1
00:00:00,000 --> 00:00:01,100
Good morning everybody.

2
00:00:01,100 --> 00:00:06,540
My name is Neil and I'll be presenting on how to use online ads as a reconnaissance and surveillance tool.

3
00:00:10,040 --> 00:00:12,480
A little about me, I'm currently a U.S.

4
00:00:12,480 --> 00:00:14,780
Army officer, 11 years in the Army.

5
00:00:15,060 --> 00:00:17,300
I got three degrees in electrical engineering and computer science.

6
00:00:17,300 --> 00:00:23,900
I'm a software developer with the Army and a personal privacy enthusiast.

7
00:00:25,060 --> 00:00:32,180
A couple of disclaimers, so all the views I present here are my own and not of the Department of Defense or any government entity.

8
00:00:33,040 --> 00:00:36,740
All accounts I used for connecting to research were created by me.

9
00:00:36,840 --> 00:00:40,240
I didn't target anybody else that didn't consent to the research.

10
00:00:40,620 --> 00:00:42,620
I don't do anything evil with this.

11
00:00:42,620 --> 00:00:48,820
And then finally, I'm a newbie when it comes to online marketing stuff, definitely not an expert, I use Qrius.

12
00:00:49,620 --> 00:00:51,320
So a little bit of background.

13
00:00:51,760 --> 00:00:55,100
Ads and ad targeting are ubiquitous online today.

14
00:00:55,100 --> 00:00:59,580
They find a lot of the services we like to use online and there's a lot of consequences of that.

15
00:00:59,580 --> 00:01:07,300
One of those consequences was covered in DEF CON 26 by HEX 200B and it really caught my eye.

16
00:01:08,080 --> 00:01:15,380
And so what HEX 200B presented was detecting blue team activities with ads.

17
00:01:15,380 --> 00:01:26,680
So his research question was, excuse me, as a red team operator, can you detect when someone, like the blue team, is searching for something unique or identifying in Google using ads?

18
00:01:26,680 --> 00:01:33,420
And so the strings that he was targeting or the search terms he was targeting was file hashes.

19
00:01:33,420 --> 00:01:36,940
And so you have a file hash of your binary or your implant.

20
00:01:38,260 --> 00:01:44,820
And one way you can detect if the blue team has detected it is if they start googling strings or hashes of that implant.

21
00:01:45,500 --> 00:01:52,120
And if you have ads on those terms, you can detect that and then take cleanup actions as required.

22
00:01:53,000 --> 00:02:03,260
As a result, it can be done, but with some considerable limitations that we'll talk about a little bit later.

23
00:02:03,400 --> 00:02:09,540
And plenty of other exploring opportunities with different ad platforms and other ways of targeting ads.

24
00:02:09,540 --> 00:02:14,060
I thought this presentation was really awesome and it inspired me to do my own research.

25
00:02:15,420 --> 00:02:21,320
So here are the research questions I went into some of the testing I did with.

26
00:02:21,320 --> 00:02:24,060
And so, first of all, I wanted to see if I replicate the research.

27
00:02:24,300 --> 00:02:26,960
I wanted to see if I could target ads specific to individuals.

28
00:02:26,980 --> 00:02:32,060
I wanted to see if I could explore other ad platforms beyond just Google, Google AdWords.

29
00:02:32,480 --> 00:02:41,440
And I wanted to see if I could over-target ads in a way to allow me to infer information about what ad platforms know about the individuals I'm targeting.

30
00:02:41,480 --> 00:02:46,140
So if any of that is possible, I want to also assess if it's practical.

31
00:02:46,140 --> 00:02:53,060
Anything from expense, to how reliable it is, to what the setup time required for it is, etc.

32
00:02:54,760 --> 00:03:02,180
So one thing to keep in mind going into using online ads for unintended purposes is overall goal is to get people to buy stuff.

33
00:03:02,380 --> 00:03:06,320
Ideally, you show ads to everybody most likely to buy something as an ad platform.

