June 16, 2026 • 43 mins
Got a question or comment? Message us here!
You probably haven’t been hacked, you’ve been tracked. This episode breaks down how ad tech, mobile apps, and data brokers create massive behavioral profiles without ever touching your phone’s security.
Learn how tracking really works, why it matters, and what you can actually do about it. 📱👁️📡
Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_01 (00:00):
A lot of people talk about like, oh, we're being
tracked, you know, our messagesare being listened to, our phone
calls are being listened to.
How realistic is that?
SPEAKER_02 (00:10):
I mean, pretty realistic, but I think people uh
don't understand a lot of themechanisms through it through
what it happens.
Um, there are some sources whichare absolutely public, being
scraped, being monitored, thingslike that.
If I just call you directly, issomebody listening to that phone
call?
Likely not.
Um, unless you have some sort ofa really targeted surveillance
(00:32):
against you, that you've gotmalware or you've got a wiretap
federally or something likethat, which there are a lot of
federal wiretaps.
Like that happens on extremelylarge scale.
So that's a different storyentirely.
But I think that the most likelything is that you're more
predictable than you think.
SPEAKER_00 (00:53):
You are now listening to the Secure AF
Podcast.
SPEAKER_01 (01:03):
All right, welcome to another episode of the Secure
AF Podcast.
This is episode 112.
You're probably not beinghacked, you're being tracked.
That's what we're gonna rollwith here.
SPEAKER_02 (01:12):
So I like that we're keeping count with the podcast
now.
I didn't know the bad ones was.
SPEAKER_01 (01:15):
Yeah, Sam does a good job.
Yeah, that's it, and it's funnytoo, because I tell people all
the time it's 112 episodes ofSecure AF, the bi-weekly one,
not counting Hickman's you know,sock brief that's the word.
So yeah, welcome to episode4365.
(01:37):
No, uh yeah, anyway.
Um, yeah, Bronze that's backout.
So we were discussing last week.
Um, there was a report that cameout about ad-based geolocation
surveillance.
So we were talking about this.
So there's a system, it's calledWeblock.
Um, it uses data from mobileapps and digital advertising um
to track people's locations andbehaviors at massive scale.
(02:01):
Um, and it can monitor up tomillions of devices globally
using constantly updated streamsof location and profile data.
Um, but here's the thing, and wehear this a lot of times too.
We have people that always, hey,I think my phone's been hacked.
Okay, well, what's going on?
(02:22):
And then they tell us what theymean by their phone is being
hacked, and it's not necessarilythe dish definition of hacking.
And just like in this case, um,this isn't, yes, this data is
out there, but they're nothacking phones.
They're buying data from ad techcompanies, um, and they're
tracking movements and routines.
(02:43):
They're identifying um a lot ofdifferent stuff.
This is like historical locationdata that can go back like
several years.
Um, it's no hacking required onthis.
It's they're just buying access.
Yeah.
SPEAKER_02 (02:57):
Yeah, and this and this this goes out even further
than this, too, where you canbuy location data and all kinds
of stuff as well.
Um, I mean, you can buy asidefrom this is a huge thing that's
being uncovered.
Um, but you can you can buyadvertising information for a
long time, right?
I want to geofence target myclients.
(03:17):
I mean, that's been a thing fora long time.
And you can buy that data for adecade.
So, I mean, this isn't exactlysuper new.
This is a very new insight intohow deep this goes and the scale
that it goes and who's using it.
And this was uh from CitizenLab.
Yeah, and Citizen Lab is isawesome.
I love them, they do great work.
(03:38):
Um, but they they kind of brokethe they kind of broke the story
on this.
Right, yeah, yeah.
Um, specifically Weblock with umuh Pin Link.
Sorry, they changed their name.
They were a different company,they changed their name to Pen
Link.
Wait, they sold to Pin Link, Idon't know the details, but now
they're Pin Link.
So um yeah, it's just uh massivecorrelation of advertisement
(04:03):
data.
And I want to introduce a newterm to you guys too.
So you've got OSINT, open sourceintelligence, SIGINT, signals
intelligence.
We're gonna call this ad int.
So this is advertisingintelligence because that's
exactly what it is, and it wouldbe used the exact same way.
SPEAKER_01 (04:18):
Yeah.
Oh yeah, absolutely.
And it's it's it's interestingtoo because this kind of dives a
little bit into my world too,because I'm at alias here, I'm
the director of marketing, um,and I do a lot of ad int, yeah,
I guess we're called.
Yeah, that's right.
Yeah, yeah, yeah.
Um, because a lot of what I dois is it's I refer to it as it
is social engineering.
(04:39):
Advertising is socialengineering, you know, because
what we're trying to do is we'retrying to get into the
consumer's head.
We're trying to figure out likewhat their patterns are, what
their likes are, what theirdislikes are.
We're trying to, it's abehavioral analysis.
And uh once we can figure outwho they are and what they are,
then we can figure out how wecan reach out to them in like
(05:00):
their language, their terms.
Um, should we talk about withoutmentioning any names an example
of that from very recently?
So we uh um so not naming anynames, but there may have been a
trend that was going around umon on the TikToks about
something.
And um legitimately it is a umphysical um security issue.
(05:24):
Oh, yeah.
Yeah, yeah.
And uh so we and of course atAlias we do physical um risk
assessments.
So as part of our also ourphysical penetration testing
that Tanner does a lot of, uh,where companies are hiring us
literally to break into theirfacilities and then show them
where those vulnerabilities are.
Um, we do a lot of walk aroundswhere we analyze things.
(05:46):
And so Tanner had seen somethingand he ran it by me and he was
like, hey, you know, like I'mwatching these videos and I see
like 10 things they can fiximmediately when you reach out
to these people.
And so we had the fun idea ofdoing a little bit of this.
Um, and so what I ended up doingis I started we started
researching this company um andI geo-targeted them.
(06:06):
So I created ads.
Um, and the fun part was Icreated ads for us that were
like in their color scheme withlike their call-to-action
styles, imagery that wouldappeal to them, using their
terminology, using their fonts.
So basically giving something tothem that made them feel
comfortable because it was veryrecognizable.
(06:27):
And then we just geo-targeted itto like specifically just those
areas.
Um, and it was pretty funny tosee it because it actually
worked.
Yeah.
So yeah.
Yeah.
SPEAKER_02 (06:37):
Um, but and this is kind of what we're talking about
with the I will say though,that's actually out of a out of
a hey, we could actually help.
That wasn't like uh like atroll.
That was legitimately like yes,oh hey, you guys should do this.
SPEAKER_01 (06:49):
Yes, to clarify, we were trying to help.
So we were just, I just thoughtwas interesting to kind of get
in that behavioral speak oflike, how can I appeal to
specific people with thelanguage that they understand
with the image.
SPEAKER_02 (07:04):
And that's without even having access to this
stuff.
SPEAKER_01 (07:06):
Right.
Yep.
So yeah, so it's it's it'srelatively easy to do this.
But you know, there's let'slet's go back for a second.
So there's, and I know peoplehave talked about this a lot,
and this is kind of a hot take,but you know, whenever you're,
you know, you're not searchingon your phone, you're not typing
something in, you're not textingsomething, you're not googling
(07:28):
something, um, but maybe you'rehaving just a verbal
conversation out loud withsomebody.
And I've had this happen beforewhere I'm having a verbal
conversation with a friend ofmine.
We're talking about goingcamping, and suddenly the next
day I start seeing like camping,like advertisements for like
camping supplies and stuff.
And even weirder, one time I wasplaying piano at this guy's
house and suddenly startedgetting piano ads the next day
(07:50):
for like sheet music and chairsand accessories and stuff.
And I was like, man, we didn'teven talk about that.
It was we were just playingpiano.
So um a lot of times people willsay, Oh, yeah, it's they've
hacked into my phone.
And no, that's not really what'shappening.
Really, when you're seeing theseads pop up, I know you have a
different take on this, um, butit's it's just you know, you're
(08:12):
being tracked through legitimatedata pipelines.
They know what your behaviorsare, they know what you're
looking for, they know whatyou're doing.
So they use that to try andappeal to you.
Yeah.
So yeah.
SPEAKER_02 (08:24):
No, I wouldn't say I have a different, a different
take.
Um, as far as the passivelistening thing goes, I think
that a lot of people uh have alot of suspicion that things
like that are going on.
But I also feel like we wouldhave a whole lot more proof.
Um, so I'm undecided on thatbecause I try to only work off
of data that I have, right?
Not as much of like anecdotes.
(08:45):
Um what I think it may be alsois that the data that's being
collected, such as the thingsthat you have sent messages
about, social media posts about,the advertisements you've
clicked on, the locations you'vegone to, the people you've
interacted with, the things thatthose people do, I think that
maybe you're a lot morepredictable than you think you
(09:06):
are.
Yeah.
And I think that goes foreverybody.
SPEAKER_01 (09:08):
Oh, yeah.
SPEAKER_02 (09:09):
So it could be that as well.
It could be that as well.
Um, but I I think there'sthere's a lot of other concerns.
Um I don't mean derail, I knowyou have kind of a kind of a
line.
So go ahead.
We'll we'll get to my myconcerns before I start going
off.
SPEAKER_01 (09:27):
Yeah, no, we're good.
Um yeah, so let's let's justkind of like let's talk about
how phones actually do leakdata.
SPEAKER_02 (09:37):
Okay.
SPEAKER_01 (09:38):
So um I'm going to mention a couple things.
You just give me some ideas ofwhat you think about.
So app permissions, SDKs.
SPEAKER_02 (09:46):
Oh, yeah, yeah, tons.
Uh it depends on the SDK, right?
Um, and and that's that's morelike Android focused, but uh,
Apple has their own equivalence.
Um, so that's gonna be theactual application package that
you install.
So what can it access?
I mean, theoretically,everything if you let it.
Um, and so we've found likevulnerabilities in SDKs several
times where we could actuallylike route the phone or where we
(10:08):
could gain system level access.
And if you have that, you canpull anything on the phone.
So I'm not saying they are.
Are some of them almostcertainly?
There's been malware found onapp stores and things like that.
Yeah, like it's almost certainlyhappened.
Uh, and you get you know,permissions pop up so it says,
Do you want to trust this to docross-application tracking and
things like that?
(10:29):
And I mean, yeah, that's that'sjust as bad as it sounds.
Yeah.
Um, and I'm not sure thattelling it no will always
prevent it either, becausethere's still lots of other ways
that's gonna correlate thatdata.
So, yeah, an SDK or anapplication can have full access
to literally everything on yourphone, yeah, depending on what
it does.
