WEBVTT 00:00.000 --> 00:01.100 Good morning everybody. 00:01.100 --> 00:06.540 My name is Neil and I'll be presenting on how to use online ads as a reconnaissance and surveillance tool. 00:10.040 --> 00:12.480 A little about me, I'm currently a U.S. 00:12.480 --> 00:14.780 Army officer, 11 years in the Army. 00:15.060 --> 00:17.300 I got three degrees in electrical engineering and computer science. 00:17.300 --> 00:23.900 I'm a software developer with the Army and a personal privacy enthusiast. 00:25.060 --> 00:32.180 A couple of disclaimers, so all the views I present here are my own and not of the Department of Defense or any government entity. 00:33.040 --> 00:36.740 All accounts I used for connecting to research were created by me. 00:36.840 --> 00:40.240 I didn't target anybody else that didn't consent to the research. 00:40.620 --> 00:42.620 I don't do anything evil with this. 00:42.620 --> 00:48.820 And then finally, I'm a newbie when it comes to online marketing stuff, definitely not an expert, I use Qrius. 00:49.620 --> 00:51.320 So a little bit of background. 00:51.760 --> 00:55.100 Ads and ad targeting are ubiquitous online today. 00:55.100 --> 00:59.580 They find a lot of the services we like to use online and there's a lot of consequences of that. 00:59.580 --> 01:07.300 One of those consequences was covered in DEF CON 26 by HEX 200B and it really caught my eye. 01:08.080 --> 01:15.380 And so what HEX 200B presented was detecting blue team activities with ads. 01:15.380 --> 01:26.680 So his research question was, excuse me, as a red team operator, can you detect when someone, like the blue team, is searching for something unique or identifying in Google using ads? 01:26.680 --> 01:33.420 And so the strings that he was targeting or the search terms he was targeting was file hashes. 01:33.420 --> 01:36.940 And so you have a file hash of your binary or your implant. 01:38.260 --> 01:44.820 And one way you can detect if the blue team has detected it is if they start googling strings or hashes of that implant. 01:45.500 --> 01:52.120 And if you have ads on those terms, you can detect that and then take cleanup actions as required. 01:53.000 --> 02:03.260 As a result, it can be done, but with some considerable limitations that we'll talk about a little bit later. 02:03.400 --> 02:09.540 And plenty of other exploring opportunities with different ad platforms and other ways of targeting ads. 02:09.540 --> 02:14.060 I thought this presentation was really awesome and it inspired me to do my own research. 02:15.420 --> 02:21.320 So here are the research questions I went into some of the testing I did with. 02:21.320 --> 02:24.060 And so, first of all, I wanted to see if I replicate the research. 02:24.300 --> 02:26.960 I wanted to see if I could target ads specific to individuals. 02:26.980 --> 02:32.060 I wanted to see if I could explore other ad platforms beyond just Google, Google AdWords. 02:32.480 --> 02:41.440 And I wanted to see if I could over-target ads in a way to allow me to infer information about what ad platforms know about the individuals I'm targeting. 02:41.480 --> 02:46.140 So if any of that is possible, I want to also assess if it's practical. 02:46.140 --> 02:53.060 Anything from expense, to how reliable it is, to what the setup time required for it is, etc. 02:54.760 --> 03:02.180 So one thing to keep in mind going into using online ads for unintended purposes is overall goal is to get people to buy stuff. 03:02.380 --> 03:06.320 Ideally, you show ads to everybody most likely to buy something as an ad platform. 03:06.320 --> 03:09.980 And not only those people, but getting 100% accuracy really isn't that important. 03:09.980 --> 03:15.500 You just need a positive return for the marketers that are your customers. 03:16.660 --> 03:31.360 With that in mind, ad platforms are not necessarily optimized for deterministic delivery of ads, delivering ads exactly when you want them to, or high precision and accuracy of the user profiles or folks you're targeting. 03:34.020 --> 03:37.320 Online ad platforms, there's a bunch of them out there. 03:37.320 --> 03:39.100 They're a big business. 03:39.100 --> 03:41.400 The ones I looked at were Google and Facebook. 