34
00:03:06,320 --> 00:03:09,980
And not only those people, but getting 100% accuracy really isn't that important.

35
00:03:09,980 --> 00:03:15,500
You just need a positive return for the marketers that are your customers.

36
00:03:16,660 --> 00:03:31,360
With that in mind, ad platforms are not necessarily optimized for deterministic delivery of ads, delivering ads exactly when you want them to, or high precision and accuracy of the user profiles or folks you're targeting.

37
00:03:34,020 --> 00:03:37,320
Online ad platforms, there's a bunch of them out there.

38
00:03:37,320 --> 00:03:39,100
They're a big business.

39
00:03:39,100 --> 00:03:41,400
The ones I looked at were Google and Facebook.

40
00:03:42,420 --> 00:03:52,940
But keep in mind, everybody pictured here has their own organic ad targeting and delivery systems that these techniques could potentially be applied to as well.

41
00:03:54,140 --> 00:03:57,200
To scope the research, I came up with a simple threat model.

42
00:03:57,800 --> 00:04:00,280
So blue, we have the Roadrunner.

43
00:04:00,280 --> 00:04:08,760
Roadrunner is a cyber analyst with the US Army stationed at Fort Meade with a mission of investigating the coyote using OSINT like Google.

44
00:04:09,080 --> 00:04:17,780
And red team coyote, a US adversary threat actor that the Roadrunner is researching.

45
00:04:17,780 --> 00:04:29,120
He's trying to use ads for evil and detect when the Roadrunner is researching the coyote using ads.

46
00:04:31,700 --> 00:04:34,620
So a couple things to keep in mind with the scenario.

47
00:04:34,620 --> 00:04:39,440
So the Roadrunner is a Google user in this scenario.

48
00:04:39,440 --> 00:04:57,120
And so using a stock Android phone with a Google account signed in and Windows 10 VM with a Chrome browser where the Roadrunner has signed in on Google before and is not in the habit of clearing cookies very often and stuff like that.

49
00:04:57,700 --> 00:05:00,200
Scenario for the coyote.

50
00:05:00,200 --> 00:05:02,720
So a couple things pointed out here.

51
00:05:02,720 --> 00:05:12,140
Coyote is set by domain name, a blog, a business to advertise on that blog, and a number of accounts on the different ad platforms.

52
00:05:14,760 --> 00:05:17,240
Right, so here's a couple screenshots of the blog.

53
00:05:17,680 --> 00:05:33,640
So coyote in the effort to attract the attention of Roadrunner and hopefully promote his ad getting shown by Google has put some of the search terms that he wants to trigger in Google AdWords in blog posts.

54
00:05:33,640 --> 00:05:44,960
And so the way Google shows ads, it's not just how much money you pay, but it's sort of an evaluation of the value of that page you're linking to.

55
00:05:44,960 --> 00:05:51,760
And so in this case, if you have keyword matches on the page you're linking to for your AdWords ad, then it's more likely to show.

56
00:05:53,540 --> 00:05:57,800
And so Google AdWords and networks, there's plenty of options to go after.

57
00:05:57,800 --> 00:05:59,860
The one we're looking at here is AdWords.

58
00:05:59,900 --> 00:06:04,500
And those are the paid results that show up in your Google searches.

59
00:06:06,800 --> 00:06:08,620
AdWords has a lot of targeting options.

60
00:06:08,620 --> 00:06:10,540
So the main one is a keyword search.

61
00:06:10,620 --> 00:06:18,880
Anything from a broad or fuzzy match to an exact match, where it's a exact match of the stream you provide, you can combine those.

62
00:06:19,140 --> 00:06:37,260
And then you can also combine it with a number of individually broad demographic parameters like language, broad interest category, user location, that when combined, can pretty effectively identify small groups of people.

63
00:06:37,640 --> 00:06:43,200
So continue on with options, IP blocking, exclusions, income level, device types.

64
00:06:43,500 --> 00:06:53,180
There's more options that you can leverage if you have a Google Ads API key, but not in the standard ad manager GUI.

