start	end	text
0	3960	Good morning everybody. My name is Neil and I'll be presenting on how to use online ads
3960	12660	as a reconnaissance and surveillance tool. A little about me, I'm currently a U.S. Army
12660	16700	officer, 11 years in the Army. I got three degrees in electrical engineering and computer
16700	25540	science. I'm a software developer with the Army and a personal privacy enthusiast. A
25540	30360	couple of disclaimers, so all the views I present here are my own and not of the Department
30360	35340	of Defense or any government entity. All accounts I used for connecting to research
35340	40240	were created by me. I didn't target anybody else that didn't consent to the research.
40620	45740	I don't do anything evil with this. And then finally, I'm a newbie when it comes to online
45740	51320	marketing stuff, definitely not an expert, I use Qrius. So a little bit of background.
51760	56540	Ads and ad targeting are ubiquitous online today. They find a lot of the services we
56540	61860	like to use online and there's a lot of consequences of that. One of those consequences was covered
61860	71880	in DEF CON 26 by HEX 200B and it really caught my eye. And so what HEX 200B presented was
71880	79320	detecting blue team activities with ads. So his research question was, excuse me, as a
79320	83740	red team operator, can you detect when someone, like the blue team, is searching for something
83740	90280	unique or identifying in Google using ads? And so the strings that he was targeting or
90280	94680	the search terms he was targeting was file hashes. And so you have a file hash of your
94680	101120	binary or your implant. And one way you can detect if the blue team has detected it is
101120	106760	if they start googling strings or hashes of that implant. And if you have ads on those
106760	117640	terms, you can detect that and then take cleanup actions as required. As a result, it can be done,
117640	124720	but with some considerable limitations that we'll talk about a little bit later. And plenty of other
124720	130140	exploring opportunities with different ad platforms and other ways of targeting ads. I thought this
130140	136520	presentation was really awesome and it inspired me to do my own research. So here are the research
136520	142600	questions I went into some of the testing I did with. And so, first of all, I wanted to see if I
142600	147580	replicate the research. I wanted to see if I could target ads specific to individuals. I wanted to
147580	153040	see if I could explore other ad platforms beyond just Google, Google AdWords. And I wanted to see
153040	158420	if I could over-target ads in a way to allow me to infer information about what ad platforms know
158420	165520	about the individuals I'm targeting. So if any of that is possible, I want to also assess if it's
165520	172220	practical. Anything from expense, to how reliable it is, to what the setup time required for it is,
172220	180180	etc. So one thing to keep in mind going into using online ads for unintended purposes is overall
180180	185300	goal is to get people to buy stuff. Ideally, you show ads to everybody most likely to buy something
185300	189420	as an ad platform. And not only those people, but getting 100% accuracy really isn't that
189420	195500	important. You just need a positive return for the marketers that are your customers.
196660	202420	With that in mind, ad platforms are not necessarily optimized for deterministic delivery of ads,
202420	209340	delivering ads exactly when you want them to, or high precision and accuracy of the user profiles
209340	218020	or folks you're targeting. Online ad platforms, there's a bunch of them out there. They're a big
218020	223900	business. The ones I looked at were Google and Facebook. But keep in mind, everybody pictured
223900	230520	here has their own organic ad targeting and delivery systems that these techniques could
230520	237200	potentially be applied to as well. To scope the research, I came up with a simple threat model.
237800	244260	So blue, we have the Roadrunner. Roadrunner is a cyber analyst with the US Army stationed at Fort
244260	251360	Meade with a mission of investigating the coyote using OSINT like Google. And red team coyote,
252220	259240	a US adversary threat actor that the Roadrunner is researching. He's trying to use ads for evil
259240	273480	and detect when the Roadrunner is researching the coyote using ads. So a couple things to keep in
273480	281780	mind with the scenario. So the Roadrunner is a Google user in this scenario. And so using a
281780	288240	stock Android phone with a Google account signed in and Windows 10 VM with a Chrome browser where
288240	294000	the Roadrunner has signed in on Google before and is not in the habit of clearing cookies very
294000	302720	often and stuff like that. Scenario for the coyote. So a couple things pointed out here.
