Good morning everybody. My name is Neil and I'll be presenting on how to use online ads
as a reconnaissance and surveillance tool. A little about me, I'm currently a U.S. Army
officer, 11 years in the Army. I got three degrees in electrical engineering and computer
science. I'm a software developer with the Army and a personal privacy enthusiast. A
couple of disclaimers, so all the views I present here are my own and not of the Department
of Defense or any government entity. All accounts I used for connecting to research
were created by me. I didn't target anybody else that didn't consent to the research.
I don't do anything evil with this. And then finally, I'm a newbie when it comes to online
marketing stuff, definitely not an expert, I use Qrius. So a little bit of background.
Ads and ad targeting are ubiquitous online today. They find a lot of the services we
like to use online and there's a lot of consequences of that. One of those consequences was covered
in DEF CON 26 by HEX 200B and it really caught my eye. And so what HEX 200B presented was
detecting blue team activities with ads. So his research question was, excuse me, as a
red team operator, can you detect when someone, like the blue team, is searching for something
unique or identifying in Google using ads? And so the strings that he was targeting or
the search terms he was targeting was file hashes. And so you have a file hash of your
binary or your implant. And one way you can detect if the blue team has detected it is
if they start googling strings or hashes of that implant. And if you have ads on those
terms, you can detect that and then take cleanup actions as required. As a result, it can be done,
but with some considerable limitations that we'll talk about a little bit later. And plenty of other
exploring opportunities with different ad platforms and other ways of targeting ads. I thought this
presentation was really awesome and it inspired me to do my own research. So here are the research
questions I went into some of the testing I did with. And so, first of all, I wanted to see if I
replicate the research. I wanted to see if I could target ads specific to individuals. I wanted to
see if I could explore other ad platforms beyond just Google, Google AdWords. And I wanted to see
if I could over-target ads in a way to allow me to infer information about what ad platforms know
about the individuals I'm targeting. So if any of that is possible, I want to also assess if it's
practical. Anything from expense, to how reliable it is, to what the setup time required for it is,
etc. So one thing to keep in mind going into using online ads for unintended purposes is overall
goal is to get people to buy stuff. Ideally, you show ads to everybody most likely to buy something
as an ad platform. And not only those people, but getting 100% accuracy really isn't that
important. You just need a positive return for the marketers that are your customers.
With that in mind, ad platforms are not necessarily optimized for deterministic delivery of ads,
delivering ads exactly when you want them to, or high precision and accuracy of the user profiles
or folks you're targeting. Online ad platforms, there's a bunch of them out there. They're a big
business. The ones I looked at were Google and Facebook. But keep in mind, everybody pictured
here has their own organic ad targeting and delivery systems that these techniques could
potentially be applied to as well. To scope the research, I came up with a simple threat model.
So blue, we have the Roadrunner. Roadrunner is a cyber analyst with the US Army stationed at Fort
Meade with a mission of investigating the coyote using OSINT like Google. And red team coyote,
a US adversary threat actor that the Roadrunner is researching. He's trying to use ads for evil
and detect when the Roadrunner is researching the coyote using ads. So a couple things to keep in
mind with the scenario. So the Roadrunner is a Google user in this scenario. And so using a
stock Android phone with a Google account signed in and Windows 10 VM with a Chrome browser where
the Roadrunner has signed in on Google before and is not in the habit of clearing cookies very
often and stuff like that. Scenario for the coyote. So a couple things pointed out here.
Coyote is set by domain name, a blog, a business to advertise on that blog, and a number of accounts
on the different ad platforms. Right, so here's a couple screenshots of the blog. So coyote in
the effort to attract the attention of Roadrunner and hopefully promote his ad getting shown by
Google has put some of the search terms that he wants to trigger in Google AdWords in blog posts.
And so the way Google shows ads, it's not just how much money you pay, but it's sort of an
evaluation of the value of that page you're linking to. And so in this case, if you have keyword
matches on the page you're linking to for your AdWords ad, then it's more likely to show. And so
Google AdWords and networks, there's plenty of options to go after. The one we're looking at
here is AdWords. And those are the paid results that show up in your Google searches. AdWords
has a lot of targeting options. So the main one is a keyword search. Anything from a broad or fuzzy
match to an exact match, where it's a exact match of the stream you provide, you can combine those.
