WEBVTT 00:00.000 --> 00:01.880 I'm going to introduce myself. 00:03.000 --> 00:06.420 I am speaking for the XR Village. 00:06.460 --> 00:07.760 My name is Whitney Phillips. 00:07.760 --> 00:14.980 I'm going to be presenting on augmented reality and the implications on mobile security. 00:16.320 --> 00:18.300 A little bit about myself. 00:18.300 --> 00:22.600 So I've been in InfoSec and IT for about 12 years. 00:22.680 --> 00:25.240 I started off at helpdesk. 00:25.240 --> 00:27.960 I was a system administrator after that. 00:27.960 --> 00:38.720 Shortly after doing system administration, I became a security operations, I guess, analyst. 00:38.720 --> 00:47.360 I would do anything between running antivirus or putting encryption on PCs. 00:47.780 --> 00:50.960 Anything that could break my way into security. 00:51.440 --> 00:59.940 After that, I switched over to a purple team where I did code review and I know zero code coding. 00:59.940 --> 01:09.260 So that was quite an interesting one year and I quickly got out of it and that's where I turned to mobile application pen testing. 01:09.380 --> 01:20.180 Um, I started that about 5 years ago and have enjoyed it ever since and that's what kind of broke me into my job here at TrustedSec right now. 01:20.180 --> 01:26.800 So I primarily do mobile app pen testing and then I go and do gray box when they need help for that. 01:26.800 --> 01:29.340 So that's a little bit about me. 01:29.340 --> 01:33.720 Um, I was, had no plan on coming to DEF CON today. 01:33.720 --> 01:47.300 Um, about 3 weeks ago, the XR village needed an extra person to fill in so I created my talk and here I am and we'll give this a go. 01:48.040 --> 01:48.960 Yay! 01:48.960 --> 01:49.720 Woo! 01:49.720 --> 01:50.620 Alright. 01:51.160 --> 01:53.180 So, why are we here? 01:53.180 --> 02:02.800 I am going to talk to you about augmented reality and the security and privacy issues it has around mobile security. 02:02.880 --> 02:11.780 So, um, a little bit about augmented reality and I'm not going to lie, like I'm more of a mobile expert. 02:12.300 --> 02:21.880 Um, augmented reality is a little bit like outside of my realm so I felt like big bird trying to research something completely new and I'm like I don't know what I'm doing. 02:21.880 --> 02:27.560 What, you know, why, you know, why, why am I researching something that's out of my realm? 02:27.560 --> 02:32.940 But it's not because we live in augmented reality every single day. 02:33.040 --> 02:37.800 So, augmented reality, it's technology that is digital. 02:37.800 --> 02:42.560 It integrates into a user's physical environment in real time. 02:42.560 --> 02:58.660 So, anything from QR codes to snapchat to even those fun little things that you can put out in your house like little 3D images, that's all augmented reality. 02:58.660 --> 03:07.340 But what we don't really think about is it collects a wealth of our information, um, in our everyday life. 03:09.640 --> 03:13.460 Some, that's my break slide. 03:13.660 --> 03:17.660 So, when I was doing research for augmented reality, I, it was kind of hard. 03:17.660 --> 03:20.360 There was a lot of different information out there. 03:20.360 --> 03:23.460 So, this is kind of the information that I've gathered. 03:26.440 --> 03:30.700 Um, there's two different main types of augmented reality. 03:30.700 --> 03:31.980 There's marker based. 03:31.980 --> 03:38.080 And that's like your snapchat, your face filtering, um, logos, posters, QR codes. 03:38.080 --> 03:39.080 There's augmented reality. 03:39.080 --> 03:40.440 I wouldn't even have thought of that. 03:40.440 --> 03:41.700 It's so crazy. 03:41.700 --> 03:45.340 Um, then there is without markers. 03:45.400 --> 03:48.260 So, location based. 03:48.440 --> 03:50.080 That's GPS. 03:50.180 --> 03:51.080 Projection based. 03:51.080 --> 03:57.260 That's your 3D images that you, maybe you get an app from, uh, target. 