302720	310540	Coyote is set by domain name, a blog, a business to advertise on that blog, and a number of accounts
310540	319480	on the different ad platforms. Right, so here's a couple screenshots of the blog. So coyote in
319480	326280	the effort to attract the attention of Roadrunner and hopefully promote his ad getting shown by
326280	333640	Google has put some of the search terms that he wants to trigger in Google AdWords in blog posts.
333640	341380	And so the way Google shows ads, it's not just how much money you pay, but it's sort of an
341380	346900	evaluation of the value of that page you're linking to. And so in this case, if you have keyword
346900	354040	matches on the page you're linking to for your AdWords ad, then it's more likely to show. And so
354040	358640	Google AdWords and networks, there's plenty of options to go after. The one we're looking at
358640	367200	here is AdWords. And those are the paid results that show up in your Google searches. AdWords
367200	372040	has a lot of targeting options. So the main one is a keyword search. Anything from a broad or fuzzy
372040	378880	match to an exact match, where it's a exact match of the stream you provide, you can combine those.
379140	386680	And then you can also combine it with a number of individually broad demographic parameters like
386680	394420	language, broad interest category, user location, that when combined, can pretty effectively
395320	401060	identify small groups of people. So continue on with options, IP blocking, exclusions, income
401060	410220	level, device types. There's more options that you can leverage if you have a Google Ads API key, but
410220	417540	not in the standard ad manager GUI. That does require additional vetting, which I was not able to
417540	426620	pass, but we'll talk about that later. So here's the targeting methodology that we're using for
426620	434500	setting up with Google AdWords, which is largely inspired by HEX 200b, with a little bit additional
434500	440360	detail filled in. So first, we have to design the AdWords ad, we're using an expanded text ad, and
440360	445320	select search terms. In this case, we selected a Bitcoin address that we thought Roadrunner might be
445320	451460	interested in. The search term needs to be specific and low volume to make sure it only triggers on
453420	459000	roadrunner searches and other people aren't likely to be searching for it, but not too low volume. And
459000	465540	so there's minimum thresholds for search activity for different keywords that Google enforces when
466520	474660	setting up ads. And so that is one of the primary challenges for conducting this sort of attack. So
476040	481020	with with a search term, the way you can narrow it down from a group of people searching for something
481020	487200	to the specific people that you want to target is by narrowing the demographic targeting options. And
487200	492000	so that those are the things like the location, age that we already talked about. And so if you have
492000	497540	enough target information, you can refine the audience down further. There are also limits on
497540	502580	how small you can make that audience that will prevent Google from showing the ads or preventing
502580	511720	you from buying them. But you can get around that somewhat by broadening your audience to the point
511720	517120	that you meet the minimum threshold, but then adjusting the bid modifiers to the specific
517120	524320	demographic features that you want. And so in this case, we know our target is between 25 and 34 years
524320	531040	of age. And so we boost the amount we're willing to bid for that click up by 200 percent.
533540	539080	Google reviews the ads, like the automated process, then eventually Google displays them. So
539680	544220	some things to keep in mind. The ads, when you purchase them, aren't necessarily going to display
544220	550040	on the first search of the target. Even if that target is in the audience, they might have to
550040	560180	multiple times. All right, so ad is under review. Roadrunner is researching bad guys, researching
560180	566420	the NotPetya actors and their Bitcoin address. And when we search the Bitcoin address, the Coyote ad
566420	573520	pops up in Roadrunner's browser. Here's what that result looks like on Coyote's end. So
574240	578680	have that little blip on the impressions. That's showing
580240	584540	they got the ad triggered. Triggered once, and it triggered it this time.