03:42.420 --> 03:52.940 But keep in mind, everybody pictured here has their own organic ad targeting and delivery systems that these techniques could potentially be applied to as well. 03:54.140 --> 03:57.200 To scope the research, I came up with a simple threat model. 03:57.800 --> 04:00.280 So blue, we have the Roadrunner. 04:00.280 --> 04:08.760 Roadrunner is a cyber analyst with the US Army stationed at Fort Meade with a mission of investigating the coyote using OSINT like Google. 04:09.080 --> 04:17.780 And red team coyote, a US adversary threat actor that the Roadrunner is researching. 04:17.780 --> 04:29.120 He's trying to use ads for evil and detect when the Roadrunner is researching the coyote using ads. 04:31.700 --> 04:34.620 So a couple things to keep in mind with the scenario. 04:34.620 --> 04:39.440 So the Roadrunner is a Google user in this scenario. 04:39.440 --> 04:57.120 And so using a stock Android phone with a Google account signed in and Windows 10 VM with a Chrome browser where the Roadrunner has signed in on Google before and is not in the habit of clearing cookies very often and stuff like that. 04:57.700 --> 05:00.200 Scenario for the coyote. 05:00.200 --> 05:02.720 So a couple things pointed out here. 05:02.720 --> 05:12.140 Coyote is set by domain name, a blog, a business to advertise on that blog, and a number of accounts on the different ad platforms. 05:14.760 --> 05:17.240 Right, so here's a couple screenshots of the blog. 05:17.680 --> 05:33.640 So coyote in the effort to attract the attention of Roadrunner and hopefully promote his ad getting shown by Google has put some of the search terms that he wants to trigger in Google AdWords in blog posts. 05:33.640 --> 05:44.960 And so the way Google shows ads, it's not just how much money you pay, but it's sort of an evaluation of the value of that page you're linking to. 05:44.960 --> 05:51.760 And so in this case, if you have keyword matches on the page you're linking to for your AdWords ad, then it's more likely to show. 05:53.540 --> 05:57.800 And so Google AdWords and networks, there's plenty of options to go after. 05:57.800 --> 05:59.860 The one we're looking at here is AdWords. 05:59.900 --> 06:04.500 And those are the paid results that show up in your Google searches. 06:06.800 --> 06:08.620 AdWords has a lot of targeting options. 06:08.620 --> 06:10.540 So the main one is a keyword search. 06:10.620 --> 06:18.880 Anything from a broad or fuzzy match to an exact match, where it's a exact match of the stream you provide, you can combine those. 06:19.140 --> 06:37.260 And then you can also combine it with a number of individually broad demographic parameters like language, broad interest category, user location, that when combined, can pretty effectively identify small groups of people. 06:37.640 --> 06:43.200 So continue on with options, IP blocking, exclusions, income level, device types. 06:43.500 --> 06:53.180 There's more options that you can leverage if you have a Google Ads API key, but not in the standard ad manager GUI. 06:53.380 --> 06:59.860 That does require additional vetting, which I was not able to pass, but we'll talk about that later. 07:01.800 --> 07:15.980 So here's the targeting methodology that we're using for setting up with Google AdWords, which is largely inspired by HEX 200b, with a little bit additional detail filled in. 07:16.080 --> 07:21.400 So first, we have to design the AdWords ad, we're using an expanded text ad, and select search terms. 07:21.400 --> 07:26.560 In this case, we selected a Bitcoin address that we thought Roadrunner might be interested in. 07:26.560 --> 07:38.980 The search term needs to be specific and low volume to make sure it only triggers on roadrunner searches and other people aren't likely to be searching for it, but not too low volume. 07:38.980 --> 07:47.520 And so there's minimum thresholds for search activity for different keywords that Google enforces when setting up ads. 07:47.520 --> 07:52.220 And so that is one of the primary challenges for conducting this sort of attack. 07:54.260 --> 08:07.200 So with with a search term, the way you can narrow it down from a group of people searching for something to the specific people that you want to target is by narrowing the demographic targeting options. 08:07.200 --> 08:11.440 And so that those are the things like the location, age that we already talked about. 