SPEAKER_01 (10:46):
And I think that that also it's a great time for
a little bit of a um um justnote to throw out there, um,
just kind of public awareness.
You know, a very good reason whyyou should always make sure that
if you're downloading apps foryour phone, that it's through a
legitimate source, whether it'sthrough um Google Play or the
(11:06):
Apple store or um the Androidstore, um not downloading
applications through websites.
SPEAKER_02 (11:15):
Um Yeah, and especially in this industry, in
in the security industry,there's a lot of things that
they don't allow in the appstore, they don't put up there,
and and I'm not saying they'reall bad by any means.
Most of those, however, are opensource.
And at that point, you need tobe able to understand what
you're looking at and look at itto know if these things are good
or not.
Um, you need to know what you'redoing at that point.
(11:36):
So I'm not gonna say don't evergo sideload an app, don't ever
go get something offline.
Like it, it it can be extremelyuseful.
Um, but you need to really knowwhat you're doing and understand
the risk that you're puttingyourself in at that point.
SPEAKER_01 (11:50):
Right.
Yeah.
And I've seen this a lot oftimes too with apps where it's
like they're on the store andthen they're taken offline and
now they're being distributeddirectly through the original
creator.
And it there may not be anythingmalicious about that, but
there's that extra layer ofprotection, that extra layer of
another development team, anunbiased party going through it
(12:10):
and looking at it that nowyou're missing.
SPEAKER_02 (12:12):
So to an extent, uh, I think the biggest the biggest
safety is that you're actuallygetting it from the vendor.
So, like if um something that'shappened before is in Linux, if
they generally allow mirrors.
And so if you want to downloadthe operating system from a
mirror, anybody can go put up amirror and you load up the file
(12:33):
and it's whatever whateverfile.iso, you can download it,
install the operating system.
I could go download that IS ISO,I could modify it, and I could
put it up there, which is whyyou need to check hashes and
check your checksums and makesure that it's actually the file
that it says it is.
Right.
Um, so that can happen as well,where you need to make sure that
you're not downloading from somealternate source that actually
(12:55):
has modified things.
SPEAKER_01 (12:56):
Yeah, yeah.
Um, so next point so atpermissions SDKs, we talked
about that.
Um, ad tech ecosystem.
So your device, it broadcastsyour location, your device ID,
behavioral metadata.
SPEAKER_02 (13:12):
I mean, I.
Yeah.
Yeah.
Unique identifier for the phone.
Mm-hmm.
So, and then um whateveraccounts that you're in,
whatever that account is.
Those accounts have profiles.
So, like if you're on socialmedia, all of your accounts have
profiles where it's like youralgorithm is tuned to you, and
you can see like this person isa uh uh liberal democrat who
(13:34):
likes um these types of arts andthey like this type of music.
And like this is all part ofyour algorithm.
That's how it knows to serve itto you.
And the ad tech has access tothis data as well.
That's how they know who to giveads to.
They generally do this in theback end, but you can still
request data on some platforms.
SPEAKER_01 (13:52):
Yep, yep.
And the third thing that I'llmention as, you know, a way that
our phones do leak data isthrough data brokers.
So, you know, they aggregate,they sell the info downstream,
and that data is eventually umaccessed by uh marketers,
private companies, sometimeseven the government.
SPEAKER_02 (14:11):
Yeah, that law enforcement.
Yep.
Yeah, that's that's uh that's abig part of uh of the concerns
that people should have.
Yeah.
Um which we can go into if youwant.
Uh yes.
The so you historically have tohave a warrant in order to pull
data from a cell carrier.
If you want to get a warrant andsubpoena a cell carrier and you
(14:34):
want to say, hey, I needlocation data of where this
number was, we needtriangulation data, we need to
know exactly where this wasduring this time frame because a
murder happened or somethinglike that.
And we deal with this prettyoften.
But what a lot of the lawenforcement is now doing, like,
we know that there's I've got alist I can pull up of people
that we've confirmed as clientsof this particular instance.
(14:56):
Um, they are not having to getwarrants because they can just
go buy this data that's readilyfor sale and they know exactly
where you've been.
They know uh where what yourlocation was, they know if it
was a religious institution,they know if you've been to a
protest, they know if you'vebeen to a shooting range, they
know if you've been to uh umwhat your friend's house is, if
(15:16):
you know if you're involved in arelationship, you know, you're
where you work, they know umwhat stores you go to, they know
that you went to a cardealership a couple of times,
like it's the they really canget granular detailed on that,
and they can they can dig inextremely easy because it's a
location pattern of everywhereyou've been.
SPEAKER_01 (15:36):
Yeah.
So let me ask you this is buyingdata fundamentally different
from surveillance?
SPEAKER_02 (15:43):
Uh data is simply data, the usage is what defines
what it is, I guess.
So um I would say no, but itreally just depends on what the
intentions are.
SPEAKER_01 (16:02):
Yeah.
SPEAKER_02 (16:05):
But I don't necessarily think that an
advertising company uhsurveilling you makes it any
better than the governmentsurveilling you.
SPEAKER_01 (16:13):
Right.
Yeah.
So each has their own goal.
So so leading into that point,maybe a hot topic of contention,
maybe we use this for the uhpreview to get more listens.
I don't know.
Or maybe we don't, so we the wethis doesn't come out, but a lot
of people talk about like, oh,we're being tracked, you know,
(16:33):
our messages are being listenedto, our phone calls are being
listened to.
How realistic is that?
SPEAKER_02 (16:40):
I mean, pretty realistic, but I think people uh
don't understand a lot of themechanisms through it through
what it happens.
Um there are some sources whichare absolutely public, being
scraped, being monitored, thingslike that.
If I just call you directly, issomebody listening to that phone
call?
Likely not.
Um, unless you have some sort ofa really targeted surveillance
(17:03):
against you, that you've gotmalware or you've got a wiretap
federally or something likethat, which there are a lot of
federal wiretaps.
Like that happens on anextremely large scale.
So that's a different storyentirely.
But I think that the most likelything is that you're more
predictable than you think.
Because you we know that you arethis person who's done these
(17:25):
things and has these interestsand has this political
affiliation.
They probably know yourpolitical affiliation better
than you do.
Um, we know that he interactswith these people who think
these things and have theseinterests, and they usually go
to these places, but sometimesthey go to these places, and
there they usually do thesethings and they search these
things.
And last night at two in themorning, whenever he couldn't
(17:45):
sleep, he was looking up thisone thing, and that is usually
looked up by people who do XYZ.
Like it's the data that you canget through the mass data
correlation is uh probably justas good, uh, if not even better.
It's kind of like um there's onestory I I like to tell.
There was a uh lady who uh waspregnant and she was buying
(18:10):
things through Target, and sheused to get these mailers from
Target.
Um, and this was years ago, soit's gotten much better.
But she um didn't know she waspregnant, and so she would get
these mailers, and so she wentto Target and she was buying
things and she was checking heraccount and she was buying like
pickles and these random thingsthat typically happen as
(18:32):
cravings in the early stages ofpregnancy.
Yeah, and they startedadvertising after that.
They started prenatal vitaminsand diapers and all these kind
of things, and she was like, youknow, this is really weird.
Why am I getting theseadvertisements?
Took a pregnancy test, she waspregnant.
SPEAKER_01 (18:48):
That's wild.
SPEAKER_02 (18:48):
Target knew that she was pregnant before she did.
SPEAKER_01 (18:50):
That's wild.
SPEAKER_02 (18:51):
So the data correlation can be extremely
strong.
Oh, yeah, yeah.
And that's just talking aboutrandom cravings.
SPEAKER_01 (18:57):
Like, yeah, yeah, we talk about human behavior and
and everyone is unique to anextent.
It's like when we look at from amarketing aspect, um, we look at
basically creating buckets.
So if we're creating likepersonas um to advertise to, um,
you know, it it might be five toeight different personas.
(19:21):
There could be like five toeight different buckets that
everyone kind of falls into, andwe don't check all the boxes
necessarily, but to an extent,yeah, it's like we up we're very
predictable.
Um, yeah.
SPEAKER_02 (19:35):
So I think that one thing that's really interesting
talking about the malware andlike going going towards
security is we we always want totalk about make sure you patch
your devices, make sure you havemulti-factor, watch out for
phishing, these things, whichare like, yeah, that's good.
These are these are extremelygood things.
But what I would be curiousabout is is an ad blocker just
(19:59):
as much as a privacy feature?
SPEAKER_01 (20:01):
You know, I I think this gives people a false sense
of security because you'reright, people do focus on
antivirus, um, but they reallydo ignore data exposure.
SPEAKER_02 (20:10):
Yeah, maybe you need to be turning off location data
and you need to be using a piehole on your home network, and
you actually need to be reallyhammering down on on you know
fighting advertisements.
Yeah.
SPEAKER_01 (20:23):
Well, and also like on the phone, so this is slight
tangent sideways, but just incase anyone else didn't know
this either.
Um, you've talked before about,hey, you know, the Apple
iPhone's pretty strong out ofthe box.
You know, if you're in public,if you're wanting to make sure
that you're being safe, um, turnoff Wi-Fi, turn off Bluetooth.
(20:44):
And that's basically it, right?
SPEAKER_02 (20:47):
Um, yeah, I generally think you're fine to
leave them on too.
It depends on what you mean,right?
So we're not talking about beinghacked in malware and things
like that.
I think that that's generallyfine.
The most you're gonna get issomething annoying.
Yeah, if anybody has a zero daywhere it by you having Bluetooth
enabled on your phone, they canhack your phone.
(21:08):
They're probably going to takethe$1.2 million from Apple that
they get as a bug bounty fromthat.
Right.
They're probably not going tohack some random person at a
coffee shop with it.
SPEAKER_01 (21:17):
Oh, right.
Yeah, yeah.
And I think that's the thing.
People are like, oh, I'm beingtargeted, you know.
SPEAKER_02 (21:21):
I think that you you're generally fine with
things like that.
Yeah.
Um, but could there be uh largecompanies like maybe Starbucks
going with coffee shops?
Maybe they keep track ofeverybody who joins the SSID.
I don't know, but I would if Iwas them.
Yeah.
I mean, I think that there'sthere's a lot of there's a lot
of things like that for privacywhy you might want to do it.
(21:43):
And I think for the security ofyour phone, generally you're
fine to leave stuff enabled.
I think that you are generallyfine.
Uh the biggest thing is notinstalling random crap on your
phone and not uh accepting, youknow, messages and random stuff
from people.
Where you end up clicking onlinks maliciously and all that
sort of stuff.
SPEAKER_01 (22:04):
Right.
Yeah.