586280	593000	Going back, it also shows on the right, you can see the exact search term that the user put in.
593000	597240	In this case, it was the Bitcoin address by itself. But if there's additional information
597740	601860	in the search that triggered, it would appear there for the advertiser to see.
603320	609240	All right, more data from the dashboard. So you can see some of the demographics,
609240	616180	timing, and device types that the targeted user applied to.
618550	623930	All right, so we got that example to work, but that example was somewhat canned.
624150	629030	And there are some limitations that RealAttack would have to overcome to make this a practical
629030	635150	attack. All right, so targeted keywords would need to have sufficient search volume. And so
635150	639750	that precludes using very unique searches without doing legally questionable things
640390	650070	on the SEO side, like getting bots to search for the term that you want before you buy an ad item.
650770	654630	Ad might not display in the first or first couple target searches, so it needs to be something that
654630	662490	the target would be repeatedly searching for if you want a very high accuracy detection rate.
662950	668030	There's a reporting delay. In my case, it was up to a day, but ranges from hours to days.
669130	673970	And it can be costly to the attacker to do this if the user is quickly on your ad.
674970	679210	So in my case, once I finally got the ad to trigger, I got really excited as a roadrunner,
679210	683850	and I clicked the ad, and I charged myself $9.40 for seeing my own ad.
686870	692830	In the AdWords API, there's plenty more... there's more granular options that you can leverage,
692830	699490	as well as all the, you know, additional programming logic or custom logic you choose to implement.
702630	708350	All right, so we've covered Google platform. Now we're going to talk a little bit about Facebook.
708450	713390	So Facebook, like Google, there's plenty of different ad types and placements.
714170	717670	Anywhere from Facebook, Instagram, Messenger, that kind of stuff.
717990	723930	And compared to Google AdWords, or Google ad platforms, Facebook offers much more detailed
723930	729350	audience targeting options to your entry ad purchaser compared to Google. And so they
731270	736530	offer targeting on sort of four categories. Demographics, interest, behaviors, and location.
736530	742090	You can combine those with sort of effectively and or not operators. You can do relationship-based
742090	745990	targeting and then custom audiences, which we'll touch on a little bit later.
747110	751650	So audience targeting, so demographics, so this stuff like age, birthday, gender.
752610	757250	This generally coincides to the data that users provide in their Facebook profiles. You know,
757770	763010	it's pretty uncanny how well that matches up to information that users are expected to provide
763010	774060	Facebook. On the interest side, that generally targets what users sort of have declared that
774060	780220	they like on Facebook or groups or joining groups or pages that indicate interest in different
780220	786140	topics. And so I think for entertainment, family relationships, different food or drink types,
786140	792660	hobbies, that kind of thing. So like to Google targeting parameters, you know, by themselves,
792660	801480	these things might not be terribly revealing, but when combined, you can target very specific
801480	813710	audiences with these features. And finally, behaviors. Of all the audience targeting
813710	822630	options, behaviors is probably the most invasive. And so this combines online and offline activities
822630	829050	on or off Facebook, things like email domains you use to create Facebook, the internet browsers
829050	835730	that you use to connect to the operating systems, what Facebook assesses your multicultural affinity
835730	841310	or sort of cultural preferences are, political beliefs, purchase behavior if you traveled recently.
843730	848690	And of all the behaviors, this one seems to draw the most from data collected from user devices if
848690	855590	you've consented to the options, which are by generally default for collecting.
857630	864430	I can also target by location. This is another place where you can get very specific. So by itself,
864430	871830	if you're using one location, you can go anywhere from a broad area to an area at a specific grid
871830	880550	coordinate and with a radius from one to 50 miles. So by itself, that's still somewhat broad,
880550	890390	but if you combine include and excluded locations, you can get very specific. You can see on the right
892070	897290	the Capitol building and some location targeting that will allow you to target people
897290	902370	who have recently been in the Capitol building, U.S. Capitol building.