08:11.440 --> 08:16.000 And so if you have enough target information, you can refine the audience down further. 08:16.240 --> 08:24.520 There are also limits on how small you can make that audience that will prevent Google from showing the ads or preventing you from buying them. 08:24.960 --> 08:40.320 But you can get around that somewhat by broadening your audience to the point that you meet the minimum threshold, but then adjusting the bid modifiers to the specific demographic features that you want. 08:40.320 --> 08:44.960 And so in this case, we know our target is between 25 and 34 years of age. 08:44.960 --> 08:51.040 And so we boost the amount we're willing to bid for that click up by 200 percent. 08:53.540 --> 08:58.980 Google reviews the ads, like the automated process, then eventually Google displays them. 08:58.980 --> 09:01.300 So some things to keep in mind. 09:01.560 --> 09:05.760 The ads, when you purchase them, aren't necessarily going to display on the first search of the target. 09:05.760 --> 09:11.540 Even if that target is in the audience, they might have to multiple times. 09:15.160 --> 09:17.300 All right, so ad is under review. 09:18.040 --> 09:23.520 Roadrunner is researching bad guys, researching the NotPetya actors and their Bitcoin address. 09:23.520 --> 09:28.600 And when we search the Bitcoin address, the Coyote ad pops up in Roadrunner's browser. 09:30.340 --> 09:32.980 Here's what that result looks like on Coyote's end. 09:33.000 --> 09:36.720 So have that little blip on the impressions. 09:37.780 --> 09:42.060 That's showing they got the ad triggered. 09:42.080 --> 09:44.540 Triggered once, and it triggered it this time. 09:46.280 --> 09:53.000 Going back, it also shows on the right, you can see the exact search term that the user put in. 09:53.000 --> 09:55.540 In this case, it was the Bitcoin address by itself. 09:55.580 --> 10:01.860 But if there's additional information in the search that triggered, it would appear there for the advertiser to see. 10:03.320 --> 10:07.020 All right, more data from the dashboard. 10:07.020 --> 10:16.180 So you can see some of the demographics, timing, and device types that the targeted user applied to. 10:18.550 --> 10:23.930 All right, so we got that example to work, but that example was somewhat canned. 10:24.150 --> 10:29.910 And there are some limitations that RealAttack would have to overcome to make this a practical attack. 10:30.450 --> 10:34.550 All right, so targeted keywords would need to have sufficient search volume. 10:34.550 --> 10:50.070 And so that precludes using very unique searches without doing legally questionable things on the SEO side, like getting bots to search for the term that you want before you buy an ad item. 10:50.770 --> 11:02.490 Ad might not display in the first or first couple target searches, so it needs to be something that the target would be repeatedly searching for if you want a very high accuracy detection rate. 11:02.950 --> 11:03.930 There's a reporting delay. 11:03.930 --> 11:08.030 In my case, it was up to a day, but ranges from hours to days. 11:09.130 --> 11:13.970 And it can be costly to the attacker to do this if the user is quickly on your ad. 11:14.970 --> 11:23.850 So in my case, once I finally got the ad to trigger, I got really excited as a roadrunner, and I clicked the ad, and I charged myself $9.40 for seeing my own ad. 11:26.870 --> 11:39.490 In the AdWords API, there's plenty more... there's more granular options that you can leverage, as well as all the, you know, additional programming logic or custom logic you choose to implement. 11:42.630 --> 11:46.050 All right, so we've covered Google platform. 11:46.050 --> 11:48.350 Now we're going to talk a little bit about Facebook. 11:48.450 --> 11:53.390 So Facebook, like Google, there's plenty of different ad types and placements. 11:54.170 --> 11:57.670 Anywhere from Facebook, Instagram, Messenger, that kind of stuff. 11:57.990 --> 12:08.890 And compared to Google AdWords, or Google ad platforms, Facebook offers much more detailed audience targeting options to your entry ad purchaser compared to Google. 12:08.890 --> 12:13.890 And so they offer targeting on sort of four categories. 12:14.210 --> 12:16.530 Demographics, interest, behaviors, and location. 