And then you can also combine it with a number of individually broad demographic parameters like
language, broad interest category, user location, that when combined, can pretty effectively
identify small groups of people. So continue on with options, IP blocking, exclusions, income
level, device types. There's more options that you can leverage if you have a Google Ads API key, but
not in the standard ad manager GUI. That does require additional vetting, which I was not able to
pass, but we'll talk about that later. So here's the targeting methodology that we're using for
setting up with Google AdWords, which is largely inspired by HEX 200b, with a little bit additional
detail filled in. So first, we have to design the AdWords ad, we're using an expanded text ad, and
select search terms. In this case, we selected a Bitcoin address that we thought Roadrunner might be
interested in. The search term needs to be specific and low volume to make sure it only triggers on
roadrunner searches and other people aren't likely to be searching for it, but not too low volume. And
so there's minimum thresholds for search activity for different keywords that Google enforces when
setting up ads. And so that is one of the primary challenges for conducting this sort of attack. So
with with a search term, the way you can narrow it down from a group of people searching for something
to the specific people that you want to target is by narrowing the demographic targeting options. And
so that those are the things like the location, age that we already talked about. And so if you have
enough target information, you can refine the audience down further. There are also limits on
how small you can make that audience that will prevent Google from showing the ads or preventing
you from buying them. But you can get around that somewhat by broadening your audience to the point
that you meet the minimum threshold, but then adjusting the bid modifiers to the specific
demographic features that you want. And so in this case, we know our target is between 25 and 34 years
of age. And so we boost the amount we're willing to bid for that click up by 200 percent.
Google reviews the ads, like the automated process, then eventually Google displays them. So
some things to keep in mind. The ads, when you purchase them, aren't necessarily going to display
on the first search of the target. Even if that target is in the audience, they might have to
multiple times. All right, so ad is under review. Roadrunner is researching bad guys, researching
the NotPetya actors and their Bitcoin address. And when we search the Bitcoin address, the Coyote ad
pops up in Roadrunner's browser. Here's what that result looks like on Coyote's end. So
have that little blip on the impressions. That's showing
they got the ad triggered. Triggered once, and it triggered it this time.
Going back, it also shows on the right, you can see the exact search term that the user put in.
In this case, it was the Bitcoin address by itself. But if there's additional information
in the search that triggered, it would appear there for the advertiser to see.
All right, more data from the dashboard. So you can see some of the demographics,
timing, and device types that the targeted user applied to.
All right, so we got that example to work, but that example was somewhat canned.
And there are some limitations that RealAttack would have to overcome to make this a practical
attack. All right, so targeted keywords would need to have sufficient search volume. And so
that precludes using very unique searches without doing legally questionable things
on the SEO side, like getting bots to search for the term that you want before you buy an ad item.
Ad might not display in the first or first couple target searches, so it needs to be something that
the target would be repeatedly searching for if you want a very high accuracy detection rate.
There's a reporting delay. In my case, it was up to a day, but ranges from hours to days.
And it can be costly to the attacker to do this if the user is quickly on your ad.
So in my case, once I finally got the ad to trigger, I got really excited as a roadrunner,
and I clicked the ad, and I charged myself $9.40 for seeing my own ad.
In the AdWords API, there's plenty more... there's more granular options that you can leverage,
as well as all the, you know, additional programming logic or custom logic you choose to implement.
All right, so we've covered Google platform. Now we're going to talk a little bit about Facebook.
So Facebook, like Google, there's plenty of different ad types and placements.
Anywhere from Facebook, Instagram, Messenger, that kind of stuff.
And compared to Google AdWords, or Google ad platforms, Facebook offers much more detailed
audience targeting options to your entry ad purchaser compared to Google. And so they
offer targeting on sort of four categories. Demographics, interest, behaviors, and location.
You can combine those with sort of effectively and or not operators. You can do relationship-based
targeting and then custom audiences, which we'll touch on a little bit later.
So audience targeting, so demographics, so this stuff like age, birthday, gender.
This generally coincides to the data that users provide in their Facebook profiles. You know,
it's pretty uncanny how well that matches up to information that users are expected to provide
Facebook. On the interest side, that generally targets what users sort of have declared that
they like on Facebook or groups or joining groups or pages that indicate interest in different
topics. And so I think for entertainment, family relationships, different food or drink types,
hobbies, that kind of thing. So like to Google targeting parameters, you know, by themselves,
these things might not be terribly revealing, but when combined, you can target very specific
audiences with these features. And finally, behaviors. Of all the audience targeting
options, behaviors is probably the most invasive. And so this combines online and offline activities
on or off Facebook, things like email domains you use to create Facebook, the internet browsers
that you use to connect to the operating systems, what Facebook assesses your multicultural affinity
or sort of cultural preferences are, political beliefs, purchase behavior if you traveled recently.
And of all the behaviors, this one seems to draw the most from data collected from user devices if
you've consented to the options, which are by generally default for collecting.