03:57.260 --> 03:59.980 And you're like, this dresser looks really cute in my house. 03:59.980 --> 04:01.440 That's the 3D image. 04:01.440 --> 04:02.820 Or Pokemon Go. 04:02.820 --> 04:07.680 And then the overlay of screen for the super, um, in position. 04:07.680 --> 04:15.020 It's like, the best I can explain it is like, um, like flying a drone app. 04:15.020 --> 04:21.720 That's how, how I take that specific augmented reality. 04:22.460 --> 04:31.880 So, with all those, like, I kind of broke them down a little bit more into not so marker, markerless, projection. 04:31.880 --> 04:34.940 I wanted to like talk about it and how I understood it. 04:35.320 --> 04:40.460 Um, so, a lot of augmented reality, there's a lot of biometrics that are involved. 04:40.620 --> 04:45.720 Especially, uh, with face changing ones or makeup apps. 04:46.060 --> 04:48.300 You've got like facial recognition software. 04:48.300 --> 04:49.820 They're tracking your eyes. 04:49.820 --> 04:52.880 Heart rate monitors is considered an augmented reality. 04:52.940 --> 04:58.520 Those fun makeup apps where you want to put eye shadow on your face to see if it looks really cute. 04:58.740 --> 05:00.940 Not that I, that everybody does that. 05:01.100 --> 05:01.700 Here. 05:02.240 --> 05:05.840 Um, yeah, face filtering and even those clothing apps. 05:05.840 --> 05:11.100 There's clothing apps right now that you can take a picture of yourself and see how that fits on you. 05:11.100 --> 05:18.780 But at the meantime, you're still scanning your whole body and you're scanning everything about you and you're placing it in this app. 05:19.580 --> 05:22.480 Um, and then location based and projection. 05:22.480 --> 05:29.220 Like, so, I keep going on about like apps that you can see how products will fit in your house. 05:29.220 --> 05:31.780 Um, architecture uses augmented reality. 05:31.780 --> 05:34.260 Navigation is augmented reality. 05:34.760 --> 05:37.960 Manufacturing games like the Pokemon Go. 05:37.960 --> 05:42.080 And even our military uses augmented reality for this. 05:44.240 --> 05:45.640 One more man? 05:45.780 --> 05:51.100 I don't know if anybody... I didn't have to have those break slides, so. 05:51.360 --> 05:57.240 Alright, so here's some examples of what I found when I was doing research of what is considered augmented reality. 05:57.380 --> 06:05.960 Uh, Shopify has an integration into apps that will basically do the same thing as the Target and IKEA app. 06:05.960 --> 06:08.380 Like, I want to see how this fits in my home. 06:08.380 --> 06:17.380 Um, okay, well now you're taking your GPS location, you're taking everything in your home and you're now giving it to that app. 06:17.460 --> 06:19.960 Um, the Uke makeup cam. 06:20.900 --> 06:23.100 Is it gif or jif? 06:24.560 --> 06:26.260 Um, world. 06:26.460 --> 06:29.620 Roar, you're putting dinosaurs in your house. 06:29.620 --> 06:34.420 Like, this is, you're giving your information up for dinosaurs. 06:34.880 --> 06:39.200 So, other, other app examples. 06:39.200 --> 06:40.040 Pokemon Go. 06:40.040 --> 06:43.260 I know we have some Pokemon Go people in here, for sure. 06:43.820 --> 06:47.360 Um, I didn't take that soldier's location out. 06:47.360 --> 06:51.020 It's supposed to go into a separate part, but ignore that. 06:51.020 --> 06:52.580 That's, that's later on. 06:52.600 --> 06:54.760 QR codes and again Snapchat. 06:54.840 --> 06:57.620 We all know we like our Snapchat filters, right? 06:57.900 --> 07:00.580 We all know we like our Snapchat filters. 07:01.220 --> 07:03.380 Again, I'm a sucker to it. 07:03.380 --> 07:05.460 Don't I look really pretty as an elf? 07:05.860 --> 07:07.520 And I have no friends. 07:08.040 --> 07:11.180 So, yeah, we have friends right here. 07:12.220 --> 07:16.600 Alright, so, with apps, there's also devices too. 07:16.880 --> 07:20.720 So, Apple's coming out with a new device. 