12:16.530 --> 12:21.010 You can combine those with sort of effectively and or not operators. 12:21.010 --> 12:25.990 You can do relationship-based targeting and then custom audiences, which we'll touch on a little bit later. 12:27.110 --> 12:31.650 So audience targeting, so demographics, so this stuff like age, birthday, gender. 12:32.610 --> 12:37.030 This generally coincides to the data that users provide in their Facebook profiles. 12:37.030 --> 12:43.930 You know, it's pretty uncanny how well that matches up to information that users are expected to provide Facebook. 12:46.560 --> 13:00.840 On the interest side, that generally targets what users sort of have declared that they like on Facebook or groups or joining groups or pages that indicate interest in different topics. 13:00.840 --> 13:08.080 And so I think for entertainment, family relationships, different food or drink types, hobbies, that kind of thing. 13:08.480 --> 13:25.360 So like to Google targeting parameters, you know, by themselves, these things might not be terribly revealing, but when combined, you can target very specific audiences with these features. 13:28.270 --> 13:30.390 And finally, behaviors. 13:30.390 --> 13:38.530 Of all the audience targeting options, behaviors is probably the most invasive. 13:38.610 --> 13:57.610 And so this combines online and offline activities on or off Facebook, things like email domains you use to create Facebook, the internet browsers that you use to connect to the operating systems, what Facebook assesses your multicultural affinity or sort of cultural preferences are, 13:57.610 --> 14:01.310 political beliefs, purchase behavior if you traveled recently. 14:03.730 --> 14:15.590 And of all the behaviors, this one seems to draw the most from data collected from user devices if you've consented to the options, which are by generally default for collecting. 14:17.630 --> 14:19.670 I can also target by location. 14:19.770 --> 14:23.150 This is another place where you can get very specific. 14:23.570 --> 14:37.990 So by itself, if you're using one location, you can go anywhere from a broad area to an area at a specific grid coordinate and with a radius from one to 50 miles. 14:38.190 --> 14:49.550 So by itself, that's still somewhat broad, but if you combine include and excluded locations, you can get very specific. 14:49.550 --> 15:01.450 You can see on the right the Capitol building and some location targeting that will allow you to target people who have recently been in the Capitol building, U.S. 15:01.450 --> 15:02.370 Capitol building. 15:05.730 --> 15:11.390 All right, so I made a first attempt at a Facebook ad and it didn't go so well. 15:12.410 --> 15:16.910 And so before the ad could trigger or do anything with it, the page got unpublished. 15:17.350 --> 15:20.930 Facebook seemed to think I was selling fraudulent tickets for something. 15:21.810 --> 15:23.270 I eventually got that. 15:24.410 --> 15:28.630 So I had to go to plan B and wait a while for the account to get reactivated. 15:30.030 --> 15:31.370 To do attempt 2. 15:31.370 --> 15:43.930 And so attempt 2, here we are trying to target Roadrunner, where we think he works at Fort Meade, using information that we know the attacker already knows about him. 15:48.920 --> 16:01.380 All right, so unfortunately, it didn't get a successful result on the Facebook ads this time, but we did learn some interesting things that should fuel further research. 16:01.380 --> 16:12.340 And so ad didn't trigger for our target during the period I had attempted to get it to trigger, but it did trigger for other users, which was strange. 16:12.900 --> 16:20.840 And so I did tweak the audience parameters mid-campaign, which might have messed with how it's supposed to work. 16:21.440 --> 16:25.740 And some of the errors could be on my end. 16:25.740 --> 16:27.940 I'm brand new at this after all. 16:28.460 --> 16:38.560 It could be that Facebook's machine learning algorithm that determines audience targeting really isn't optimized for our unintended use case. 16:38.560 --> 16:45.200 Or it could be audience targeting is deliberately obfuscated for privacy reasons. 16:46.420 --> 16:51.220 The only thing, though, is if Facebook can charge for these clicks, they're outside my audience anyway. 