I can also target by location. This is another place where you can get very specific. So by itself,
if you're using one location, you can go anywhere from a broad area to an area at a specific grid
coordinate and with a radius from one to 50 miles. So by itself, that's still somewhat broad,
but if you combine include and excluded locations, you can get very specific. You can see on the right
the Capitol building and some location targeting that will allow you to target people
who have recently been in the Capitol building, U.S. Capitol building.
All right, so I made a first attempt at a Facebook ad and it didn't go so well.
And so before the ad could trigger or do anything with it, the page got unpublished.
Facebook seemed to think I was selling fraudulent tickets for something. I eventually got that.
So I had to go to plan B and wait a while for the account to get reactivated.
To do attempt 2. And so attempt 2, here we are trying to target Roadrunner, where we think he
works at Fort Meade, using information that we know the attacker already knows about him.
All right, so unfortunately, it didn't get a successful result on the Facebook ads
this time, but we did learn some interesting things that should fuel further research. And so
ad didn't trigger for our target during the period I had attempted to get it to trigger,
but it did trigger for other users, which was strange. And so I did tweak the audience
parameters mid-campaign, which might have messed with how it's supposed to work. And
some of the errors could be on my end. I'm brand new at this after all. It could be that
Facebook's machine learning algorithm that determines audience targeting really isn't
optimized for our unintended use case. Or it could be audience targeting is deliberately obfuscated
for privacy reasons. The only thing, though, is if Facebook can charge for these clicks,
they're outside my audience anyway. So I had to pay for clicks for users that I didn't want
my product. So go over a couple other ad targeting features that I didn't get to
experiment with, but are still something you should be aware of. And first one of those is
customer-tailored audiences. And so the marketing goal for this is target specific people with ads
based on previous interactions or third-party data. This is otherwise known as remarketing
a lot of marketing literature. So it varies slightly from provider, but
what this can look like is basically taking your customer database, taking as business,
and uploading it to... uploading everything that's targetable on the platform to an ad platform.
So also target this way through website visitors. If your company has apps, you can target through
that identifiers embedded in those, as well as third-party data sources if you're paying
data brokers or marketing firms. Use is restricted by platforms. There is some additional vetting.
Facebook requires a business ads account to use it, and Google requires you to have no violations
and pay them a lot of money in ads. Here's an example of what the Facebook custom audience
looks like. And so you can target by email, phone,
advertising ID on a phone, names, dates of birth, and a bunch of other information.
So there's a lot of research already done on exploiting custom audience sizes
and defeating some of the protections that ad platforms have implemented for these. And so
most platforms implement a minimum audience size. They only provide estimator obfuscated sizes for
audiences when you upload your customer database. And some other platform-dependent things that
aren't necessarily public knowledge for the ad purchasers. So I've got three papers here that I
recommend you take a look at if you're interested later on how some smart folks figure out how to
defeat that and we're able to target individual people using these custom audiences.
One example is an article from Gizmodo a couple years ago, 2018 I believe. So one of those
researchers worked with a journalist and the journalist was able to target that researcher
using an office phone number that he never provided to Facebook, and with the conclusion
being that Facebook somehow collected that office phone number for that researcher through some other
third-party source. Twitter also got into trouble for using personal data that wasn't supposed to
be for advertising for advertising, in this case two-factor phone numbers.
I'm running a little bit out of time here, but let's very briefly go over this. But ads
over-targeting, basically this is over-targeting ads in a way, over-targeting ads using all
possible combinations of sort of the parameters you want to enumerate, seeing which ads trigger,
and using the ad platform to tell you information about that user.
So here's an example for enumerating operating system and browser for our Roadrunner. I didn't
get to test this because we couldn't get the Facebook ad to work, but plan on experimenting
with that in the future. All right, so we've talked about all the creepy things you can do with ads,
so we'll talk now about mitigations and defenses. So if you're ad platform, we've seen that
doing things like adding noise, noise to the target of advertisements,
raising minimum sizes of custom audiences, obfuscating audience sizes, and, you know,
allowing opt-outs to partially solve the problem or make it more difficult for attackers,
give some more options to consumers. But really, there are some still fundamental problems with
those approaches. And so the problem is that individual ad targeting is sort of inherent to
the business model of a lot of these ad platforms. It's what their primary customers, the marketers
and the purchasers of advertisements, what they want. It allows those advertisers to
demonstrate that this ad directly led to this sale, and people can make very data-driven
arguments to their executives about how their marketing budgets are making a difference.
All right, so some of the things that Facebook has added to at least provide some transparency
with this is ads library. And so you can look up ads that are active on Facebook recently using
their ads library. So mitigations for marketers. Same fundamental problems here. Individual
targeting is what marketers want. There's some things they could do, whether it's adjusting
privacy policies to provide more transparency or minimize customer information. But ultimately,
that undercuts their effective targeting of users in the bottom line. All right,
so what can individuals do about this kind of thing? So good news is there are some easy wins.