65
00:06:53,380 --> 00:06:59,860
That does require additional vetting, which I was not able to pass, but we'll talk about that later.

66
00:07:01,800 --> 00:07:15,980
So here's the targeting methodology that we're using for setting up with Google AdWords, which is largely inspired by HEX 200b, with a little bit additional detail filled in.

67
00:07:16,080 --> 00:07:21,400
So first, we have to design the AdWords ad, we're using an expanded text ad, and select search terms.

68
00:07:21,400 --> 00:07:26,560
In this case, we selected a Bitcoin address that we thought Roadrunner might be interested in.

69
00:07:26,560 --> 00:07:38,980
The search term needs to be specific and low volume to make sure it only triggers on roadrunner searches and other people aren't likely to be searching for it, but not too low volume.

70
00:07:38,980 --> 00:07:47,520
And so there's minimum thresholds for search activity for different keywords that Google enforces when setting up ads.

71
00:07:47,520 --> 00:07:52,220
And so that is one of the primary challenges for conducting this sort of attack.

72
00:07:54,260 --> 00:08:07,200
So with with a search term, the way you can narrow it down from a group of people searching for something to the specific people that you want to target is by narrowing the demographic targeting options.

73
00:08:07,200 --> 00:08:11,440
And so that those are the things like the location, age that we already talked about.

74
00:08:11,440 --> 00:08:16,000
And so if you have enough target information, you can refine the audience down further.

75
00:08:16,240 --> 00:08:24,520
There are also limits on how small you can make that audience that will prevent Google from showing the ads or preventing you from buying them.

76
00:08:24,960 --> 00:08:40,320
But you can get around that somewhat by broadening your audience to the point that you meet the minimum threshold, but then adjusting the bid modifiers to the specific demographic features that you want.

77
00:08:40,320 --> 00:08:44,960
And so in this case, we know our target is between 25 and 34 years of age.

78
00:08:44,960 --> 00:08:51,040
And so we boost the amount we're willing to bid for that click up by 200 percent.

79
00:08:53,540 --> 00:08:58,980
Google reviews the ads, like the automated process, then eventually Google displays them.

80
00:08:58,980 --> 00:09:01,300
So some things to keep in mind.

81
00:09:01,560 --> 00:09:05,760
The ads, when you purchase them, aren't necessarily going to display on the first search of the target.

82
00:09:05,760 --> 00:09:11,540
Even if that target is in the audience, they might have to multiple times.

83
00:09:15,160 --> 00:09:17,300
All right, so ad is under review.

84
00:09:18,040 --> 00:09:23,520
Roadrunner is researching bad guys, researching the NotPetya actors and their Bitcoin address.

85
00:09:23,520 --> 00:09:28,600
And when we search the Bitcoin address, the Coyote ad pops up in Roadrunner's browser.

86
00:09:30,340 --> 00:09:32,980
Here's what that result looks like on Coyote's end.

87
00:09:33,000 --> 00:09:36,720
So have that little blip on the impressions.

88
00:09:37,780 --> 00:09:42,060
That's showing they got the ad triggered.

89
00:09:42,080 --> 00:09:44,540
Triggered once, and it triggered it this time.

90
00:09:46,280 --> 00:09:53,000
Going back, it also shows on the right, you can see the exact search term that the user put in.

91
00:09:53,000 --> 00:09:55,540
In this case, it was the Bitcoin address by itself.

92
00:09:55,580 --> 00:10:01,860
But if there's additional information in the search that triggered, it would appear there for the advertiser to see.

93
00:10:03,320 --> 00:10:07,020
All right, more data from the dashboard.

94
00:10:07,020 --> 00:10:16,180
So you can see some of the demographics, timing, and device types that the targeted user applied to.

95
00:10:18,550 --> 00:10:23,930
All right, so we got that example to work, but that example was somewhat canned.

96
00:10:24,150 --> 00:10:29,910
And there are some limitations that RealAttack would have to overcome to make this a practical attack.