07:20.880 --> 07:23.680 Google Glass has had devices out. 07:24.120 --> 07:27.140 Uh, Bose, didn't even know they have frames. 07:27.140 --> 07:28.440 Ray-Bans have frames. 07:28.440 --> 07:29.660 Did not know that. 07:29.660 --> 07:32.060 Amazon and even our U.S. 07:32.060 --> 07:36.020 Army, they have a tactical augmented reality. 07:38.220 --> 07:40.980 That's my, it looks like this. 07:41.700 --> 08:04.740 So, I know, I know the army gets picked on a lot and I just, I see something like that and it makes me a little uncomfortable because I hope that maybe they're the ones sitting, uh, behind the scenes and not doing the actual military work but like shooting and stuff but this might be our future right here. 08:04.920 --> 08:08.400 Um, and especially with these devices. 08:08.400 --> 08:11.440 So, where am I going with this? 08:11.940 --> 08:13.660 You have these devices. 08:13.660 --> 08:15.180 You have these apps. 08:15.180 --> 08:21.120 Let's talk about the physical, like, let's talk about security concerns and privacy concerns around these. 08:21.600 --> 08:31.500 So, with the physical devices, imagine you're wearing your Google Glasses and you're trying to go into somewhere where you're not supposed to take pictures. 08:32.220 --> 08:35.340 Um, how are we supposed to know if you're recording or not? 08:35.540 --> 08:39.340 Um, I'm pretty sure plenty of people in here don't want their picture taken. 08:39.340 --> 08:52.420 If I had glasses on right now, you know, would you want to be in my, um, would you want to be in my Google thing and have your information being sent out? 08:52.520 --> 09:10.060 Uh, there was also earlier reports of people being assaulted for wearing Google, like, those types of virtual reality, augmented reality glasses just because it's, uh, you're kind of drawing a fine line in people's privacy. 09:11.080 --> 09:14.980 So, that's kind of where I'm going with the physical devices. 09:15.200 --> 09:22.080 Um, and with the apps, there's also just general app security concerns. 09:22.380 --> 09:27.060 So, attackers can gain device, or access to your device. 09:27.480 --> 09:42.260 Um, I know when you're building out an app and there's such a rush to get things out, you have, um, developers creating apps that are maybe not as up to par. 09:42.500 --> 09:44.680 And then, like, where are your data stored? 09:44.780 --> 09:46.480 And then what third parties get it? 09:46.480 --> 09:49.600 And I'm going to kind of go over those now. 09:49.600 --> 10:05.220 So, um, attackers gaining access, it's basically, you know, they could potentially capture your images if it's not stored properly on your device. 10:05.220 --> 10:17.140 Um, that's another way if they can get a secure backup, or a backup from your phone, they can pull that information off, um, depending on how the app is storing it. 10:21.170 --> 10:26.370 Ransomware, um, on your device is another security issue. 10:26.690 --> 10:47.610 So, I don't see it as much on my end because I'm doing more of the red teaming and, um, mobile pen testing, but higher profile people, you know, are could be susceptible to ransomware, um, because they have more information that's needed or is desired. 10:48.290 --> 10:55.990 And then this is a little bit more, um, in my realm, man in the middle of attacks trying to intercept traffic. 10:58.450 --> 11:17.930 We don't know, and this is more where I'm coming in from the mobile perspective, I see a lot of applications that they rush through and get the app done just to get it out there, and then they have no concern over how their app is done, or if it's done securely. 11:17.930 --> 11:24.910 They want to be the front runner of being in the augmented reality space. 