The point I was kind of gettingto was the fact that I had
thought that if you flick downthe menu and turn off Bluetooth,
Bluetooth is off.
It doesn't.
And it's not.
It's like a lot of people thinkthat.
They think that if you justflick it down, turn off
Bluetooth, Bluetooth is turnedoff.
You start BLE spamming me out.
It's like I've got Bluetoothturned off.
(22:24):
You're like, you don't.
And it's like, oh no.
You have to actually go into theBluetooth and the settings, turn
it off.
It's it's not as easy as justflick that just disconnects your
devices.
Right.
Yeah.
So okay, so we have this falsesense of security because people
are focusing on antivirus,they're ignoring data exposure.
Um, this brings about anexpansion of the attack surface.
(22:47):
So data can be weaponized, um,social engineering, physical
targeting, stalking, doxing.
Yeah.
SPEAKER_02 (22:54):
Yeah.
No, you're yeah, you're you'reabsolutely right.
I mean, um, if you have accessto buy uh, you know, this level
of of advertisement data, doxingpeople's probably pretty
insignificant.
I mean, uh, I think the thebiggest thing is that they're
keeping their customer list toit's not necessarily bad people
you want to to have it, butthey're they're not giving it
(23:17):
out to everybody at this point.
We we've can or Citizen Labconfirmed ICE is using it, US t
US military organizations, uhTexas DPS, a bunch of local
police departments, a bunch ofdistrict attorneys, um, some
other uh countries, uh ElSalvador National Police,
Hungarian intelligence services,I'm sure most of our
(23:39):
intelligence services, why wouldthey not?
Um So I I think the biggestthing is preventing them from
being a huge issue whenever itdoes come to stalking and that
sort of stuff is um is gonna bethe fact that the data's a
little bit exclusive right now.
Now, how long until that getsout, I don't know.
SPEAKER_01 (23:58):
Right.
Well, and what's to stop thisfrom becoming part of a
ransomware attack and now thatdata is all out there.
Exactly.
Exactly.
Yeah.
So let's talk about all right,let's talk about actions that we
could take.
So practical defense.
Um, what are some like highimpact steps and things that you
(24:18):
can do?
SPEAKER_02 (24:19):
Um actually, oh I gotta I gotta lead into that
kind of thing.
Okay, all right.
So um why what I'll say I wantto tell you what I think about
this as a red teamer.
So if I can get location, can Iverify an employee's identity
before I do a social engineeringattack?
(24:40):
If I can get their identity, canthen I get other people's can I
target an executive?
Can can I figure out thingsabout that executive that would
assist me in the socialengineering?
Um, can I find patterns in thethings that they do to set up an
attack easier?
Hey, this person always goes tothis coffee shop.
I'm gonna sit up there with aWi-Fi pineapple.
(25:01):
Um, can I find travel patterns?
Every third Tuesday they flyhere or something like that, and
I can try to, you know, sourcemy attacks out at that point.
Um if they are at a data centeror something like that, you
know, it's looking at IT peopleor they go to this data center
sometime.
(25:21):
I bet you they have stuff there.
You can know where to target.
Yeah.
SPEAKER_01 (25:25):
Um it's it's any any gathering OSINT by following
someone around.
SPEAKER_02 (25:30):
And a lot of large organizations have covert
facilities too, right?
Where it's it's this is whatthey they don't want everybody
to know, their infrastructureshere.
It could easily reveal allthose.
Yeah.
So as far as a a business level,there's massive concern from
from employees that are justhaving their phones doing normal
(25:52):
stuff.
SPEAKER_01 (25:53):
Yeah.
It's wild.
SPEAKER_02 (25:55):
So how do you protect against that?
SPEAKER_01 (25:56):
Yeah, so how do you protect against that?
Well, first thing I'll throw onis you know, disable ad
tracking, which I would hate,honestly, as a marketer, but you
know, let's be real, if youwanna um start um ways to
disable this, yeah, ad tracking,reset your advertising ID.
(26:19):
Um and this is something thatI've actually done a lot of too,
just because I hate the way myphone battery drains all the
time, but limiting locationaccess.
You know, don't have it whereyou you you don't need Spotify
to know where your location isat all times, you know.
There's apps that doesn't thatdon't need to know where you
(26:41):
are.
So if you have an app that doesrequire um location tracking,
um, you know, set it to likewhile using or something similar
to that.
So yeah.
Um probably good securityhygiene to just remove unused
apps as well.
Um prefer privacy-focused apps.
(27:02):
Um, and then you know, avoidingunnecessary permissions.
So whether that's like, youknow, Bluetooth permissions.
I mean, how many times do yousee now like I will go to open
up an app and I don't know why,but it's like, hey, do you want
me to find Bluetooth devices inyour area?
And it's wild when you're doingit at home because then you're
seeing like a map that's showinglike all the Bluetooth devices
(27:26):
of your neighbors and everyonewithin a radius um with the
names of those devices.
And so, yeah, contacts, um, youknow, et cetera, just you know,
permissions.
Yeah.
So um, what are some otherthings that you would suggest?
SPEAKER_02 (27:42):
Um, looking into something like a pie hole for
your home network, it's going tofilter out all of your
advertisements.
Um, there are some services thatcan feed fake data.
Uh there some of those arepretty fun.
Um, or you can like there'sthere's one is a browser plugin
where periodically you can say,like, hey, reset my advertising
profile, and it'll spend thenext 20 minutes just searching a
(28:06):
ton of things you would neversearch and going to a bunch of
websites you would never go.
You can go as far as spoofingGPS data to like really mess
with stuff.
Um, but I think the the mostpractical thing for people to do
is looking at ad blockers,looking at something like a pie
hole for your home network.
Um, this is actually I typicallydon't recommend VPNs, but
whenever it comes through like aprivacy sort of deal, really,
(28:28):
that's possible.
But at the same time, now all ofyour data lies with the VPN
provider, so you have to hopethat they're good.
SPEAKER_01 (28:34):
True, probably the same with like DNS filtering
too.
SPEAKER_02 (28:37):
Yes, yeah, sure.
Yeah, and a lot of the timesthose are one and the same.
SPEAKER_01 (28:40):
Yeah.
SPEAKER_02 (28:41):
Um, but the at that point also it could be like,
okay, we know that they're acustomer of Molad VPN.
Like, you know, I mean, becausethey know what those IPs are,
they know so so that might be adouble-edged sword, but
personally I do use one on mymobile phone, and I make sure I
have it has blockingadvertisements features on it
(29:02):
and and things like that.
Um, and you can get super crazywith it.
Really, I mean, use lockdownsystems that you know don't have
anything in them.
You know, you can go as far asI'm gonna use an Orange Pie
because it doesn't use any chipsthat have backdoors in it, and
I'm not gonna have anaccelerometer in this machine,
and I'm gonna do all these thesethings to make sure it's super
(29:23):
bare bones and only I have this,and I'm gonna use Linux that
doesn't have any kind of atracker in it, and uh like you
can really get get hardcore withit.
You can get hardcore.
But it just depends on how muchuh practicality you're willing
to put into it versus you knowwhat's what's what's tracking
you.
SPEAKER_01 (29:39):
Right.
And I'd I'd say, and I don'tknow, you can be your thoughts
on this too, but I don't think Idon't think you can fully opt
out, but you can take steps toreduce your signal.
Yeah, for sure.
Yeah, for sure.
All right, let's do it, let's doa little something fun here.
We're gonna do um a lightninground here because getting back
to the topic hacked versustracked.
(30:00):
So we're talking about a lot ofinstances where people are like,
oh, I've been hacked because youknow people are uh you know
promoting products to me andthey're ah, they're in my head,
they're in my phone, theythey're listening through the
devices.
Um, but okay, so no.
So malware infections, hacked,not tracked.
(30:20):
Sure.
So yeah, efficient compromise.
Generally hacked.
Yeah, not tracked.
Yeah.
App collection, um, collectinglocation.
So also not hacked.
SPEAKER_02 (30:33):
It could be either, but most much, much more likely
it's just it's just ad data.
SPEAKER_01 (30:39):
Yeah, ads following you.
Yeah, yeah, that's tracked,yeah.
Um, data broker profiles also,yeah, not hacked, but tracked.
And there you go.
Nation state spyware.
Probably hacked.
There's not much you can doabout that.
Yeah.
So um this might be a functionbug for you up.
(31:00):
Yeah.
Yeah.
Yeah.
Um get an unplugged phone.
Um, yeah, um, personally checkedby alias cybersecurity.
Yep.
So um, yeah, so the the nationstate spyware.
I think that's I I think one ofthe things that kind of sticks
out to me is people are like,oh, they're listening.
You know, like, for instance,there's all these protests that
(31:21):
happen, and regardless of whatside you're on, the protests,
there are probably people therethat are, you know, analyzing
things and keeping an eye onthings and trying to see what's
going on.
And so um, you were telling me alittle bit about the stingray.
Yeah.
Um, but that's not like a itdoesn't work like in the movies
(31:43):
where it's like, oh, in realtime, they're capturing all this
data and they know exactly whatyou're saying, right?
SPEAKER_02 (31:49):
Yeah, yeah.
Yes and no.
Like, I mean, anything that'shappening through like a level
of of encapsulation andencryption is going to be harder
for them to see, but they candefinitely get especially like
SMS messages that aren't like aniMessage or like a signal or
something like that.
Right.
Um, so they have a have a devicecalled a Stingray, which is
basically a rogue cell tower.
Uh, and so they're they canbring this out to events like a
(32:11):
protest and they can say, okay,they have they can do like
what's called like a downgradeattack, where it's much easier
to do this on 4G than 5G.
5G has a lot of protections.
But if your phone doesn't have5G, it will it will negotiate
down to 4G, it will negotiatedown to 3G still.
So you can go down down untilthere are really vulnerable
(32:31):
protocols that they can use.
And so this is typically whatthey like to do.
Um, there's that's just one ofthe several attacks.
There's many attacks they can doto try to get you to link onto
the Stingray instead of theactual cell tower.
And you're going through theirs.
It's just like a Wi-Fi.
It's just like a Wi-Fipineapple, but but through that.
Um yeah, there's a device thatyou can you can set up called
(32:53):
the uh the ray hunter.
You can build it with uh with anLTE hotspot, and you can flash
your firmware onto it.
They support a bunch ofdifferent hotspots now, and it
you can take it to places andjust run it, and it'll look for
those patterns of attacks in theair.
Uh and you can you can run apacket capture and you can
analyze everything.
It'll start, it'll do it livetoo, where it'll like pop up and
(33:15):
say, like, you know, likeflashing red bar, like, yo,
there's a stingray, this deviceis is seeing attacks happening
on the air.