905730	911390	All right, so I made a first attempt at a Facebook ad and it didn't go so well.
912410	916910	And so before the ad could trigger or do anything with it, the page got unpublished.
917350	923270	Facebook seemed to think I was selling fraudulent tickets for something. I eventually got that.
924410	928630	So I had to go to plan B and wait a while for the account to get reactivated.
930030	937990	To do attempt 2. And so attempt 2, here we are trying to target Roadrunner, where we think he
937990	943930	works at Fort Meade, using information that we know the attacker already knows about him.
948920	955200	All right, so unfortunately, it didn't get a successful result on the Facebook ads
955960	961720	this time, but we did learn some interesting things that should fuel further research. And so
963660	968520	ad didn't trigger for our target during the period I had attempted to get it to trigger,
968520	974800	but it did trigger for other users, which was strange. And so I did tweak the audience
974800	981440	parameters mid-campaign, which might have messed with how it's supposed to work. And
982820	989160	some of the errors could be on my end. I'm brand new at this after all. It could be that
989160	995980	Facebook's machine learning algorithm that determines audience targeting really isn't
995980	1002020	optimized for our unintended use case. Or it could be audience targeting is deliberately obfuscated
1003040	1009800	for privacy reasons. The only thing, though, is if Facebook can charge for these clicks,
1009800	1014460	they're outside my audience anyway. So I had to pay for clicks for users that I didn't want
1014460	1021620	my product. So go over a couple other ad targeting features that I didn't get to
1021620	1029720	experiment with, but are still something you should be aware of. And first one of those is
1029720	1034400	customer-tailored audiences. And so the marketing goal for this is target specific people with ads
1034400	1038640	based on previous interactions or third-party data. This is otherwise known as remarketing
1039240	1044640	a lot of marketing literature. So it varies slightly from provider, but
1044640	1052660	what this can look like is basically taking your customer database, taking as business,
1052660	1059580	and uploading it to... uploading everything that's targetable on the platform to an ad platform.
1059780	1065380	So also target this way through website visitors. If your company has apps, you can target through
1065380	1070140	that identifiers embedded in those, as well as third-party data sources if you're paying
1070900	1077280	data brokers or marketing firms. Use is restricted by platforms. There is some additional vetting.
1077560	1084360	Facebook requires a business ads account to use it, and Google requires you to have no violations
1084360	1093150	and pay them a lot of money in ads. Here's an example of what the Facebook custom audience
1093150	1097250	looks like. And so you can target by email, phone,
1097250	1102490	advertising ID on a phone, names, dates of birth, and a bunch of other information.
1104790	1108570	So there's a lot of research already done on exploiting custom audience sizes
1110350	1117150	and defeating some of the protections that ad platforms have implemented for these. And so
1117150	1124130	most platforms implement a minimum audience size. They only provide estimator obfuscated sizes for
1124130	1133330	audiences when you upload your customer database. And some other platform-dependent things that
1133330	1143170	aren't necessarily public knowledge for the ad purchasers. So I've got three papers here that I
1143170	1150230	recommend you take a look at if you're interested later on how some smart folks figure out how to
1150230	1155970	defeat that and we're able to target individual people using these custom audiences.
1160010	1166830	One example is an article from Gizmodo a couple years ago, 2018 I believe. So one of those
1166830	1171450	researchers worked with a journalist and the journalist was able to target that researcher
1171450	1179090	using an office phone number that he never provided to Facebook, and with the conclusion
1179090	1185170	being that Facebook somehow collected that office phone number for that researcher through some other
1185170	1196870	third-party source. Twitter also got into trouble for using personal data that wasn't supposed to
1196870	1200850	be for advertising for advertising, in this case two-factor phone numbers.