11:25.210 --> 11:44.010 Um, especially because this is, it's newer, but if you look back, there still is research that is going back like several years, um, I will say the information out on augmented reality reminds me of how like mobile security was five years ago when I started doing this. 11:44.010 --> 11:56.810 So, so proper app development, I don't know, mobile app development life cycle is something needed, um, and I don't see that happening very quickly. 11:57.950 --> 12:04.070 Uh, data storage on your device, that's another privacy and security concern. 12:04.090 --> 12:27.090 I do get a lot of apps, um, not augmented reality, but example, chat, and a chat app that I had stores, um, stores every photo that you take into the cache of the phone, and if you have backups enabled on that app, well, now you have all your phone's pictures that you took in that app, 12:27.090 --> 12:35.650 so whether, so data storage on the device, if you don't have a lock screen, on your device, is an issue. 12:36.090 --> 12:44.650 So, um, we're lost and damaged, I mean, it's still a privacy concern. 12:45.110 --> 13:04.610 And then these apps also store stuff up in the cloud and we have, a lot of times we do not know, I, I know going and doing my gray box testing and my mobile testing, when I first started working there, I was like, wait a minute, why is all this information heading, 13:04.610 --> 13:07.990 like, to all these different, uh, companies? 13:07.990 --> 13:09.150 Like, why is that a thing? 13:09.150 --> 13:18.890 Because I was so, uh, focused on data leaving the device and you just, you don't realize how much goes to third parties. 13:18.890 --> 13:31.590 But it's a huge risk because if the third party vendor potentially gets breached, then your data is out there and I know that's a general concern of everybody in security. 13:32.610 --> 13:39.390 So, that's a little bit, like, on my take on augmented reality, on the app portion of it. 13:39.390 --> 13:45.950 So, we have these apps, how are we going to maybe look at them from a technical's perspective? 13:49.450 --> 14:09.770 So, I actually did these, a couple of these slides just a couple of days ago, so, um, I'm kind of going to go over, um, something you can do as a user and you don't even have to have, um, you don't even have to have a jailbroken phone, um, just these two, 14:09.770 --> 14:12.530 um, pieces of information. 14:12.530 --> 14:15.310 So, there's a site called APK Pure. 14:15.530 --> 14:19.650 This is where you can pull down Android installation files. 14:20.030 --> 14:24.670 And from there, um, let me go over my IPA. 14:24.670 --> 14:27.210 Uh, iPhone cake, same idea. 14:27.270 --> 14:38.690 I did that, I pulled my APK file out of my phone , I pulled down APK, uh, if you're not familiar, it's the Android installation file, uh, IPA is the iOS installation file. 14:38.790 --> 14:44.010 So, I took those and I stuck it in a static analysis tool called MobSF. 14:44.530 --> 14:51.130 Um, this is so great, like, if you're just wanting, like, a high level overview of what's going on in your app. 14:51.330 --> 14:54.730 Um, so, I took Snapchat, for instance. 14:55.090 --> 15:02.590 Um, look at all these security, like, issues with danger all over here. 15:02.590 --> 15:08.330 Read your phone number, um, your phone state, external storage. 15:08.330 --> 15:10.590 I mean, I guess maybe it stores something there. 15:10.810 --> 15:12.470 Read your call logs. 15:13.110 --> 15:14.530 Isn't that a little scary? 15:15.030 --> 15:18.450 So, um, and this is something I do, like, as a mobile pen tester. 15:18.450 --> 15:20.010 I'm, this is my first step. 15:20.010 --> 15:22.290 I'm looking at how this app is functioning. 15:22.590 --> 15:33.910 So, we've got vulnerabilities, Janice vulnerabilities, and you can install it on a really old version of Android. 15:34.430 --> 15:37.850 So, is your data going to be secured? 15:38.450 --> 15:39.690 No. 15:40.390 --> 15:43.530 It also allows clear text traffic. 15:43.670 --> 15:49.530 So, yeah, it's, and I was a little bit surprised. 