Um, so that's really fun to playwith.
SPEAKER_01 (33:27):
If if it identifies it, it's it's yeah, you know
it's within range.
Yeah, yeah.
SPEAKER_02 (33:31):
Yeah.
But yeah, yeah, if it yeah, ifit identifies it, it's
essentially too late.
SPEAKER_01 (33:36):
Yeah, yeah.
So all right.
So, you know, closing thoughts.
So, I mean, we've pretty muchwe've built I had a I had a
question.
SPEAKER_02 (33:44):
I had a question to ask you before we did closing
thoughts.
I don't know if you can tell meabout it or not, but are you
familiar with RTB or real-timebidding?
Real-time betting for ad for addata?
SPEAKER_01 (33:52):
I've I've heard about it, but I've I've not
looked into it now.
SPEAKER_02 (33:57):
Um, I don't know a ton about it.
We'll have to talk about itanother time.
But yeah, I guess there'sadvertising bidding on live ads.
So like it goes as much as um,hey, I'll bid this much to
advertise this to people whosearch this.
And so like there might be fivepeople who have bid on it, and
(34:18):
if you meet their profile enoughand they've bid enough, they'll
get their ad served to you.
So, like, if you meet a profileof like, say I have searched
these things and now I'msearching wedding rings or
something like that, there'slike five different advertisers
who are bidding to send their adto you because it's much more
likely a payoff.
Something like that.
SPEAKER_01 (34:36):
Yeah, yeah.
SPEAKER_02 (34:37):
Kind of like with Google AdWords.
Yeah, I don't know.
Apparently, this is happening ona large scale.
Citizen Lab was talking aboutit, but they didn't go into it
super deep.
SPEAKER_01 (34:44):
Hmm.
Okay.
We need to look into that forthe next time.
All right, all right.
Next podcast, real-time bidding.
Real time bidding, yeah.
Um, yeah.
So, I mean, we pretty much we'veit's we can't we can't really go
back.
We've kind of built this worldwhere surveillance doesn't
really require hacking, it'sjust access to the right data
feeds.
Um, so what what do you think ismore dangerous?
(35:08):
Illegal hacking or illegaltracking at scale?
SPEAKER_02 (35:12):
Well, it's not illegal.
Huh?
It's not illegal.
SPEAKER_01 (35:16):
Oh, I said legal.
Oh, legal, yeah, or legal.
SPEAKER_02 (35:19):
Yeah.
Um, I think an illegal hack willprobably be much more damaging
whenever it does happen.
But I think that for 99% ofpeople who are constantly being,
you know, tracked by ad stuff,they're more impacted than the
0.1% of people who are beinghacked.
(35:40):
So I think if you're unluckyenough to fall into the line of
the line of, hey, I'm actuallygetting hacked in a in a bad
way, um, that's probably goingto be worse for you than the
tracking.
But I think the tracking isinterfering with our lives in
ways that people have no ideaof.
SPEAKER_01 (35:54):
Oh, yeah.
No, we're happy to have thetools and the technology in our
hands, and we don't understandhow much we're actually giving
away with that.
So um, yeah, I'd say that, youknow, data tracking is making
people a lot more vulnerable.
SPEAKER_02 (36:10):
Yeah.
So especially whenever you tieit into, you know, the the flock
ecosystem and all the the camerastuff that's happening lately.
SPEAKER_01 (36:17):
Yeah, I was actually going to bring that up because
that's kind of like I I've thatthat's that's been happening
here in Oklahoma a lot.
And you actually were on thenews doing a segment about it
sometime last year.
Yeah.
And uh it's it's come up againthe news in the last couple of
weeks, and people were likecomplaining about it because
they're like, oh, I don't wantthese cameras tracking us
everywhere.
And that's funny because you seepeople like also respond, you
(36:39):
know, you have a camera in yourpocket that tracks you
everywhere you go.
It's not the same.
Yeah.
SPEAKER_02 (36:44):
It's not the same, though.
Yeah.
No, the the level of of datathat those are capturing is
absurd.
I mean, it's it's ridiculous thenetwork that they've developed.
Yeah.
You won't go into a little bitmore.
SPEAKER_01 (36:56):
This is another misconception network.
SPEAKER_02 (36:58):
It could be a whole nother a whole nother episode,
but but yeah, I mean they sothey're called ALPRs, automatic
license plate readers.
Most of the cameras that yousee, it's little, it's basically
got it looks like a littlewebcam on a solar panel that's
on a post, and they're kind ofstanding alone, and they usually
don't meet any of the standardsthat they need to for road signs
to meet, by the way.
Interesting, but I guess youknow that nobody cares about
(37:21):
that.
Um because they're supposed tohave safety protocols like
breaking away and they don't,but I digress.
Um, they they are able tomonitor everything that they can
see.
So they have profiles onindividuals walking, biking,
things like that for vehicles,which is obviously the main
(37:41):
thing.
It's not just license plate,they keep a profile of vehicles.
So if you don't have a licenseplate, they can still identify
that vehicle, they can stillgive it a profile.
Hey, this is um this is a 2012Corolla that has a dent on the
back left bumper and it has asticker here.
We know that this is a uniquelyindividual car.
We know who this is, we know whodrives it, we know where they
(38:03):
go, we know exactly what theirpatterns are every single day.
We know the one-offs that theydo because they have enough
camera for this, and they knowexactly where you were seen at
most recently, which is um, youknow, probably yeah.
But then the data, the the dataof the people who have access to
that.
I mean, a lot more people haveaccess to the flock data.
(38:23):
Tons and tons of people haveaccess to the flock data.
And we've seen um also ringcameras are feeding into flock
and all kinds of things now arefleeting, feeding in these
networks.
Not even to mention likePalantir and the larger nation
networks.
This is more of a smaller scale,but they've had we could we
could really go into this.
Uh, where they've hadindividuals who are doing creepy
(38:45):
stuff.
I mean, they've had people whoare um they had one, I think it
was an executive who got caughtlooking at like a bunch of like
children's gymnastics camerasand like all kinds of like
creepy stuff.
They've had like 37 instances ofofficers that are committing
stalking against like theirex-girlfriends and stuff like
(39:05):
that.
I mean, it's far worse.
Maybe not worse.
It's far worse on a smallerscale, but it's still a giant
scale.
SPEAKER_01 (39:14):
Gosh.
SPEAKER_02 (39:15):
So that's a whole we could we could talk all day
about flock.
SPEAKER_01 (39:18):
Oh, yeah, yeah.
And on the ring cameraspecifically, as I know we've
worked, I've helped out ondigital forensics cases where
you know we're looking at ringcamera footage to see something
that happened 500 yards down thestreet, you know.
SPEAKER_02 (39:31):
Yeah, and I won't I won't stick my head in the sand
and say like it doesn't ithasn't ever helped solve a crime
or something like that.
Like there's been valid uses ofit, but uh I it's it's a privacy
privacy versus safety sort ofdeal.
SPEAKER_01 (39:46):
Um and that's it's it's weaponized.
It's like in the hands of thewrong person, it can be very
detrimental.
SPEAKER_02 (39:52):
Who is it?
Benjamin Franklin that had theprivacy quote.
So those who value priv thosewho value uh safety above
privacy devo deserve neither.
Something like that.
I probably have that wrong, butyeah, I think that's all right.
SPEAKER_01 (40:05):
Abraham Lincoln said something about everything you
see on the internet being true.
Yeah, yeah.
Yeah, I don't know.
But yeah, so you've kind of wentinto this a little bit, but
yeah, just maybe a final word onlike, you know, going back to
using like the data brokerintel, like from a red team
expect uh from a red teamperspective, how do you see
attackers using that data?
SPEAKER_02 (40:25):
Yeah, kind of like what I was I was mentioning
earlier, where I I I would useit to identify an individual,
um, how I need to target tosocial engineer that individual.
A lot of the times I'll try tofind whenever somebody's gonna
not be there.
I'll try to like schedule acalendar invite with somebody.
And whenever they say, Oh, Ican't do that, I have I have
something here.
I'll try as like a fraudulentperson, right?
(40:46):
Like, hey, I'm part of thissales thing that you want, and
I'm gonna hook you up.
And can you do a meeting thistime?
And I'll just try to find a timethat they're not there, and like
that's when I know I can gobreak in and like say, Oh, I'm
here to see so-and-so.
Who I've already done all myresearch on that becomes a lot
easier, yeah.
So you can get data like that,um, find out the locations of
(41:07):
assets, you can find out um whatthey're into, or if you can
build a profile on somebody tospearfish them, which I've
talked before about some of thespearfishing campaigns that
we've done where we've reallygone all in developing, yeah.
SPEAKER_01 (41:20):
Well, I think, I think, and I don't know, this is
oof.
Kind of going off of that, youcan spearfish, you can find like
executives by you can figure outtheir families' patterns too,
yeah, yeah, based off of stuffthat they're looking up.
Like if they're looking up um,you know, vacation information
or like if they're looking atlike toys or I answered you as a
(41:42):
red teamer also.
SPEAKER_02 (41:44):
Um, yeah, had I been uh a real POS attacker, I might
even target the family.
SPEAKER_01 (41:51):
Yeah.
SPEAKER_02 (41:52):
And I might try to be hesitant to bring that up.
I might try to hack I might tryto go through Roblox via the
child to hack the familycomputer.
I might get an info stealer onthat family computer and see if
they've ever logged into theiremail on it.
Um yeah, I I would you could doa lot.
SPEAKER_01 (42:08):
Yeah.
It's it's a scary world.
But um, yeah, so the kind ofgoing back in the closing, you
know, I mean, this is this isjust the world we live in.
So tracking is way more commonand it's more normalized than
hacking is.
Um, you know, your phone isn'tspying on you, it's
(42:30):
participating in themarketplace.
So um just exercise, you know,safety and kind of going back
to, you know, again, thosebullet points of things that you
can do um to um, you know, tryto mitigate this a little bit,
you know, um, you know, disableyour ad tracking, you know,
(42:51):
limit your location access, um,remove your unused apps.
And this is good hygiene foryour phone anyway.
So, because it saves hard drivespace, it saves battery power.
Um, definitely preferprivacy-focused apps and uh
avoid unnecessary permissions.
Um, if you get pop-ups poppingup on your phone to like give
access to something, don't justlike blindly click it without
(43:13):
reading.
Look and see what it actually isdoing.
And you might want to sacrificea little bit of convenience for
your privacy.
Absolutely.
We're gonna end it on that notebecause I can't think of a
better line.
So thank you everyone forlistening.
Um, we'll catch you next time.
Thank you.