16:51.220 --> 16:55.460 So I had to pay for clicks for users that I didn't want my product. 16:58.740 --> 17:05.540 So go over a couple other ad targeting features that I didn't get to experiment with, but are still something you should be aware of. 17:06.980 --> 17:11.240 And first one of those is customer-tailored audiences. 17:11.240 --> 17:17.120 And so the marketing goal for this is target specific people with ads based on previous interactions or third-party data. 17:17.120 --> 17:21.540 This is otherwise known as remarketing a lot of marketing literature. 17:21.820 --> 17:39.580 So it varies slightly from provider, but what this can look like is basically taking your customer database, taking as business, and uploading it to... uploading everything that's targetable on the platform to an ad platform. 17:39.780 --> 17:43.440 So also target this way through website visitors. 17:43.440 --> 17:53.060 If your company has apps, you can target through that identifiers embedded in those, as well as third-party data sources if you're paying data brokers or marketing firms. 17:53.960 --> 17:55.800 Use is restricted by platforms. 17:55.800 --> 17:57.280 There is some additional vetting. 17:57.560 --> 18:07.060 Facebook requires a business ads account to use it, and Google requires you to have no violations and pay them a lot of money in ads. 18:10.970 --> 18:14.170 Here's an example of what the Facebook custom audience looks like. 18:14.170 --> 18:22.490 And so you can target by email, phone, advertising ID on a phone, names, dates of birth, and a bunch of other information. 18:24.790 --> 18:36.890 So there's a lot of research already done on exploiting custom audience sizes and defeating some of the protections that ad platforms have implemented for these. 18:36.890 --> 18:41.010 And so most platforms implement a minimum audience size. 18:41.030 --> 18:47.470 They only provide estimator obfuscated sizes for audiences when you upload your customer database. 18:48.210 --> 19:00.190 And some other platform-dependent things that aren't necessarily public knowledge for the ad purchasers. 19:00.190 --> 19:15.970 So I've got three papers here that I recommend you take a look at if you're interested later on how some smart folks figure out how to defeat that and we're able to target individual people using these custom audiences. 19:20.010 --> 19:26.350 One example is an article from Gizmodo a couple years ago, 2018 I believe. 19:26.350 --> 19:47.830 So one of those researchers worked with a journalist and the journalist was able to target that researcher using an office phone number that he never provided to Facebook, and with the conclusion being that Facebook somehow collected that office phone number for that researcher through some other third-party source. 19:50.010 --> 20:00.850 Twitter also got into trouble for using personal data that wasn't supposed to be for advertising for advertising, in this case two-factor phone numbers. 20:03.330 --> 20:08.290 I'm running a little bit out of time here, but let's very briefly go over this. 20:08.290 --> 20:26.650 But ads over-targeting, basically this is over-targeting ads in a way, over-targeting ads using all possible combinations of sort of the parameters you want to enumerate, seeing which ads trigger, and using the ad platform to tell you information about that user. 20:27.470 --> 20:33.490 So here's an example for enumerating operating system and browser for our Roadrunner. 20:33.490 --> 20:40.170 I didn't get to test this because we couldn't get the Facebook ad to work, but plan on experimenting with that in the future. 20:41.690 --> 20:47.530 All right, so we've talked about all the creepy things you can do with ads, so we'll talk now about mitigations and defenses. 20:49.010 --> 21:08.690 So if you're ad platform, we've seen that doing things like adding noise, noise to the target of advertisements, raising minimum sizes of custom audiences, obfuscating audience sizes, and, you know, allowing opt-outs to partially solve the problem or make it more difficult for attackers, 21:09.030 --> 21:11.590 give some more options to consumers. 21:11.730 --> 21:19.090 But really, there are some still fundamental problems with those approaches. 