1203330	1208710	I'm running a little bit out of time here, but let's very briefly go over this. But ads
1208710	1217010	over-targeting, basically this is over-targeting ads in a way, over-targeting ads using all
1217010	1221690	possible combinations of sort of the parameters you want to enumerate, seeing which ads trigger,
1222290	1226650	and using the ad platform to tell you information about that user.
1227470	1233950	So here's an example for enumerating operating system and browser for our Roadrunner. I didn't
1233950	1239030	get to test this because we couldn't get the Facebook ad to work, but plan on experimenting
1239030	1244310	with that in the future. All right, so we've talked about all the creepy things you can do with ads,
1244310	1252150	so we'll talk now about mitigations and defenses. So if you're ad platform, we've seen that
1253250	1258970	doing things like adding noise, noise to the target of advertisements,
1258970	1264650	raising minimum sizes of custom audiences, obfuscating audience sizes, and, you know,
1264650	1268690	allowing opt-outs to partially solve the problem or make it more difficult for attackers,
1269030	1277130	give some more options to consumers. But really, there are some still fundamental problems with
1277960	1283250	those approaches. And so the problem is that individual ad targeting is sort of inherent to
1283250	1288390	the business model of a lot of these ad platforms. It's what their primary customers, the marketers
1288390	1295270	and the purchasers of advertisements, what they want. It allows those advertisers to
1295850	1301050	demonstrate that this ad directly led to this sale, and people can make very data-driven
1301050	1306670	arguments to their executives about how their marketing budgets are making a difference.
1307130	1316720	All right, so some of the things that Facebook has added to at least provide some transparency
1316720	1322540	with this is ads library. And so you can look up ads that are active on Facebook recently using
1322540	1333180	their ads library. So mitigations for marketers. Same fundamental problems here. Individual
1333180	1340240	targeting is what marketers want. There's some things they could do, whether it's adjusting
1340240	1346500	privacy policies to provide more transparency or minimize customer information. But ultimately,
1346500	1354830	that undercuts their effective targeting of users in the bottom line. All right,
1354830	1360910	so what can individuals do about this kind of thing? So good news is there are some easy wins.
1361070	1367770	You know, some of that good internet browsing hygiene will prevent a lot of these techniques
1367770	1372290	from being used on you. So signing out of accounts in browsers you don't need, including browser
1372290	1380390	cookies, using privacy-friendly browser plugins and settings, using some OPSEC on search engines,
1380970	1385390	using privacy-protecting search engines, that kind of stuff. There's also some less convenient
1385390	1390850	and possibly more paranoid things you can do. One thing I noticed, targeting the ads, especially
1390850	1396890	going by location. Google trusts the location and pulls off of mobile devices, but if you use
1396890	1404090	location services, much more than any sort of data you self-report. But the problem is that's
1404090	1408590	harder to avoid, especially when, if you're using an Android phone, most Android phones are going to
1408590	1412570	require you to set up a Google account. You have Google Play services and all of its information
1412570	1425520	collection on your handset. All right, so we talked about sort of the theoretical uses of ads for
1426900	1434100	different purposes. Here's a couple of examples. So back in 2018 or 2019, I've seen an article about
1434100	1439140	FBI running Facebook ads to target Russians in Washington, presumably to get them to come
1439140	1443360	into the field office and tell them what they know about Russian interference.
1445400	1452600	Also more recently, political groups, in this case, political groups looking to mobilize
1453580	1456720	protesters at recent protests against police brutality
1458540	1464900	to target them with ads to continue the political fight in support of their chosen cause.
1468080	1474900	One thing we run into that's hard to mitigate here is you can control somewhat what you provide
1474900	1479880	yourself, but it's very hard to control what other people provide about you. And the ad platforms have
1479880	1485200	shown generally to leverage information other people provide about you. Same thing from government
1485200	1493280	public records to data brokers, other marketers, other third-party sources, and finally friends
1493280	1499530	sharing contact lists, emails, and other personnel info with Snoopy apps and services. So you might be
1500220	1506060	individually be Mr. or Mrs. Super Opsec, but if your friends are using these apps
1506060	1509520	and uploading their contacts and not paying attention to
1510060	1514600	privacy settings, you can still be very exposed to all this.