SPEAKER_00 (43:33):
The Secure AF Podcast is a production of Alias
Cybersecurity.
Visit us online ataliascybersecurity.com.
All rights reserved.
A lot of people talk about like, oh, we're being
tracked, you know, our messagesare being listened to, our phone
calls are being listened to.
How realistic is that?
SPEAKER_02 (00:10):
I mean, pretty realistic, but I think people uh
don't understand a lot of themechanisms through it through
what it happens.
Um, there are some sources whichare absolutely public, being
scraped, being monitored, thingslike that.
If I just call you directly, issomebody listening to that phone
call?
Likely not.
Um, unless you have some sort ofa really targeted surveillance
(00:32):
against you, that you've gotmalware or you've got a wiretap
federally or something likethat, which there are a lot of
federal wiretaps.
Like that happens on extremelylarge scale.
So that's a different storyentirely.
But I think that the most likelything is that you're more
predictable than you think.
SPEAKER_00 (00:53):
You are now listening to the Secure AF
Podcast.
SPEAKER_01 (01:03):
All right, welcome to another episode of the Secure
AF Podcast.
This is episode 112.
You're probably not beinghacked, you're being tracked.
That's what we're gonna rollwith here.
SPEAKER_02 (01:12):
So I like that we're keeping count with the podcast
now.
I didn't know the bad ones was.
SPEAKER_01 (01:15):
Yeah, Sam does a good job.
Yeah, that's it, and it's funnytoo, because I tell people all
the time it's 112 episodes ofSecure AF, the bi-weekly one,
not counting Hickman's you know,sock brief that's the word.
So yeah, welcome to episode4365.
(01:37):
No, uh yeah, anyway.
Um, yeah, Bronze that's backout.
So we were discussing last week.
Um, there was a report that cameout about ad-based geolocation
surveillance.
So we were talking about this.
So there's a system, it's calledWeblock.
Um, it uses data from mobileapps and digital advertising um
to track people's locations andbehaviors at massive scale.
(02:01):
Um, and it can monitor up tomillions of devices globally
using constantly updated streamsof location and profile data.
Um, but here's the thing, and wehear this a lot of times too.
We have people that always, hey,I think my phone's been hacked.
Okay, well, what's going on?
(02:22):
And then they tell us what theymean by their phone is being
hacked, and it's not necessarilythe dish definition of hacking.
And just like in this case, um,this isn't, yes, this data is
out there, but they're nothacking phones.
They're buying data from ad techcompanies, um, and they're
tracking movements and routines.
(02:43):
They're identifying um a lot ofdifferent stuff.
This is like historical locationdata that can go back like
several years.
Um, it's no hacking required onthis.
It's they're just buying access.
Yeah.
SPEAKER_02 (02:57):
Yeah, and this and this this goes out even further
than this, too, where you canbuy location data and all kinds
of stuff as well.
Um, I mean, you can buy asidefrom this is a huge thing that's
being uncovered.
Um, but you can you can buyadvertising information for a
long time, right?
I want to geofence target myclients.
(03:17):
I mean, that's been a thing fora long time.
And you can buy that data for adecade.
So, I mean, this isn't exactlysuper new.
This is a very new insight intohow deep this goes and the scale
that it goes and who's using it.
And this was uh from CitizenLab.
Yeah, and Citizen Lab is isawesome.
I love them, they do great work.
(03:38):
Um, but they they kind of brokethe they kind of broke the story
on this.
Right, yeah, yeah.
Um, specifically Weblock with umuh Pin Link.
Sorry, they changed their name.
They were a different company,they changed their name to Pen
Link.
Wait, they sold to Pin Link, Idon't know the details, but now
they're Pin Link.
So um yeah, it's just uh massivecorrelation of advertisement
(04:03):
data.
And I want to introduce a newterm to you guys too.
So you've got OSINT, open sourceintelligence, SIGINT, signals
intelligence.
We're gonna call this ad int.
So this is advertisingintelligence because that's
exactly what it is, and it wouldbe used the exact same way.
SPEAKER_01 (04:18):
Yeah.
Oh yeah, absolutely.
And it's it's it's interestingtoo because this kind of dives a
little bit into my world too,because I'm at alias here, I'm
the director of marketing, um,and I do a lot of ad int, yeah,
I guess we're called.
Yeah, that's right.
Yeah, yeah, yeah.
Um, because a lot of what I dois is it's I refer to it as it
is social engineering.
(04:39):
Advertising is socialengineering, you know, because
what we're trying to do is we'retrying to get into the
consumer's head.
We're trying to figure out likewhat their patterns are, what
their likes are, what theirdislikes are.
We're trying to, it's abehavioral analysis.
And uh once we can figure outwho they are and what they are,
then we can figure out how wecan reach out to them in like
(05:00):
their language, their terms.
Um, should we talk about withoutmentioning any names an example
of that from very recently?
So we uh um so not naming anynames, but there may have been a
trend that was going around umon on the TikToks about
something.
And um legitimately it is a umphysical um security issue.
(05:24):
Oh, yeah.
Yeah, yeah.
And uh so we and of course atAlias we do physical um risk
assessments.
So as part of our also ourphysical penetration testing
that Tanner does a lot of, uh,where companies are hiring us
literally to break into theirfacilities and then show them
where those vulnerabilities are.
Um, we do a lot of walk aroundswhere we analyze things.
(05:46):
And so Tanner had seen somethingand he ran it by me and he was
like, hey, you know, like I'mwatching these videos and I see
like 10 things they can fiximmediately when you reach out
to these people.
And so we had the fun idea ofdoing a little bit of this.
Um, and so what I ended up doingis I started we started
researching this company um andI geo-targeted them.
(06:06):
So I created ads.
Um, and the fun part was Icreated ads for us that were
like in their color scheme withlike their call-to-action
styles, imagery that wouldappeal to them, using their
terminology, using their fonts.
So basically giving something tothem that made them feel
comfortable because it was veryrecognizable.
(06:27):
And then we just geo-targeted itto like specifically just those
areas.
Um, and it was pretty funny tosee it because it actually
worked.
Yeah.
So yeah.
Yeah.
SPEAKER_02 (06:37):
Um, but and this is kind of what we're talking about
with the I will say though,that's actually out of a out of
a hey, we could actually help.
That wasn't like uh like atroll.
That was legitimately like yes,oh hey, you guys should do this.
SPEAKER_01 (06:49):
Yes, to clarify, we were trying to help.
So we were just, I just thoughtwas interesting to kind of get
in that behavioral speak oflike, how can I appeal to
specific people with thelanguage that they understand
with the image.
SPEAKER_02 (07:04):
And that's without even having access to this
stuff.
SPEAKER_01 (07:06):
Right.
Yep.
So yeah, so it's it's it'srelatively easy to do this.
But you know, there's let'slet's go back for a second.
So there's, and I know peoplehave talked about this a lot,
and this is kind of a hot take,but you know, whenever you're,
you know, you're not searchingon your phone, you're not typing
something in, you're not textingsomething, you're not googling
(07:28):
something, um, but maybe you'rehaving just a verbal
conversation out loud withsomebody.
And I've had this happen beforewhere I'm having a verbal
conversation with a friend ofmine.
We're talking about goingcamping, and suddenly the next
day I start seeing like camping,like advertisements for like
camping supplies and stuff.
And even weirder, one time I wasplaying piano at this guy's
house and suddenly startedgetting piano ads the next day
(07:50):
for like sheet music and chairsand accessories and stuff.
And I was like, man, we didn'teven talk about that.
It was we were just playingpiano.
So um a lot of times people willsay, Oh, yeah, it's they've
hacked into my phone.
And no, that's not really what'shappening.
Really, when you're seeing theseads pop up, I know you have a
different take on this, um, butit's it's just you know, you're
(08:12):
being tracked through legitimatedata pipelines.
They know what your behaviorsare, they know what you're
looking for, they know whatyou're doing.
So they use that to try andappeal to you.
Yeah.
So yeah.
SPEAKER_02 (08:24):
No, I wouldn't say I have a different, a different
take.
Um, as far as the passivelistening thing goes, I think
that a lot of people uh have alot of suspicion that things
like that are going on.
But I also feel like we wouldhave a whole lot more proof.
Um, so I'm undecided on thatbecause I try to only work off
of data that I have, right?
Not as much of like anecdotes.
(08:45):
Um what I think it may be alsois that the data that's being
collected, such as the thingsthat you have sent messages
about, social media posts about,the advertisements you've
clicked on, the locations you'vegone to, the people you've
interacted with, the things thatthose people do, I think that
maybe you're a lot morepredictable than you think you
(09:06):
are.
Yeah.
And I think that goes foreverybody.
SPEAKER_01 (09:08):
Oh, yeah.
SPEAKER_02 (09:09):
So it could be that as well.
It could be that as well.
Um, but I I think there'sthere's a lot of other concerns.
Um I don't mean derail, I knowyou have kind of a kind of a
line.
So go ahead.
We'll we'll get to my myconcerns before I start going
off.
SPEAKER_01 (09:27):
Yeah, no, we're good.
Um yeah, so let's let's justkind of like let's talk about
how phones actually do leakdata.
SPEAKER_02 (09:37):
Okay.
SPEAKER_01 (09:38):
So um I'm going to mention a couple things.
You just give me some ideas ofwhat you think about.
So app permissions, SDKs.
SPEAKER_02 (09:46):
Oh, yeah, yeah, tons.
Uh it depends on the SDK, right?
Um, and and that's that's morelike Android focused, but uh,
Apple has their own equivalence.
Um, so that's gonna be theactual application package that
you install.
So what can it access?
I mean, theoretically,everything if you let it.
Um, and so we've found likevulnerabilities in SDKs several
times where we could actuallylike route the phone or where we
(10:08):
could gain system level access.
And if you have that, you canpull anything on the phone.
So I'm not saying they are.
Are some of them almostcertainly?
There's been malware found onapp stores and things like that.
Yeah, like it's almost certainlyhappened.
Uh, and you get you know,permissions pop up so it says,
Do you want to trust this to docross-application tracking and
things like that?
(10:29):
And I mean, yeah, that's that'sjust as bad as it sounds.
Yeah.
Um, and I'm not sure thattelling it no will always
prevent it either, becausethere's still lots of other ways
that's gonna correlate thatdata.
So, yeah, an SDK or anapplication can have full access
to literally everything on yourphone, yeah, depending on what
it does.
SPEAKER_01 (10:46):
And I think that that also it's a great time for
a little bit of a um um justnote to throw out there, um,
just kind of public awareness.