21:19.090 --> 21:25.730 And so the problem is that individual ad targeting is sort of inherent to the business model of a lot of these ad platforms. 21:25.730 --> 21:32.110 It's what their primary customers, the marketers and the purchasers of advertisements, what they want. 21:32.190 --> 21:46.670 It allows those advertisers to demonstrate that this ad directly led to this sale, and people can make very data-driven arguments to their executives about how their marketing budgets are making a difference. 21:47.130 --> 21:58.760 All right, so some of the things that Facebook has added to at least provide some transparency with this is ads library. 21:58.760 --> 22:03.880 And so you can look up ads that are active on Facebook recently using their ads library. 22:06.800 --> 22:09.120 So mitigations for marketers. 22:11.100 --> 22:12.900 Same fundamental problems here. 22:12.900 --> 22:15.380 Individual targeting is what marketers want. 22:17.540 --> 22:25.260 There's some things they could do, whether it's adjusting privacy policies to provide more transparency or minimize customer information. 22:25.260 --> 22:31.800 But ultimately, that undercuts their effective targeting of users in the bottom line. 22:34.350 --> 22:38.510 All right, so what can individuals do about this kind of thing? 22:38.510 --> 22:40.910 So good news is there are some easy wins. 22:41.070 --> 22:49.430 You know, some of that good internet browsing hygiene will prevent a lot of these techniques from being used on you. 22:49.430 --> 23:03.890 So signing out of accounts in browsers you don't need, including browser cookies, using privacy-friendly browser plugins and settings, using some OPSEC on search engines, using privacy-protecting search engines, that kind of stuff. 23:04.130 --> 23:07.810 There's also some less convenient and possibly more paranoid things you can do. 23:08.310 --> 23:12.330 One thing I noticed, targeting the ads, especially going by location. 23:12.330 --> 23:21.490 Google trusts the location and pulls off of mobile devices, but if you use location services, much more than any sort of data you self-report. 23:22.370 --> 23:30.510 But the problem is that's harder to avoid, especially when, if you're using an Android phone, most Android phones are going to require you to set up a Google account. 23:30.510 --> 23:35.190 You have Google Play services and all of its information collection on your handset. 23:41.700 --> 23:48.220 All right, so we talked about sort of the theoretical uses of ads for different purposes. 23:48.220 --> 23:49.360 Here's a couple of examples. 23:49.360 --> 24:03.360 So back in 2018 or 2019, I've seen an article about FBI running Facebook ads to target Russians in Washington, presumably to get them to come into the field office and tell them what they know about Russian interference. 24:05.400 --> 24:24.900 Also more recently, political groups, in this case, political groups looking to mobilize protesters at recent protests against police brutality to target them with ads to continue the political fight in support of their chosen cause. 24:28.080 --> 24:38.500 One thing we run into that's hard to mitigate here is you can control somewhat what you provide yourself, but it's very hard to control what other people provide about you. 24:38.860 --> 24:44.300 And the ad platforms have shown generally to leverage information other people provide about you. 24:44.300 --> 24:58.860 Same thing from government public records to data brokers, other marketers, other third-party sources, and finally friends sharing contact lists, emails, and other personnel info with Snoopy apps and services. 24:58.860 --> 25:02.680 So you might be individually be Mr. 25:02.680 --> 25:03.100 or Mrs. 25:03.100 --> 25:14.600 Super Opsec, but if your friends are using these apps and uploading their contacts and not paying attention to privacy settings, you can still be very exposed to all this. 25:16.340 --> 25:18.240 That's some conclusions. 25:18.240 --> 25:23.120 I think we've demonstrated that there's some potential abuse of these systems. 25:23.320 --> 25:32.440 A lot of the techniques that I proposed or tested are sort of inherent, or they take advantage of inherent features of ad delivery platforms. 25:32.440 --> 25:36.820 It'd be hard to completely fix these sorts of issues on a major overhaul. 