15:49.530 --> 15:53.030 So, I thought maybe Snapchat would have had a lot of trackers to it. 15:53.030 --> 15:53.810 It doesn't. 15:53.810 --> 15:59.050 Just Mapbox and, you know, your general Firebase analytics. 15:59.130 --> 16:00.890 So, that was really impressive. 16:00.890 --> 16:06.810 I was, I was kind of hoping to see a list of trackers, but I did not. 16:07.870 --> 16:09.610 Back to that Roar app. 16:09.950 --> 16:11.890 I just, I like it for some reason. 16:11.890 --> 16:16.150 I'm, I kind of want to install it after I'm done with this talk and give them all my data. 16:16.890 --> 16:22.350 Um, they actually have like less permission settings, uh, that I would have expected. 16:23.490 --> 16:28.570 Still the read external storage, um, fine location, but they need that. 16:28.570 --> 16:33.190 And that's kind of as a mobile tester, you have to look and see and look at the app. 16:33.230 --> 16:36.510 Like, why, what does the app do? 16:36.510 --> 16:38.850 Does it absolutely need to do this? 16:41.290 --> 16:43.030 That, alright. 16:43.030 --> 16:44.470 What else do they got? 16:44.950 --> 16:47.810 Oh, minimum version again and clear text. 16:47.910 --> 16:50.590 So, clear text allowed on this app. 16:50.690 --> 16:52.510 But look at all these trackers. 16:53.190 --> 16:56.510 So, that's the dinosaur app. 16:56.510 --> 17:02.870 So, you're purchasing this app to put 3D images in your house of dinosaurs. 17:03.010 --> 17:05.650 And it's tracking all your information. 17:07.030 --> 17:12.230 And I know, I hate to pick on the military, but I like picking on them a little bit. 17:12.230 --> 17:14.810 Just because our guys are using these apps. 17:14.810 --> 17:18.870 And this is a civilian version, so I shouldn't get in trouble for this. 17:18.890 --> 17:22.190 But our boots on the ground are using these apps. 17:22.410 --> 17:27.130 And it's just as, we want to make sure that they're secure. 17:28.050 --> 17:35.350 Um, but then it still needs a lot of permissions to have that app run. 17:36.490 --> 17:40.610 And still clear text. 17:40.630 --> 17:42.250 And another vulnerability. 17:43.450 --> 17:49.910 But why do we have servers over in different countries if it's a US app? 17:50.190 --> 17:53.110 So, I know. 17:53.110 --> 18:03.110 It's, all this, all this I just wanted to like kind of show from a mobile , um, you know, a mobile pen testers perspective. 18:03.110 --> 18:06.650 How I would securely look at these devices. 18:06.990 --> 18:10.970 I'm going to go in just a little bit more on my mobile. 18:11.910 --> 18:15.010 Um, say you want to take it a step further. 18:15.450 --> 18:18.890 Uh, you need a jailbroken or rooted device. 18:18.890 --> 18:22.170 I use Magisk personally for my Android . 18:22.710 --> 18:27.890 I use Uncover for my, uh, IOS. 18:28.690 --> 18:34.130 And then these are my steps that I would take to look at like local data storage. 18:34.330 --> 18:36.970 I would have my rooted or jailbroken phone. 18:39.250 --> 18:48.110 And then, uh, if I was wanting to, um, not get, like get the app from the actual app store, I would just create a fake account. 18:48.190 --> 18:49.870 Um, and do it that way. 18:49.870 --> 18:59.810 But, the, if you're just going to do static analysis and you don't need a phone, um, APK Pure and MobSF is like the best way to go. 19:00.110 --> 19:04.170 So, this is my little bit more technical part of my talk. 19:04.470 --> 19:07.590 Um, I use ADB for Android. 19:07.590 --> 19:17.230 And that, um, is my tool kit that I use a lot to do more internal investigation of the device and the application. 19:19.560 --> 19:30.800 Burp Suite I use, uh, to do that traffic to see what the application, um, how it functions, which, 19:34.780 --> 19:37.780 um, Frida is another app that I use. 19:37.960 --> 19:50.140 Um, this app, if it, you have to, like, be in a wrong state of mind to learn, learn how this app functions. 