You know, a very good reason whyyou should always make sure that
if you're downloading apps foryour phone, that it's through a
legitimate source, whether it'sthrough um Google Play or the
(11:06):
Apple store or um the Androidstore, um not downloading
applications through websites.
SPEAKER_02 (11:15):
Um Yeah, and especially in this industry, in
in the security industry,there's a lot of things that
they don't allow in the appstore, they don't put up there,
and and I'm not saying they'reall bad by any means.
Most of those, however, are opensource.
And at that point, you need tobe able to understand what
you're looking at and look at itto know if these things are good
or not.
Um, you need to know what you'redoing at that point.
(11:36):
So I'm not gonna say don't evergo sideload an app, don't ever
go get something offline.
Like it, it it can be extremelyuseful.
Um, but you need to really knowwhat you're doing and understand
the risk that you're puttingyourself in at that point.
SPEAKER_01 (11:50):
Right.
Yeah.
And I've seen this a lot oftimes too with apps where it's
like they're on the store andthen they're taken offline and
now they're being distributeddirectly through the original
creator.
And it there may not be anythingmalicious about that, but
there's that extra layer ofprotection, that extra layer of
another development team, anunbiased party going through it
(12:10):
and looking at it that nowyou're missing.
SPEAKER_02 (12:12):
So to an extent, uh, I think the biggest the biggest
safety is that you're actuallygetting it from the vendor.
So, like if um something that'shappened before is in Linux, if
they generally allow mirrors.
And so if you want to downloadthe operating system from a
mirror, anybody can go put up amirror and you load up the file
(12:33):
and it's whatever whateverfile.iso, you can download it,
install the operating system.
I could go download that IS ISO,I could modify it, and I could
put it up there, which is whyyou need to check hashes and
check your checksums and makesure that it's actually the file
that it says it is.
Right.
Um, so that can happen as well,where you need to make sure that
you're not downloading from somealternate source that actually
(12:55):
has modified things.
SPEAKER_01 (12:56):
Yeah, yeah.
Um, so next point so atpermissions SDKs, we talked
about that.
Um, ad tech ecosystem.
So your device, it broadcastsyour location, your device ID,
behavioral metadata.
SPEAKER_02 (13:12):
I mean, I.
Yeah.
Yeah.
Unique identifier for the phone.
Mm-hmm.
So, and then um whateveraccounts that you're in,
whatever that account is.
Those accounts have profiles.
So, like if you're on socialmedia, all of your accounts have
profiles where it's like youralgorithm is tuned to you, and
you can see like this person isa uh uh liberal democrat who
(13:34):
likes um these types of arts andthey like this type of music.
And like this is all part ofyour algorithm.
That's how it knows to serve itto you.
And the ad tech has access tothis data as well.
That's how they know who to giveads to.
They generally do this in theback end, but you can still
request data on some platforms.
SPEAKER_01 (13:52):
Yep, yep.
And the third thing that I'llmention as, you know, a way that
our phones do leak data isthrough data brokers.
So, you know, they aggregate,they sell the info downstream,
and that data is eventually umaccessed by uh marketers,
private companies, sometimeseven the government.
SPEAKER_02 (14:11):
Yeah, that law enforcement.
Yep.
Yeah, that's that's uh that's abig part of uh of the concerns
that people should have.
Yeah.
Um which we can go into if youwant.
Uh yes.
The so you historically have tohave a warrant in order to pull
data from a cell carrier.
If you want to get a warrant andsubpoena a cell carrier and you
(14:34):
want to say, hey, I needlocation data of where this
number was, we needtriangulation data, we need to
know exactly where this wasduring this time frame because a
murder happened or somethinglike that.
And we deal with this prettyoften.
But what a lot of the lawenforcement is now doing, like,
we know that there's I've got alist I can pull up of people
that we've confirmed as clientsof this particular instance.
(14:56):
Um, they are not having to getwarrants because they can just
go buy this data that's readilyfor sale and they know exactly
where you've been.
They know uh where what yourlocation was, they know if it
was a religious institution,they know if you've been to a
protest, they know if you'vebeen to a shooting range, they
know if you've been to uh umwhat your friend's house is, if
(15:16):
you know if you're involved in arelationship, you know, you're
where you work, they know umwhat stores you go to, they know
that you went to a cardealership a couple of times,
like it's the they really canget granular detailed on that,
and they can they can dig inextremely easy because it's a
location pattern of everywhereyou've been.
SPEAKER_01 (15:36):
Yeah.
So let me ask you this is buyingdata fundamentally different
from surveillance?
SPEAKER_02 (15:43):
Uh data is simply data, the usage is what defines
what it is, I guess.
So um I would say no, but itreally just depends on what the
intentions are.
SPEAKER_01 (16:02):
Yeah.
SPEAKER_02 (16:05):
But I don't necessarily think that an
advertising company uhsurveilling you makes it any
better than the governmentsurveilling you.
SPEAKER_01 (16:13):
Right.
Yeah.
So each has their own goal.
So so leading into that point,maybe a hot topic of contention,
maybe we use this for the uhpreview to get more listens.
I don't know.
Or maybe we don't, so we the wethis doesn't come out, but a lot
of people talk about like, oh,we're being tracked, you know,
(16:33):
our messages are being listenedto, our phone calls are being
listened to.
How realistic is that?
SPEAKER_02 (16:40):
I mean, pretty realistic, but I think people uh
don't understand a lot of themechanisms through it through
what it happens.
Um there are some sources whichare absolutely public, being
scraped, being monitored, thingslike that.
If I just call you directly, issomebody listening to that phone
call?
Likely not.
Um, unless you have some sort ofa really targeted surveillance
(17:03):
against you, that you've gotmalware or you've got a wiretap
federally or something likethat, which there are a lot of
federal wiretaps.
Like that happens on anextremely large scale.
So that's a different storyentirely.
But I think that the most likelything is that you're more
predictable than you think.
Because you we know that you arethis person who's done these
(17:25):
things and has these interestsand has this political
affiliation.
They probably know yourpolitical affiliation better
than you do.
Um, we know that he interactswith these people who think
these things and have theseinterests, and they usually go
to these places, but sometimesthey go to these places, and
there they usually do thesethings and they search these
things.
And last night at two in themorning, whenever he couldn't
(17:45):
sleep, he was looking up thisone thing, and that is usually
looked up by people who do XYZ.
Like it's the data that you canget through the mass data
correlation is uh probably justas good, uh, if not even better.
It's kind of like um there's onestory I I like to tell.
There was a uh lady who uh waspregnant and she was buying
(18:10):
things through Target, and sheused to get these mailers from
Target.
Um, and this was years ago, soit's gotten much better.
But she um didn't know she waspregnant, and so she would get
these mailers, and so she wentto Target and she was buying
things and she was checking heraccount and she was buying like
pickles and these random thingsthat typically happen as
(18:32):
cravings in the early stages ofpregnancy.
Yeah, and they startedadvertising after that.
They started prenatal vitaminsand diapers and all these kind
of things, and she was like, youknow, this is really weird.
Why am I getting theseadvertisements?
Took a pregnancy test, she waspregnant.
SPEAKER_01 (18:48):
That's wild.
SPEAKER_02 (18:48):
Target knew that she was pregnant before she did.
SPEAKER_01 (18:50):
That's wild.
SPEAKER_02 (18:51):
So the data correlation can be extremely
strong.
Oh, yeah, yeah.
And that's just talking aboutrandom cravings.
SPEAKER_01 (18:57):
Like, yeah, yeah, we talk about human behavior and
and everyone is unique to anextent.
It's like when we look at from amarketing aspect, um, we look at
basically creating buckets.
So if we're creating likepersonas um to advertise to, um,
you know, it it might be five toeight different personas.
(19:21):
There could be like five toeight different buckets that
everyone kind of falls into, andwe don't check all the boxes
necessarily, but to an extent,yeah, it's like we up we're very
predictable.
Um, yeah.
SPEAKER_02 (19:35):
So I think that one thing that's really interesting
talking about the malware andlike going going towards
security is we we always want totalk about make sure you patch
your devices, make sure you havemulti-factor, watch out for
phishing, these things, whichare like, yeah, that's good.
These are these are extremelygood things.
But what I would be curiousabout is is an ad blocker just
(19:59):
as much as a privacy feature?
SPEAKER_01 (20:01):
You know, I I think this gives people a false sense
of security because you'reright, people do focus on
antivirus, um, but they reallydo ignore data exposure.
SPEAKER_02 (20:10):
Yeah, maybe you need to be turning off location data
and you need to be using a piehole on your home network, and
you actually need to be reallyhammering down on on you know
fighting advertisements.
Yeah.
SPEAKER_01 (20:23):
Well, and also like on the phone, so this is slight
tangent sideways, but just incase anyone else didn't know
this either.
Um, you've talked before about,hey, you know, the Apple
iPhone's pretty strong out ofthe box.
You know, if you're in public,if you're wanting to make sure
that you're being safe, um, turnoff Wi-Fi, turn off Bluetooth.
(20:44):
And that's basically it, right?
SPEAKER_02 (20:47):
Um, yeah, I generally think you're fine to
leave them on too.
It depends on what you mean,right?
So we're not talking about beinghacked in malware and things
like that.
I think that that's generallyfine.
The most you're gonna get issomething annoying.
Yeah, if anybody has a zero daywhere it by you having Bluetooth
enabled on your phone, they canhack your phone.
(21:08):
They're probably going to takethe$1.2 million from Apple that
they get as a bug bounty fromthat.
Right.
They're probably not going tohack some random person at a
coffee shop with it.
SPEAKER_01 (21:17):
Oh, right.
Yeah, yeah.
And I think that's the thing.
People are like, oh, I'm beingtargeted, you know.
SPEAKER_02 (21:21):
I think that you you're generally fine with
things like that.
Yeah.
Um, but could there be uh largecompanies like maybe Starbucks
going with coffee shops?
Maybe they keep track ofeverybody who joins the SSID.
I don't know, but I would if Iwas them.
Yeah.
I mean, I think that there'sthere's a lot of there's a lot
of things like that for privacywhy you might want to do it.
(21:43):
And I think for the security ofyour phone, generally you're
fine to leave stuff enabled.
I think that you are generallyfine.
Uh the biggest thing is notinstalling random crap on your
phone and not uh accepting, youknow, messages and random stuff
from people.
Where you end up clicking onlinks maliciously and all that
sort of stuff.
SPEAKER_01 (22:04):
Right.
Yeah.
The point I was kind of gettingto was the fact that I had
thought that if you flick downthe menu and turn off Bluetooth,
Bluetooth is off.
It doesn't.
And it's not.
It's like a lot of people thinkthat.
They think that if you justflick it down, turn off
Bluetooth, Bluetooth is turnedoff.