97
00:10:30,450 --> 00:10:34,550
All right, so targeted keywords would need to have sufficient search volume.

98
00:10:34,550 --> 00:10:50,070
And so that precludes using very unique searches without doing legally questionable things on the SEO side, like getting bots to search for the term that you want before you buy an ad item.

99
00:10:50,770 --> 00:11:02,490
Ad might not display in the first or first couple target searches, so it needs to be something that the target would be repeatedly searching for if you want a very high accuracy detection rate.

100
00:11:02,950 --> 00:11:03,930
There's a reporting delay.

101
00:11:03,930 --> 00:11:08,030
In my case, it was up to a day, but ranges from hours to days.

102
00:11:09,130 --> 00:11:13,970
And it can be costly to the attacker to do this if the user is quickly on your ad.

103
00:11:14,970 --> 00:11:23,850
So in my case, once I finally got the ad to trigger, I got really excited as a roadrunner, and I clicked the ad, and I charged myself $9.40 for seeing my own ad.

104
00:11:26,870 --> 00:11:39,490
In the AdWords API, there's plenty more... there's more granular options that you can leverage, as well as all the, you know, additional programming logic or custom logic you choose to implement.

105
00:11:42,630 --> 00:11:46,050
All right, so we've covered Google platform.

106
00:11:46,050 --> 00:11:48,350
Now we're going to talk a little bit about Facebook.

107
00:11:48,450 --> 00:11:53,390
So Facebook, like Google, there's plenty of different ad types and placements.

108
00:11:54,170 --> 00:11:57,670
Anywhere from Facebook, Instagram, Messenger, that kind of stuff.

109
00:11:57,990 --> 00:12:08,890
And compared to Google AdWords, or Google ad platforms, Facebook offers much more detailed audience targeting options to your entry ad purchaser compared to Google.

110
00:12:08,890 --> 00:12:13,890
And so they offer targeting on sort of four categories.

111
00:12:14,210 --> 00:12:16,530
Demographics, interest, behaviors, and location.

112
00:12:16,530 --> 00:12:21,010
You can combine those with sort of effectively and or not operators.

113
00:12:21,010 --> 00:12:25,990
You can do relationship-based targeting and then custom audiences, which we'll touch on a little bit later.

114
00:12:27,110 --> 00:12:31,650
So audience targeting, so demographics, so this stuff like age, birthday, gender.

115
00:12:32,610 --> 00:12:37,030
This generally coincides to the data that users provide in their Facebook profiles.

116
00:12:37,030 --> 00:12:43,930
You know, it's pretty uncanny how well that matches up to information that users are expected to provide Facebook.

117
00:12:46,560 --> 00:13:00,840
On the interest side, that generally targets what users sort of have declared that they like on Facebook or groups or joining groups or pages that indicate interest in different topics.

118
00:13:00,840 --> 00:13:08,080
And so I think for entertainment, family relationships, different food or drink types, hobbies, that kind of thing.

119
00:13:08,480 --> 00:13:25,360
So like to Google targeting parameters, you know, by themselves, these things might not be terribly revealing, but when combined, you can target very specific audiences with these features.

120
00:13:28,270 --> 00:13:30,390
And finally, behaviors.

121
00:13:30,390 --> 00:13:38,530
Of all the audience targeting options, behaviors is probably the most invasive.

122
00:13:38,610 --> 00:13:57,610
And so this combines online and offline activities on or off Facebook, things like email domains you use to create Facebook, the internet browsers that you use to connect to the operating systems, what Facebook assesses your multicultural affinity or sort of cultural preferences are,

123
00:13:57,610 --> 00:14:01,310
political beliefs, purchase behavior if you traveled recently.

124
00:14:03,730 --> 00:14:15,590
And of all the behaviors, this one seems to draw the most from data collected from user devices if you've consented to the options, which are by generally default for collecting.

125
00:14:17,630 --> 00:14:19,670
I can also target by location.

126
00:14:19,770 --> 00:14:23,150
This is another place where you can get very specific.