You know, some of that good internet browsing hygiene will prevent a lot of these techniques
from being used on you. So signing out of accounts in browsers you don't need, including browser
cookies, using privacy-friendly browser plugins and settings, using some OPSEC on search engines,
using privacy-protecting search engines, that kind of stuff. There's also some less convenient
and possibly more paranoid things you can do. One thing I noticed, targeting the ads, especially
going by location. Google trusts the location and pulls off of mobile devices, but if you use
location services, much more than any sort of data you self-report. But the problem is that's
harder to avoid, especially when, if you're using an Android phone, most Android phones are going to
require you to set up a Google account. You have Google Play services and all of its information
collection on your handset. All right, so we talked about sort of the theoretical uses of ads for
different purposes. Here's a couple of examples. So back in 2018 or 2019, I've seen an article about
FBI running Facebook ads to target Russians in Washington, presumably to get them to come
into the field office and tell them what they know about Russian interference.
Also more recently, political groups, in this case, political groups looking to mobilize
protesters at recent protests against police brutality
to target them with ads to continue the political fight in support of their chosen cause.
One thing we run into that's hard to mitigate here is you can control somewhat what you provide
yourself, but it's very hard to control what other people provide about you. And the ad platforms have
shown generally to leverage information other people provide about you. Same thing from government
public records to data brokers, other marketers, other third-party sources, and finally friends
sharing contact lists, emails, and other personnel info with Snoopy apps and services. So you might be
individually be Mr. or Mrs. Super Opsec, but if your friends are using these apps
and uploading their contacts and not paying attention to
privacy settings, you can still be very exposed to all this.
That's some conclusions. I think we've demonstrated that there's some potential abuse
of these systems. A lot of the techniques that I proposed or tested are sort of inherent, or they
take advantage of inherent features of ad delivery platforms. It'd be hard to completely fix these
sorts of issues on a major overhaul. Low budget ad surveillance, like I was doing, it's probably only
effective in very specific scenarios. But given more budget and more expertise, I could see this
being effective for people who know what they're doing with it.
Also sort of reinforces surveillance capitalism is still pretty creepy. And finally, I definitely
underestimated the amount of time I should have spent on this and I procrastinated.
Hopefully it doesn't show too bad. Some future research plans, plan on trying to get those API
key accesses and accounts. See if I automate some of the ads management, like a lot of the
professional researchers did. Score over-targeting, see if that's something that can be done or not.
Hopefully find some experts to work with and better know what they're doing.
Finally, I'd like to give some thanks, first of all, to Hex200B for his initial presentation that
inspired a lot of my work. A big thank you to Crypto and Privacy Village staff for putting
on this event. And finally, to all the attendees that decided to spend time in this presentation,
especially DEF CON, there's infinite number of presentations or other activities you could be
doing. Right now, thank you for choosing to spend it with Crypto, Privacy Village, and myself.
At this time, I open it up for questions and comments.
All right. Thank you to Neil M. for this terrific talk that we just saw,
online ads as a recon and surveillance tool. We have our speaker here to do a little bit of Q&A
with us. Hi there, Neil. I want to first mention Neil has put a link in the Discord Q&A channel
to a PDF of the presentation to be more easily referenced if any of you have questions to take
a look at that. We have something that is sort of a question, sort of a comment that I found
interesting and thought maybe you could you could comment on, Neil, that the subtle implication
of your talk is that emitting unique strings can help bad guys, even though we traditionally think
of this as something that helps good guys, for example, to do AP signatures. Is that something
you can comment on? Yes, definitely. And it was touched on during Hex200B's talk a couple of
years ago as well. And so the one thing he found in either through his research or asking other
folks is like antivirus companies, for example, will take out ads for things like file hashes
and stuff that they recently discovered for detection purposes as well as promoting their
own services. But it definitely goes both ways. Google can see what you're doing and
if Google can see it, then their marketing customers can potentially see it as well.
Great. Well, I actually found this to be a really interesting talk because I started out my career
right after college as a temp doing AdWords ads at Google. So I want to thank you for a
fascinating contribution. Have you had any pushback from Google or any intervention or
have you been keeping this enough on the DL to evade the eye of Sauron there?
Oh, well, we'll see after this talk, I guess. But yeah, so far, I haven't gotten enough
attention to even get my API key approved yet. So I think I'm okay.
Wonderful. All right. Well, thank you again so much for this talk. We hope you have a great
rest of your DEF CON. All right. Thank you. You as well. Thank you. Take care.