25:37.580 --> 25:43.120 Low budget ad surveillance, like I was doing, it's probably only effective in very specific scenarios. 25:44.300 --> 25:54.480 But given more budget and more expertise, I could see this being effective for people who know what they're doing with it. 25:55.320 --> 25:58.520 Also sort of reinforces surveillance capitalism is still pretty creepy. 25:58.740 --> 26:04.600 And finally, I definitely underestimated the amount of time I should have spent on this and I procrastinated. 26:05.020 --> 26:06.400 Hopefully it doesn't show too bad. 26:07.920 --> 26:16.080 Some future research plans, plan on trying to get those API key accesses and accounts. 26:16.660 --> 26:22.100 See if I automate some of the ads management, like a lot of the professional researchers did. 26:24.580 --> 26:27.580 Score over-targeting, see if that's something that can be done or not. 26:27.580 --> 26:32.120 Hopefully find some experts to work with and better know what they're doing. 26:33.680 --> 26:41.740 Finally, I'd like to give some thanks, first of all, to Hex200B for his initial presentation that inspired a lot of my work. 26:41.860 --> 26:46.040 A big thank you to Crypto and Privacy Village staff for putting on this event. 26:46.240 --> 26:56.800 And finally, to all the attendees that decided to spend time in this presentation, especially DEF CON, there's infinite number of presentations or other activities you could be doing. 26:57.240 --> 27:02.060 Right now, thank you for choosing to spend it with Crypto, Privacy Village, and myself. 27:02.540 --> 27:06.520 At this time, I open it up for questions and comments. 27:15.250 --> 27:16.150 All right. 27:16.150 --> 27:17.230 Thank you to Neil M. 27:17.230 --> 27:22.030 for this terrific talk that we just saw, online ads as a recon and surveillance tool. 27:22.030 --> 27:25.610 We have our speaker here to do a little bit of Q&A with us. 27:25.610 --> 27:26.750 Hi there, Neil. 27:27.270 --> 27:38.330 I want to first mention Neil has put a link in the Discord Q&A channel to a PDF of the presentation to be more easily referenced if any of you have questions to take a look at that. 27:39.230 --> 27:54.030 We have something that is sort of a question, sort of a comment that I found interesting and thought maybe you could you could comment on, Neil, that the subtle implication of your talk is that emitting unique strings can help bad guys, even though we traditionally think of this as something that helps good guys, 27:54.030 --> 27:55.570 for example, to do AP signatures. 27:55.570 --> 27:57.410 Is that something you can comment on? 27:57.730 --> 27:58.910 Yes, definitely. 27:58.910 --> 28:04.770 And it was touched on during Hex200B's talk a couple of years ago as well. 28:04.790 --> 28:24.350 And so the one thing he found in either through his research or asking other folks is like antivirus companies, for example, will take out ads for things like file hashes and stuff that they recently discovered for detection purposes as well as promoting their own services. 28:24.350 --> 28:28.370 But it definitely goes both ways. 28:30.050 --> 28:37.410 Google can see what you're doing and if Google can see it, then their marketing customers can potentially see it as well. 28:38.790 --> 28:39.430 Great. 28:39.430 --> 28:47.910 Well, I actually found this to be a really interesting talk because I started out my career right after college as a temp doing AdWords ads at Google. 28:48.070 --> 28:52.190 So I want to thank you for a fascinating contribution. 28:52.350 --> 29:01.650 Have you had any pushback from Google or any intervention or have you been keeping this enough on the DL to evade the eye of Sauron there? 29:02.130 --> 29:04.730 Oh, well, we'll see after this talk, I guess. 29:04.730 --> 29:10.470 But yeah, so far, I haven't gotten enough attention to even get my API key approved yet. 29:10.470 --> 29:11.990 So I think I'm okay. 29:13.610 --> 29:14.250 Wonderful. 29:14.250 --> 29:14.690 All right. 29:14.690 --> 29:17.070 Well, thank you again so much for this talk. 29:17.070 --> 29:19.530 We hope you have a great rest of your DEF CON. 29:20.710 --> 29:21.030 All right. 29:21.030 --> 29:21.330 Thank you. 29:21.330 --> 29:21.990 You as well. 29:22.070 --> 29:22.630 Thank you. 29:22.630 --> 29:22.970 Take care.