19:50.140 --> 20:00.200 So, I use FreeDump a lot to dump the memory of a device. 20:00.340 --> 20:04.400 So, sometimes applications will dump information in run time. 20:04.780 --> 20:06.820 Um, this is a great tool. 20:06.820 --> 20:18.960 So, if they don't reboot their phone and you're looking for maybe potential security flaws or application issues, um, I would use this tool right here. 20:20.500 --> 20:22.300 This one I have just left over. 20:22.300 --> 20:34.680 I was, you pull, like, your unencrypted IPA file and that's another way you can, like, statically, uh, analysis an IPA for iOS and that's, uh, FreeDump. 20:36.080 --> 20:38.980 Tied to Frida, let me take a break here. 20:42.110 --> 20:47.470 Tied to Frida is Objection and that's another tool that I use in and out. 20:47.470 --> 20:59.050 And if I were to be taking these augmented reality, um, apps, I would go through and kind of inspect them a little bit deeper. 20:59.090 --> 21:20.890 So, Objection, you can do, um, file system, exploration, you can bypass certificate pinning, dump keychains, so if they're not, um, storing things or if they're storing, uh, stuff in the keychain properly or maybe they're not storing it properly, you can get that information. 21:21.090 --> 21:26.230 Memory leak issues, you can manipulate objects. 21:26.470 --> 21:29.690 Um, this is a starting command for Objection. 21:29.770 --> 21:32.410 You didn't think this was going to be a mobile talk now, did you? 21:32.410 --> 21:33.570 It is. 21:34.630 --> 21:38.670 Um, so these are the kind of commands that you can run with Objection. 21:39.210 --> 21:44.450 Basically, these are my go to when I'm, like, searching through an app. 21:44.450 --> 21:50.730 Uh, if it's got SSL, like a cert pinning so I can't use burp suite, I'll use the bypass. 21:50.790 --> 21:56.370 If it detects root detection, I will bypass that with the root disable. 21:56.710 --> 22:10.770 Key store, um, looking for classes, I like to take the classes and try to launch them in the app, um, without being logged in to see if I can get some sort of different information. 22:10.990 --> 22:20.750 Um, and that's not so much with these apps that I was talking about before, but a lot of times, like maybe a banking app, can I launch that activity? 22:20.750 --> 22:23.830 Will it drop me into the banking software? 22:23.870 --> 22:39.070 So, iOS, um, NS user defaults, sometimes a lot of information gets stored in that and you'd be surprised, um, yeah, you'd be surprised. 22:39.070 --> 22:44.450 I've seen passwords in there, so it's definitely a good thing to look at. 22:44.910 --> 22:50.290 Uh, credentials, I'll have you on, I have the defaults twice, I never fix that, whoops. 22:50.950 --> 22:58.390 Uh, key chain dump, and then cookies, again, we need to see if the app is storing things properly in the key chain. 23:01.130 --> 23:21.070 So, um, I know I kind of touched on, oopsie, a little crazy on the slides, I know I kind of touched on iOS a little bit, but I use jadex too for decompiling my android apps, um, that's a good app to have a nice, if you're a gooey person like I am, uh, 23:21.070 --> 23:39.250 you can take that, uh, APK, you don't even have to do anything with it, it just, you stick it in the app and it shows you all your classes and it's an easier way to be able to look at that information and see what, um, what the app has. 23:40.110 --> 23:44.430 So you have your mobile apps, what am I looking for? 23:44.630 --> 24:07.150 Secrets, keys, credentials, URLs, IP addresses, email addresses, um, and then again with the augmented reality, if I was given that like as an assignment, I would probably look to see what kind of URLs that aren't tied to that company, you know, how, why are they going to that, 24:07.150 --> 24:15.410 is it necessary, because there is a lot of information that gets stored in apps that you don't normally think you would want to see. 24:18.520 --> 24:34.980 So, after all this, um, circling back around with our augmented reality and our mobile apps, like, how, what should we do as humans to like keep, keep ourselves secure? 