127
00:14:23,570 --> 00:14:37,990
So by itself, if you're using one location, you can go anywhere from a broad area to an area at a specific grid coordinate and with a radius from one to 50 miles.

128
00:14:38,190 --> 00:14:49,550
So by itself, that's still somewhat broad, but if you combine include and excluded locations, you can get very specific.

129
00:14:49,550 --> 00:15:01,450
You can see on the right the Capitol building and some location targeting that will allow you to target people who have recently been in the Capitol building, U.S.

130
00:15:01,450 --> 00:15:02,370
Capitol building.

131
00:15:05,730 --> 00:15:11,390
All right, so I made a first attempt at a Facebook ad and it didn't go so well.

132
00:15:12,410 --> 00:15:16,910
And so before the ad could trigger or do anything with it, the page got unpublished.

133
00:15:17,350 --> 00:15:20,930
Facebook seemed to think I was selling fraudulent tickets for something.

134
00:15:21,810 --> 00:15:23,270
I eventually got that.

135
00:15:24,410 --> 00:15:28,630
So I had to go to plan B and wait a while for the account to get reactivated.

136
00:15:30,030 --> 00:15:31,370
To do attempt 2.

137
00:15:31,370 --> 00:15:43,930
And so attempt 2, here we are trying to target Roadrunner, where we think he works at Fort Meade, using information that we know the attacker already knows about him.

138
00:15:48,920 --> 00:16:01,380
All right, so unfortunately, it didn't get a successful result on the Facebook ads this time, but we did learn some interesting things that should fuel further research.

139
00:16:01,380 --> 00:16:12,340
And so ad didn't trigger for our target during the period I had attempted to get it to trigger, but it did trigger for other users, which was strange.

140
00:16:12,900 --> 00:16:20,840
And so I did tweak the audience parameters mid-campaign, which might have messed with how it's supposed to work.

141
00:16:21,440 --> 00:16:25,740
And some of the errors could be on my end.

142
00:16:25,740 --> 00:16:27,940
I'm brand new at this after all.

143
00:16:28,460 --> 00:16:38,560
It could be that Facebook's machine learning algorithm that determines audience targeting really isn't optimized for our unintended use case.

144
00:16:38,560 --> 00:16:45,200
Or it could be audience targeting is deliberately obfuscated for privacy reasons.

145
00:16:46,420 --> 00:16:51,220
The only thing, though, is if Facebook can charge for these clicks, they're outside my audience anyway.

146
00:16:51,220 --> 00:16:55,460
So I had to pay for clicks for users that I didn't want my product.

147
00:16:58,740 --> 00:17:05,540
So go over a couple other ad targeting features that I didn't get to experiment with, but are still something you should be aware of.

148
00:17:06,980 --> 00:17:11,240
And first one of those is customer-tailored audiences.

149
00:17:11,240 --> 00:17:17,120
And so the marketing goal for this is target specific people with ads based on previous interactions or third-party data.

150
00:17:17,120 --> 00:17:21,540
This is otherwise known as remarketing a lot of marketing literature.

151
00:17:21,820 --> 00:17:39,580
So it varies slightly from provider, but what this can look like is basically taking your customer database, taking as business, and uploading it to... uploading everything that's targetable on the platform to an ad platform.

152
00:17:39,780 --> 00:17:43,440
So also target this way through website visitors.

153
00:17:43,440 --> 00:17:53,060
If your company has apps, you can target through that identifiers embedded in those, as well as third-party data sources if you're paying data brokers or marketing firms.

154
00:17:53,960 --> 00:17:55,800
Use is restricted by platforms.

155
00:17:55,800 --> 00:17:57,280
There is some additional vetting.

156
00:17:57,560 --> 00:18:07,060
Facebook requires a business ads account to use it, and Google requires you to have no violations and pay them a lot of money in ads.

157
00:18:10,970 --> 00:18:14,170
Here's an example of what the Facebook custom audience looks like.

158
00:18:14,170 --> 00:18:22,490
And so you can target by email, phone, advertising ID on a phone, names, dates of birth, and a bunch of other information.