You start BLE spamming me out.
It's like I've got Bluetoothturned off.
(22:24):
You're like, you don't.
And it's like, oh no.
You have to actually go into theBluetooth and the settings, turn
it off.
It's it's not as easy as justflick that just disconnects your
devices.
Right.
Yeah.
So okay, so we have this falsesense of security because people
are focusing on antivirus,they're ignoring data exposure.
Um, this brings about anexpansion of the attack surface.
(22:47):
So data can be weaponized, um,social engineering, physical
targeting, stalking, doxing.
Yeah.
SPEAKER_02 (22:54):
Yeah.
No, you're yeah, you're you'reabsolutely right.
I mean, um, if you have accessto buy uh, you know, this level
of of advertisement data, doxingpeople's probably pretty
insignificant.
I mean, uh, I think the thebiggest thing is that they're
keeping their customer list toit's not necessarily bad people
you want to to have it, butthey're they're not giving it
(23:17):
out to everybody at this point.
We we've can or Citizen Labconfirmed ICE is using it, US t
US military organizations, uhTexas DPS, a bunch of local
police departments, a bunch ofdistrict attorneys, um, some
other uh countries, uh ElSalvador National Police,
Hungarian intelligence services,I'm sure most of our
(23:39):
intelligence services, why wouldthey not?
Um So I I think the biggestthing is preventing them from
being a huge issue whenever itdoes come to stalking and that
sort of stuff is um is gonna bethe fact that the data's a
little bit exclusive right now.
Now, how long until that getsout, I don't know.
SPEAKER_01 (23:58):
Right.
Well, and what's to stop thisfrom becoming part of a
ransomware attack and now thatdata is all out there.
Exactly.
Exactly.
Yeah.
So let's talk about all right,let's talk about actions that we
could take.
So practical defense.
Um, what are some like highimpact steps and things that you
(24:18):
can do?
SPEAKER_02 (24:19):
Um actually, oh I gotta I gotta lead into that
kind of thing.
Okay, all right.
So um why what I'll say I wantto tell you what I think about
this as a red teamer.
So if I can get location, can Iverify an employee's identity
before I do a social engineeringattack?
(24:40):
If I can get their identity, canthen I get other people's can I
target an executive?
Can can I figure out thingsabout that executive that would
assist me in the socialengineering?
Um, can I find patterns in thethings that they do to set up an
attack easier?
Hey, this person always goes tothis coffee shop.
I'm gonna sit up there with aWi-Fi pineapple.
(25:01):
Um, can I find travel patterns?
Every third Tuesday they flyhere or something like that, and
I can try to, you know, sourcemy attacks out at that point.
Um if they are at a data centeror something like that, you
know, it's looking at IT peopleor they go to this data center
sometime.
(25:21):
I bet you they have stuff there.
You can know where to target.
Yeah.
SPEAKER_01 (25:25):
Um it's it's any any gathering OSINT by following
someone around.
SPEAKER_02 (25:30):
And a lot of large organizations have covert
facilities too, right?
Where it's it's this is whatthey they don't want everybody
to know, their infrastructureshere.
It could easily reveal allthose.
Yeah.
So as far as a a business level,there's massive concern from
from employees that are justhaving their phones doing normal
(25:52):
stuff.
SPEAKER_01 (25:53):
Yeah.
It's wild.
SPEAKER_02 (25:55):
So how do you protect against that?
SPEAKER_01 (25:56):
Yeah, so how do you protect against that?
Well, first thing I'll throw onis you know, disable ad
tracking, which I would hate,honestly, as a marketer, but you
know, let's be real, if youwanna um start um ways to
disable this, yeah, ad tracking,reset your advertising ID.
(26:19):
Um and this is something thatI've actually done a lot of too,
just because I hate the way myphone battery drains all the
time, but limiting locationaccess.
You know, don't have it whereyou you you don't need Spotify
to know where your location isat all times, you know.
There's apps that doesn't thatdon't need to know where you
(26:41):
are.
So if you have an app that doesrequire um location tracking,
um, you know, set it to likewhile using or something similar
to that.
So yeah.
Um probably good securityhygiene to just remove unused
apps as well.
Um prefer privacy-focused apps.
(27:02):
Um, and then you know, avoidingunnecessary permissions.
So whether that's like, youknow, Bluetooth permissions.
I mean, how many times do yousee now like I will go to open
up an app and I don't know why,but it's like, hey, do you want
me to find Bluetooth devices inyour area?
And it's wild when you're doingit at home because then you're
seeing like a map that's showinglike all the Bluetooth devices
(27:26):
of your neighbors and everyonewithin a radius um with the
names of those devices.
And so, yeah, contacts, um, youknow, et cetera, just you know,
permissions.
Yeah.
So um, what are some otherthings that you would suggest?
SPEAKER_02 (27:42):
Um, looking into something like a pie hole for
your home network, it's going tofilter out all of your
advertisements.
Um, there are some services thatcan feed fake data.
Uh there some of those arepretty fun.
Um, or you can like there'sthere's one is a browser plugin
where periodically you can say,like, hey, reset my advertising
profile, and it'll spend thenext 20 minutes just searching a
(28:06):
ton of things you would neversearch and going to a bunch of
websites you would never go.
You can go as far as spoofingGPS data to like really mess
with stuff.
Um, but I think the the mostpractical thing for people to do
is looking at ad blockers,looking at something like a pie
hole for your home network.
Um, this is actually I typicallydon't recommend VPNs, but
whenever it comes through like aprivacy sort of deal, really,
(28:28):
that's possible.
But at the same time, now all ofyour data lies with the VPN
provider, so you have to hopethat they're good.
SPEAKER_01 (28:34):
True, probably the same with like DNS filtering
too.
SPEAKER_02 (28:37):
Yes, yeah, sure.
Yeah, and a lot of the timesthose are one and the same.
SPEAKER_01 (28:40):
Yeah.
SPEAKER_02 (28:41):
Um, but the at that point also it could be like,
okay, we know that they're acustomer of Molad VPN.
Like, you know, I mean, becausethey know what those IPs are,
they know so so that might be adouble-edged sword, but
personally I do use one on mymobile phone, and I make sure I
have it has blockingadvertisements features on it
(29:02):
and and things like that.
Um, and you can get super crazywith it.
Really, I mean, use lockdownsystems that you know don't have
anything in them.
You know, you can go as far asI'm gonna use an Orange Pie
because it doesn't use any chipsthat have backdoors in it, and
I'm not gonna have anaccelerometer in this machine,
and I'm gonna do all these thesethings to make sure it's super
(29:23):
bare bones and only I have this,and I'm gonna use Linux that
doesn't have any kind of atracker in it, and uh like you
can really get get hardcore withit.
You can get hardcore.
But it just depends on how muchuh practicality you're willing
to put into it versus you knowwhat's what's what's tracking
you.
SPEAKER_01 (29:39):
Right.
And I'd I'd say, and I don'tknow, you can be your thoughts
on this too, but I don't think Idon't think you can fully opt
out, but you can take steps toreduce your signal.
Yeah, for sure.
Yeah, for sure.
All right, let's do it, let's doa little something fun here.
We're gonna do um a lightninground here because getting back
to the topic hacked versustracked.
(30:00):
So we're talking about a lot ofinstances where people are like,
oh, I've been hacked because youknow people are uh you know
promoting products to me andthey're ah, they're in my head,
they're in my phone, theythey're listening through the
devices.
Um, but okay, so no.
So malware infections, hacked,not tracked.
(30:20):
Sure.
So yeah, efficient compromise.
Generally hacked.
Yeah, not tracked.
Yeah.
App collection, um, collectinglocation.
So also not hacked.
SPEAKER_02 (30:33):
It could be either, but most much, much more likely
it's just it's just ad data.
SPEAKER_01 (30:39):
Yeah, ads following you.
Yeah, yeah, that's tracked,yeah.
Um, data broker profiles also,yeah, not hacked, but tracked.
And there you go.
Nation state spyware.
Probably hacked.
There's not much you can doabout that.
Yeah.
So um this might be a functionbug for you up.
(31:00):
Yeah.
Yeah.
Yeah.
Um get an unplugged phone.
Um, yeah, um, personally checkedby alias cybersecurity.
Yep.
So um, yeah, so the the nationstate spyware.
I think that's I I think one ofthe things that kind of sticks
out to me is people are like,oh, they're listening.
You know, like, for instance,there's all these protests that
(31:21):
happen, and regardless of whatside you're on, the protests,
there are probably people therethat are, you know, analyzing
things and keeping an eye onthings and trying to see what's
going on.
And so um, you were telling me alittle bit about the stingray.
Yeah.
Um, but that's not like a itdoesn't work like in the movies
(31:43):
where it's like, oh, in realtime, they're capturing all this
data and they know exactly whatyou're saying, right?
SPEAKER_02 (31:49):
Yeah, yeah.
Yes and no.
Like, I mean, anything that'shappening through like a level
of of encapsulation andencryption is going to be harder
for them to see, but they candefinitely get especially like
SMS messages that aren't like aniMessage or like a signal or
something like that.
Right.
Um, so they have a have a devicecalled a Stingray, which is
basically a rogue cell tower.
Uh, and so they're they canbring this out to events like a
(32:11):
protest and they can say, okay,they have they can do like
what's called like a downgradeattack, where it's much easier
to do this on 4G than 5G.
5G has a lot of protections.
But if your phone doesn't have5G, it will it will negotiate
down to 4G, it will negotiatedown to 3G still.
So you can go down down untilthere are really vulnerable
(32:31):
protocols that they can use.
And so this is typically whatthey like to do.
Um, there's that's just one ofthe several attacks.
There's many attacks they can doto try to get you to link onto
the Stingray instead of theactual cell tower.
And you're going through theirs.
It's just like a Wi-Fi.
It's just like a Wi-Fipineapple, but but through that.
Um yeah, there's a device thatyou can you can set up called
(32:53):
the uh the ray hunter.
You can build it with uh with anLTE hotspot, and you can flash
your firmware onto it.
They support a bunch ofdifferent hotspots now, and it
you can take it to places andjust run it, and it'll look for
those patterns of attacks in theair.
Uh and you can you can run apacket capture and you can
analyze everything.
It'll start, it'll do it livetoo, where it'll like pop up and
(33:15):
say, like, you know, likeflashing red bar, like, yo,
there's a stingray, this deviceis is seeing attacks happening
on the air.
Um, so that's really fun to playwith.
SPEAKER_01 (33:27):
If if it identifies it, it's it's yeah, you know
it's within range.
Yeah, yeah.
SPEAKER_02 (33:31):
Yeah.