24:34.980 --> 24:38.280 So, avoiding giving out too much information. 24:38.280 --> 24:47.080 A lot of times it's easy to just put your name down and just let it auto fill in the app and then hope for the best. 24:47.260 --> 24:57.700 So, um, give, give half information if it's an app that does not need your information, you do not need to give your app, that app your information. 24:57.720 --> 25:05.320 So, have a Jane Doe or whatever name and then Paul won't be able to user enumerate you. 25:05.880 --> 25:08.340 So, do you want to come finish the rest of your talk? 25:08.340 --> 25:08.940 No. 25:09.460 --> 25:13.300 Anyways, um, VPN, that's another one. 25:13.300 --> 25:15.240 I've been told I should use it. 25:15.380 --> 25:17.460 I probably will, eventually. 25:18.100 --> 25:22.180 Um, and then going back to like the, the physical devices. 25:22.180 --> 25:23.300 So, firmware. 25:23.860 --> 25:29.120 Firmware is huge when you have your physical devices, like your glasses, keeping those up to date. 25:29.120 --> 25:41.240 I know when I worked, um, in my previous job, I did a lot of drone stuff and keeping firmware up to date on your drones is a necessary, necessary evil. 25:41.240 --> 25:49.560 So, um, I know it can be a pain in the butt and it probably sometimes might make your drone act funny. 25:49.560 --> 25:53.580 I might, may or may not have had that happen in my life before. 25:53.620 --> 25:56.260 Maybe it will just fly up in your house for no reason . 25:56.260 --> 25:58.080 But firmware updates are needed. 25:58.260 --> 26:01.840 Um, and then locking your device. 26:01.840 --> 26:06.840 I know it's something really simple to say, but I feel like people still don't do that. 26:06.840 --> 26:15.180 And two factor authentication is I feel like the best way to make sure that your information doesn't get put out there. 26:15.340 --> 26:22.400 And like I said, to push that first bullet point is don't put your information out there if it doesn't need to be. 26:22.740 --> 26:30.180 Um, that's like the best information that I could give for keeping yourself secure in these kind of apps. 26:30.280 --> 26:43.900 Because they are going to start pushing more tracking information and they are going to start getting more of our data and sending it out so then they can use, uh, use it for other things. 26:43.900 --> 26:50.220 You know, like when you think about buying a pair of shoes and it shows up in your, um, shows up in your ads. 26:50.300 --> 26:51.140 Right? 26:51.720 --> 26:54.940 So, I might have went too fast. 26:55.020 --> 27:00.220 But, uh, some training material that I often like to suggest. 27:00.400 --> 27:02.340 Shameless post of my job. 27:02.340 --> 27:03.420 The blog. 27:03.420 --> 27:05.300 Or you can hear me on a podcast. 27:05.640 --> 27:11.100 But, um, when I first started doing mobile security, like this was my bread and butter. 27:11.100 --> 27:13.860 Uh, the OWASP mobile security testing guide. 27:13.860 --> 27:16.180 It's my, it's my thing. 27:16.180 --> 27:17.280 Like I, I liked it. 27:17.280 --> 27:18.740 It has good information. 27:19.300 --> 27:25.440 Um, and there's also a website hack tricks that I have referenced quite often now. 27:25.880 --> 27:28.720 Um, but I did not have that on that slide. 27:28.720 --> 27:33.980 So, with that, I think, I think that's 30 minutes. 27:33.980 --> 27:36.120 That's a solid 30 minutes. 27:36.120 --> 27:40.480 If anybody has any questions, we can answer them down, we, there's a royal we. 27:40.480 --> 27:46.920 I can answer them down there and here's my information if you want to just message me, that's fine too. 27:47.140 --> 27:51.140 Um, but yeah, that's, that's my first DEF CON talk. 27:51.140 --> 27:51.760 Woo!