159
00:18:24,790 --> 00:18:36,890
So there's a lot of research already done on exploiting custom audience sizes and defeating some of the protections that ad platforms have implemented for these.

160
00:18:36,890 --> 00:18:41,010
And so most platforms implement a minimum audience size.

161
00:18:41,030 --> 00:18:47,470
They only provide estimator obfuscated sizes for audiences when you upload your customer database.

162
00:18:48,210 --> 00:19:00,190
And some other platform-dependent things that aren't necessarily public knowledge for the ad purchasers.

163
00:19:00,190 --> 00:19:15,970
So I've got three papers here that I recommend you take a look at if you're interested later on how some smart folks figure out how to defeat that and we're able to target individual people using these custom audiences.

164
00:19:20,010 --> 00:19:26,350
One example is an article from Gizmodo a couple years ago, 2018 I believe.

165
00:19:26,350 --> 00:19:47,830
So one of those researchers worked with a journalist and the journalist was able to target that researcher using an office phone number that he never provided to Facebook, and with the conclusion being that Facebook somehow collected that office phone number for that researcher through some other third-party source.

166
00:19:50,010 --> 00:20:00,850
Twitter also got into trouble for using personal data that wasn't supposed to be for advertising for advertising, in this case two-factor phone numbers.

167
00:20:03,330 --> 00:20:08,290
I'm running a little bit out of time here, but let's very briefly go over this.

168
00:20:08,290 --> 00:20:26,650
But ads over-targeting, basically this is over-targeting ads in a way, over-targeting ads using all possible combinations of sort of the parameters you want to enumerate, seeing which ads trigger, and using the ad platform to tell you information about that user.

169
00:20:27,470 --> 00:20:33,490
So here's an example for enumerating operating system and browser for our Roadrunner.

170
00:20:33,490 --> 00:20:40,170
I didn't get to test this because we couldn't get the Facebook ad to work, but plan on experimenting with that in the future.

171
00:20:41,690 --> 00:20:47,530
All right, so we've talked about all the creepy things you can do with ads, so we'll talk now about mitigations and defenses.

172
00:20:49,010 --> 00:21:08,690
So if you're ad platform, we've seen that doing things like adding noise, noise to the target of advertisements, raising minimum sizes of custom audiences, obfuscating audience sizes, and, you know, allowing opt-outs to partially solve the problem or make it more difficult for attackers,

173
00:21:09,030 --> 00:21:11,590
give some more options to consumers.

174
00:21:11,730 --> 00:21:19,090
But really, there are some still fundamental problems with those approaches.

175
00:21:19,090 --> 00:21:25,730
And so the problem is that individual ad targeting is sort of inherent to the business model of a lot of these ad platforms.

176
00:21:25,730 --> 00:21:32,110
It's what their primary customers, the marketers and the purchasers of advertisements, what they want.

177
00:21:32,190 --> 00:21:46,670
It allows those advertisers to demonstrate that this ad directly led to this sale, and people can make very data-driven arguments to their executives about how their marketing budgets are making a difference.

178
00:21:47,130 --> 00:21:58,760
All right, so some of the things that Facebook has added to at least provide some transparency with this is ads library.

179
00:21:58,760 --> 00:22:03,880
And so you can look up ads that are active on Facebook recently using their ads library.

180
00:22:06,800 --> 00:22:09,120
So mitigations for marketers.

181
00:22:11,100 --> 00:22:12,900
Same fundamental problems here.

182
00:22:12,900 --> 00:22:15,380
Individual targeting is what marketers want.

183
00:22:17,540 --> 00:22:25,260
There's some things they could do, whether it's adjusting privacy policies to provide more transparency or minimize customer information.

184
00:22:25,260 --> 00:22:31,800
But ultimately, that undercuts their effective targeting of users in the bottom line.

185
00:22:34,350 --> 00:22:38,510
All right, so what can individuals do about this kind of thing?