But yeah, yeah, if it yeah, ifit identifies it, it's
essentially too late.
SPEAKER_01 (33:36):
Yeah, yeah.
So all right.
So, you know, closing thoughts.
So, I mean, we've pretty muchwe've built I had a I had a
question.
SPEAKER_02 (33:44):
I had a question to ask you before we did closing
thoughts.
I don't know if you can tell meabout it or not, but are you
familiar with RTB or real-timebidding?
Real-time betting for ad for addata?
SPEAKER_01 (33:52):
I've I've heard about it, but I've I've not
looked into it now.
SPEAKER_02 (33:57):
Um, I don't know a ton about it.
We'll have to talk about itanother time.
But yeah, I guess there'sadvertising bidding on live ads.
So like it goes as much as um,hey, I'll bid this much to
advertise this to people whosearch this.
And so like there might be fivepeople who have bid on it, and
(34:18):
if you meet their profile enoughand they've bid enough, they'll
get their ad served to you.
So, like, if you meet a profileof like, say I have searched
these things and now I'msearching wedding rings or
something like that, there'slike five different advertisers
who are bidding to send their adto you because it's much more
likely a payoff.
Something like that.
SPEAKER_01 (34:36):
Yeah, yeah.
SPEAKER_02 (34:37):
Kind of like with Google AdWords.
Yeah, I don't know.
Apparently, this is happening ona large scale.
Citizen Lab was talking aboutit, but they didn't go into it
super deep.
SPEAKER_01 (34:44):
Hmm.
Okay.
We need to look into that forthe next time.
All right, all right.
Next podcast, real-time bidding.
Real time bidding, yeah.
Um, yeah.
So, I mean, we pretty much we'veit's we can't we can't really go
back.
We've kind of built this worldwhere surveillance doesn't
really require hacking, it'sjust access to the right data
feeds.
Um, so what what do you think ismore dangerous?
(35:08):
Illegal hacking or illegaltracking at scale?
SPEAKER_02 (35:12):
Well, it's not illegal.
Huh?
It's not illegal.
SPEAKER_01 (35:16):
Oh, I said legal.
Oh, legal, yeah, or legal.
SPEAKER_02 (35:19):
Yeah.
Um, I think an illegal hack willprobably be much more damaging
whenever it does happen.
But I think that for 99% ofpeople who are constantly being,
you know, tracked by ad stuff,they're more impacted than the
0.1% of people who are beinghacked.
(35:40):
So I think if you're unluckyenough to fall into the line of
the line of, hey, I'm actuallygetting hacked in a in a bad
way, um, that's probably goingto be worse for you than the
tracking.
But I think the tracking isinterfering with our lives in
ways that people have no ideaof.
SPEAKER_01 (35:54):
Oh, yeah.
No, we're happy to have thetools and the technology in our
hands, and we don't understandhow much we're actually giving
away with that.
So um, yeah, I'd say that, youknow, data tracking is making
people a lot more vulnerable.
SPEAKER_02 (36:10):
Yeah.
So especially whenever you tieit into, you know, the the flock
ecosystem and all the the camerastuff that's happening lately.
SPEAKER_01 (36:17):
Yeah, I was actually going to bring that up because
that's kind of like I I've thatthat's that's been happening
here in Oklahoma a lot.
And you actually were on thenews doing a segment about it
sometime last year.
Yeah.
And uh it's it's come up againthe news in the last couple of
weeks, and people were likecomplaining about it because
they're like, oh, I don't wantthese cameras tracking us
everywhere.
And that's funny because you seepeople like also respond, you
(36:39):
know, you have a camera in yourpocket that tracks you
everywhere you go.
It's not the same.
Yeah.
SPEAKER_02 (36:44):
It's not the same, though.
Yeah.
No, the the level of of datathat those are capturing is
absurd.
I mean, it's it's ridiculous thenetwork that they've developed.
Yeah.
You won't go into a little bitmore.
SPEAKER_01 (36:56):
This is another misconception network.
SPEAKER_02 (36:58):
It could be a whole nother a whole nother episode,
but but yeah, I mean they sothey're called ALPRs, automatic
license plate readers.
Most of the cameras that yousee, it's little, it's basically
got it looks like a littlewebcam on a solar panel that's
on a post, and they're kind ofstanding alone, and they usually
don't meet any of the standardsthat they need to for road signs
to meet, by the way.
Interesting, but I guess youknow that nobody cares about
(37:21):
that.
Um because they're supposed tohave safety protocols like
breaking away and they don't,but I digress.
Um, they they are able tomonitor everything that they can
see.
So they have profiles onindividuals walking, biking,
things like that for vehicles,which is obviously the main
(37:41):
thing.
It's not just license plate,they keep a profile of vehicles.
So if you don't have a licenseplate, they can still identify
that vehicle, they can stillgive it a profile.
Hey, this is um this is a 2012Corolla that has a dent on the
back left bumper and it has asticker here.
We know that this is a uniquelyindividual car.
We know who this is, we know whodrives it, we know where they
(38:03):
go, we know exactly what theirpatterns are every single day.
We know the one-offs that theydo because they have enough
camera for this, and they knowexactly where you were seen at
most recently, which is um, youknow, probably yeah.
But then the data, the the dataof the people who have access to
that.
I mean, a lot more people haveaccess to the flock data.
(38:23):
Tons and tons of people haveaccess to the flock data.
And we've seen um also ringcameras are feeding into flock
and all kinds of things now arefleeting, feeding in these
networks.
Not even to mention likePalantir and the larger nation
networks.
This is more of a smaller scale,but they've had we could we
could really go into this.
Uh, where they've hadindividuals who are doing creepy
(38:45):
stuff.
I mean, they've had people whoare um they had one, I think it
was an executive who got caughtlooking at like a bunch of like
children's gymnastics camerasand like all kinds of like
creepy stuff.
They've had like 37 instances ofofficers that are committing
stalking against like theirex-girlfriends and stuff like
(39:05):
that.
I mean, it's far worse.
Maybe not worse.
It's far worse on a smallerscale, but it's still a giant
scale.
SPEAKER_01 (39:14):
Gosh.
SPEAKER_02 (39:15):
So that's a whole we could we could talk all day
about flock.
SPEAKER_01 (39:18):
Oh, yeah, yeah.
And on the ring cameraspecifically, as I know we've
worked, I've helped out ondigital forensics cases where
you know we're looking at ringcamera footage to see something
that happened 500 yards down thestreet, you know.
SPEAKER_02 (39:31):
Yeah, and I won't I won't stick my head in the sand
and say like it doesn't ithasn't ever helped solve a crime
or something like that.
Like there's been valid uses ofit, but uh I it's it's a privacy
privacy versus safety sort ofdeal.
SPEAKER_01 (39:46):
Um and that's it's it's weaponized.
It's like in the hands of thewrong person, it can be very
detrimental.
SPEAKER_02 (39:52):
Who is it?
Benjamin Franklin that had theprivacy quote.
So those who value priv thosewho value uh safety above
privacy devo deserve neither.
Something like that.
I probably have that wrong, butyeah, I think that's all right.
SPEAKER_01 (40:05):
Abraham Lincoln said something about everything you
see on the internet being true.
Yeah, yeah.
Yeah, I don't know.
But yeah, so you've kind of wentinto this a little bit, but
yeah, just maybe a final word onlike, you know, going back to
using like the data brokerintel, like from a red team
expect uh from a red teamperspective, how do you see
attackers using that data?
SPEAKER_02 (40:25):
Yeah, kind of like what I was I was mentioning
earlier, where I I I would useit to identify an individual,
um, how I need to target tosocial engineer that individual.
A lot of the times I'll try tofind whenever somebody's gonna
not be there.
I'll try to like schedule acalendar invite with somebody.
And whenever they say, Oh, Ican't do that, I have I have
something here.
I'll try as like a fraudulentperson, right?
(40:46):
Like, hey, I'm part of thissales thing that you want, and
I'm gonna hook you up.
And can you do a meeting thistime?
And I'll just try to find a timethat they're not there, and like
that's when I know I can gobreak in and like say, Oh, I'm
here to see so-and-so.
Who I've already done all myresearch on that becomes a lot
easier, yeah.
So you can get data like that,um, find out the locations of
(41:07):
assets, you can find out um whatthey're into, or if you can
build a profile on somebody tospearfish them, which I've
talked before about some of thespearfishing campaigns that
we've done where we've reallygone all in developing, yeah.
SPEAKER_01 (41:20):
Well, I think, I think, and I don't know, this is
oof.
Kind of going off of that, youcan spearfish, you can find like
executives by you can figure outtheir families' patterns too,
yeah, yeah, based off of stuffthat they're looking up.
Like if they're looking up um,you know, vacation information
or like if they're looking atlike toys or I answered you as a
(41:42):
red teamer also.
SPEAKER_02 (41:44):
Um, yeah, had I been uh a real POS attacker, I might
even target the family.
SPEAKER_01 (41:51):
Yeah.
SPEAKER_02 (41:52):
And I might try to be hesitant to bring that up.
I might try to hack I might tryto go through Roblox via the
child to hack the familycomputer.
I might get an info stealer onthat family computer and see if
they've ever logged into theiremail on it.
Um yeah, I I would you could doa lot.
SPEAKER_01 (42:08):
Yeah.
It's it's a scary world.
But um, yeah, so the kind ofgoing back in the closing, you
know, I mean, this is this isjust the world we live in.
So tracking is way more commonand it's more normalized than
hacking is.
Um, you know, your phone isn'tspying on you, it's
(42:30):
participating in themarketplace.
So um just exercise, you know,safety and kind of going back
to, you know, again, thosebullet points of things that you
can do um to um, you know, tryto mitigate this a little bit,
you know, um, you know, disableyour ad tracking, you know,
(42:51):
limit your location access, um,remove your unused apps.
And this is good hygiene foryour phone anyway.
So, because it saves hard drivespace, it saves battery power.
Um, definitely preferprivacy-focused apps and uh
avoid unnecessary permissions.
Um, if you get pop-ups poppingup on your phone to like give
access to something, don't justlike blindly click it without
(43:13):
reading.
Look and see what it actually isdoing.
And you might want to sacrificea little bit of convenience for
your privacy.
Absolutely.
We're gonna end it on that notebecause I can't think of a
better line.
So thank you everyone forlistening.
Um, we'll catch you next time.
Thank you.
SPEAKER_00 (43:33):
The Secure AF Podcast is a production of Alias
Cybersecurity.
Visit us online ataliascybersecurity.com.
All rights reserved.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Joe Rogan Experience
The official podcast of comedian Joe Rogan.