1516340	1520900	That's some conclusions. I think we've demonstrated that there's some potential abuse
1520900	1529240	of these systems. A lot of the techniques that I proposed or tested are sort of inherent, or they
1529240	1534720	take advantage of inherent features of ad delivery platforms. It'd be hard to completely fix these
1534720	1540900	sorts of issues on a major overhaul. Low budget ad surveillance, like I was doing, it's probably only
1540900	1549200	effective in very specific scenarios. But given more budget and more expertise, I could see this
1549200	1554480	being effective for people who know what they're doing with it.
1555320	1560400	Also sort of reinforces surveillance capitalism is still pretty creepy. And finally, I definitely
1561420	1564600	underestimated the amount of time I should have spent on this and I procrastinated.
1565020	1571500	Hopefully it doesn't show too bad. Some future research plans, plan on trying to get those API
1574420	1580300	key accesses and accounts. See if I automate some of the ads management, like a lot of the
1580300	1587580	professional researchers did. Score over-targeting, see if that's something that can be done or not.
1587580	1592120	Hopefully find some experts to work with and better know what they're doing.
1593680	1598320	Finally, I'd like to give some thanks, first of all, to Hex200B for his initial presentation that
1598320	1604920	inspired a lot of my work. A big thank you to Crypto and Privacy Village staff for putting
1604920	1611620	on this event. And finally, to all the attendees that decided to spend time in this presentation,
1611620	1616200	especially DEF CON, there's infinite number of presentations or other activities you could be
1616200	1622060	doing. Right now, thank you for choosing to spend it with Crypto, Privacy Village, and myself.
1622540	1626520	At this time, I open it up for questions and comments.
1635250	1639190	All right. Thank you to Neil M. for this terrific talk that we just saw,
1639190	1644770	online ads as a recon and surveillance tool. We have our speaker here to do a little bit of Q&A
1644770	1651730	with us. Hi there, Neil. I want to first mention Neil has put a link in the Discord Q&A channel
1651730	1657350	to a PDF of the presentation to be more easily referenced if any of you have questions to take
1657450	1662450	a look at that. We have something that is sort of a question, sort of a comment that I found
1662450	1666770	interesting and thought maybe you could you could comment on, Neil, that the subtle implication
1667330	1672110	of your talk is that emitting unique strings can help bad guys, even though we traditionally think
1672110	1675990	of this as something that helps good guys, for example, to do AP signatures. Is that something
1675990	1683470	you can comment on? Yes, definitely. And it was touched on during Hex200B's talk a couple of
1683470	1689510	years ago as well. And so the one thing he found in either through his research or asking other
1689510	1698570	folks is like antivirus companies, for example, will take out ads for things like file hashes
1698570	1703430	and stuff that they recently discovered for detection purposes as well as promoting their
1703430	1712370	own services. But it definitely goes both ways. Google can see what you're doing and
1712370	1717410	if Google can see it, then their marketing customers can potentially see it as well.
1718790	1723170	Great. Well, I actually found this to be a really interesting talk because I started out my career
1723170	1730630	right after college as a temp doing AdWords ads at Google. So I want to thank you for a
1730630	1736890	fascinating contribution. Have you had any pushback from Google or any intervention or
1736890	1741650	have you been keeping this enough on the DL to evade the eye of Sauron there?
1742130	1747950	Oh, well, we'll see after this talk, I guess. But yeah, so far, I haven't gotten enough
1747950	1751990	attention to even get my API key approved yet. So I think I'm okay.
1753610	1758130	Wonderful. All right. Well, thank you again so much for this talk. We hope you have a great
1758130	1762970	rest of your DEF CON. All right. Thank you. You as well. Thank you. Take care.