186
00:22:38,510 --> 00:22:40,910
So good news is there are some easy wins.

187
00:22:41,070 --> 00:22:49,430
You know, some of that good internet browsing hygiene will prevent a lot of these techniques from being used on you.

188
00:22:49,430 --> 00:23:03,890
So signing out of accounts in browsers you don't need, including browser cookies, using privacy-friendly browser plugins and settings, using some OPSEC on search engines, using privacy-protecting search engines, that kind of stuff.

189
00:23:04,130 --> 00:23:07,810
There's also some less convenient and possibly more paranoid things you can do.

190
00:23:08,310 --> 00:23:12,330
One thing I noticed, targeting the ads, especially going by location.

191
00:23:12,330 --> 00:23:21,490
Google trusts the location and pulls off of mobile devices, but if you use location services, much more than any sort of data you self-report.

192
00:23:22,370 --> 00:23:30,510
But the problem is that's harder to avoid, especially when, if you're using an Android phone, most Android phones are going to require you to set up a Google account.

193
00:23:30,510 --> 00:23:35,190
You have Google Play services and all of its information collection on your handset.

194
00:23:41,700 --> 00:23:48,220
All right, so we talked about sort of the theoretical uses of ads for different purposes.

195
00:23:48,220 --> 00:23:49,360
Here's a couple of examples.

196
00:23:49,360 --> 00:24:03,360
So back in 2018 or 2019, I've seen an article about FBI running Facebook ads to target Russians in Washington, presumably to get them to come into the field office and tell them what they know about Russian interference.

197
00:24:05,400 --> 00:24:24,900
Also more recently, political groups, in this case, political groups looking to mobilize protesters at recent protests against police brutality to target them with ads to continue the political fight in support of their chosen cause.

198
00:24:28,080 --> 00:24:38,500
One thing we run into that's hard to mitigate here is you can control somewhat what you provide yourself, but it's very hard to control what other people provide about you.

199
00:24:38,860 --> 00:24:44,300
And the ad platforms have shown generally to leverage information other people provide about you.

200
00:24:44,300 --> 00:24:58,860
Same thing from government public records to data brokers, other marketers, other third-party sources, and finally friends sharing contact lists, emails, and other personnel info with Snoopy apps and services.

201
00:24:58,860 --> 00:25:02,680
So you might be individually be Mr.

202
00:25:02,680 --> 00:25:03,100
or Mrs.

203
00:25:03,100 --> 00:25:14,600
Super Opsec, but if your friends are using these apps and uploading their contacts and not paying attention to privacy settings, you can still be very exposed to all this.

204
00:25:16,340 --> 00:25:18,240
That's some conclusions.

205
00:25:18,240 --> 00:25:23,120
I think we've demonstrated that there's some potential abuse of these systems.

206
00:25:23,320 --> 00:25:32,440
A lot of the techniques that I proposed or tested are sort of inherent, or they take advantage of inherent features of ad delivery platforms.

207
00:25:32,440 --> 00:25:36,820
It'd be hard to completely fix these sorts of issues on a major overhaul.

208
00:25:37,580 --> 00:25:43,120
Low budget ad surveillance, like I was doing, it's probably only effective in very specific scenarios.

209
00:25:44,300 --> 00:25:54,480
But given more budget and more expertise, I could see this being effective for people who know what they're doing with it.

210
00:25:55,320 --> 00:25:58,520
Also sort of reinforces surveillance capitalism is still pretty creepy.

211
00:25:58,740 --> 00:26:04,600
And finally, I definitely underestimated the amount of time I should have spent on this and I procrastinated.

212
00:26:05,020 --> 00:26:06,400
Hopefully it doesn't show too bad.

213
00:26:07,920 --> 00:26:16,080
Some future research plans, plan on trying to get those API key accesses and accounts.

214
00:26:16,660 --> 00:26:22,100
See if I automate some of the ads management, like a lot of the professional researchers did.

215
00:26:24,580 --> 00:26:27,580
Score over-targeting, see if that's something that can be done or not.

216
00:26:27,580 --> 00:26:32,120
Hopefully find some experts to work with and better know what they're doing.

217
00:26:33,680 --> 00:26:41,740
Finally, I'd like to give some thanks, first of all, to Hex200B for his initial presentation that inspired a lot of my work.

218
00:26:41,860 --> 00:26:46,040
A big thank you to Crypto and Privacy Village staff for putting on this event.

219
00:26:46,240 --> 00:26:56,800
And finally, to all the attendees that decided to spend time in this presentation, especially DEF CON, there's infinite number of presentations or other activities you could be doing.

220
00:26:57,240 --> 00:27:02,060
Right now, thank you for choosing to spend it with Crypto, Privacy Village, and myself.

221
00:27:02,540 --> 00:27:06,520
At this time, I open it up for questions and comments.

222
00:27:15,250 --> 00:27:16,150
All right.

223
00:27:16,150 --> 00:27:17,230
Thank you to Neil M.

224
00:27:17,230 --> 00:27:22,030
for this terrific talk that we just saw, online ads as a recon and surveillance tool.

225
00:27:22,030 --> 00:27:25,610
We have our speaker here to do a little bit of Q&A with us.

226
00:27:25,610 --> 00:27:26,750
Hi there, Neil.

227
00:27:27,270 --> 00:27:38,330
I want to first mention Neil has put a link in the Discord Q&A channel to a PDF of the presentation to be more easily referenced if any of you have questions to take a look at that.

228
00:27:39,230 --> 00:27:54,030
We have something that is sort of a question, sort of a comment that I found interesting and thought maybe you could you could comment on, Neil, that the subtle implication of your talk is that emitting unique strings can help bad guys, even though we traditionally think of this as something that helps good guys,

229
00:27:54,030 --> 00:27:55,570
for example, to do AP signatures.

230
00:27:55,570 --> 00:27:57,410
Is that something you can comment on?

231
00:27:57,730 --> 00:27:58,910
Yes, definitely.

232
00:27:58,910 --> 00:28:04,770
And it was touched on during Hex200B's talk a couple of years ago as well.

233
00:28:04,790 --> 00:28:24,350
And so the one thing he found in either through his research or asking other folks is like antivirus companies, for example, will take out ads for things like file hashes and stuff that they recently discovered for detection purposes as well as promoting their own services.

234
00:28:24,350 --> 00:28:28,370
But it definitely goes both ways.

235
00:28:30,050 --> 00:28:37,410
Google can see what you're doing and if Google can see it, then their marketing customers can potentially see it as well.

236
00:28:38,790 --> 00:28:39,430
Great.

237
00:28:39,430 --> 00:28:47,910
Well, I actually found this to be a really interesting talk because I started out my career right after college as a temp doing AdWords ads at Google.

238
00:28:48,070 --> 00:28:52,190
So I want to thank you for a fascinating contribution.

239
00:28:52,350 --> 00:29:01,650
Have you had any pushback from Google or any intervention or have you been keeping this enough on the DL to evade the eye of Sauron there?

240
00:29:02,130 --> 00:29:04,730
Oh, well, we'll see after this talk, I guess.

241
00:29:04,730 --> 00:29:10,470
But yeah, so far, I haven't gotten enough attention to even get my API key approved yet.

242
00:29:10,470 --> 00:29:11,990
So I think I'm okay.

243
00:29:13,610 --> 00:29:14,250
Wonderful.

244
00:29:14,250 --> 00:29:14,690
All right.

245
00:29:14,690 --> 00:29:17,070
Well, thank you again so much for this talk.

246
00:29:17,070 --> 00:29:19,530
We hope you have a great rest of your DEF CON.

247
00:29:20,710 --> 00:29:21,030
All right.

248
00:29:21,030 --> 00:29:21,330
Thank you.

249
00:29:21,330 --> 00:29:21,990
You as well.

250
00:29:22,070 --> 00:29:22,630
Thank you.

251
00:29:22,630 --> 00:29:22,970
Take care.