Press "Enter" to skip to content

Privacy, Is There Really Such a Thing | Will Bengston | TEDxElPaso


privacy is there really such a thing
wouldn’t set the tone a little bit with
this image paradise it’s a picture of a
beach in Costa Rica I took it last year
it’s a beach called Ave Yanis backed by
a bar called Lola’s named after a pig
bigger than myself
right very private we took this picture
after we spent a day surfing I know what
you’re thinking a Texas man or boy out
surfing you’re lucky my slides had to be
due last week before I went to Costa
Rica or this would have turned into a
slide deck of how I learned to surf
sitting on a beach in a remote location
in a country like Costa Rica you feel
private right there were a group of 20
of us there were a couple locals there
but we were by ourselves we’d been
surfing all afternoon we decided to sit
at the bar have a couple drinks and
watch the sunset really a secluded
private area but what if I told you that
on my way to Costa Rica this year I
started in San Francisco where I’m based
I flew to Costa Rica and now I’m here in
El Paso in my hometown and during this
entire trip what if I mentioned to you
that you could track me the entire way
think about that as I go through these
next couple slides and think of you know
does this make sense can this really
happen so I’m moving soon I’m here
because I love security I love security
so much that as a little boy dreaming to
be a hacker and going to work for the
NSA I grew up and now I’ve in Silicon
Valley working for a big company such as
Netflix right I took security from a
thought a dream to a hobby to my life
and I’m hoping to spread that and a
little bit to you today hopefully at a
high enough level that you don’t just
glaze over if not stare at the pretty
lights keep you interested I’m also here
because I actually teach at UTEP you
know I love the community I love
security so much that I want to spread
the word and that’s what I hope to do
today so at UTEP I actually teach an
undergraduate and grad
course on wireless technologies and so
that’s why I wanted to bring some of
that topic here to you today and kind of
open your eyes to what you were opening
yourselves or what we are all sending
about as we walk around from day to day
or in my case San Francisco Costa Rica
to here and if you were tracking me you
could tell I made a couple stops in
between but most of all I’m so
privileged and honored to be here
because I’m from El Paso I’m born and
raised and even though I’ve left El Paso
I remember where I’ve come from and as I
meet people as I come through my career
and connect with other members of the
system you know the community from El
Paso such as miguel camino who is now
the CTO of New York City it really makes
me proud to go represent El Paso outside
of the city so before we actually get
into the heart of the topic I want to
show you a quote that I kind of lived my
life by and for those of you that went
to high school with me and might have
come over to my house this was actually
on my rim my mom actually cut this in
vinyl and pasted it on the wall wrapping
around two walls but nothing is to be
feared it is only to be understood and
that’s how I’ve approached my career all
the security thinks I come across and
how I want you to approach what I
present to you today so a couple
examples of some security in the world
that you might be familiar with is
anyone aware of AccuWeather
show hands alright a couple of you does
ooh want to use the AccuWeather app on
your iPhone Android a couple of you
should delete it say no I’m just I think
they fix it
but the AccuWeather app actually was
sending your user location data to its
ad networks and other back-end systems
even though you told it not to it’s kind
of frightening to think you’re trusting
these apps as you download them you’re
giving them your information you’re
agreeing to things and yet they’re
violating that trust they’re violating
your privacy and they’re seeing that
data elsewhere you know before I got to
Netflix I used to consult companies
would hire me my dream of being a hacker
became a realization and I used to hack
companies and break in Jason Bourne
style
for money without getting in trouble
it’s kind of cool I stopped actually
looking at the applications on my phone
because I stopped using them every
application I looked at I got scared
I saw something I didn’t like and I
deleted it so I blindly trust things
nowadays but it’s important to
understand what kind of information
you’re agreeing to or what kind of
permissions these applications are
actually asking for is anyone yuzu
beurre it live in the city the first
year and a half I did not have a vehicle
I either walked miles to where I needed
to go I took over a lyft uber has been
in the news a lot lately with privacy
you know bad culture but most
importantly the Justice Department is
actually investigating uber right now
for tracking lyft drivers you know a
competitive advantage where are the lyft
drivers compared to my drivers what are
our passengers doing when the uber
updated their app recently they were
asking for permission to track your
location in the background even when you
weren’t using the application it’s a lot
of powerful data but what are you know
is it important that uber has that
information do you care that they know
where you live or you spend most of your
time things to think about and just
recently Equifax you know this one
really hits home to me and kind of the
preface for this talk is in most cases
people that are affected by this Equifax
breach did not give their information to
Equifax at all their information was
provided to them by third parties and so
it’s really kind of a breach of trust
and privacy but you know nothing be
feared it’s only to be understood and
let’s get going
so the picture of Costa Rica privacy
right it’s actually a picture of me and
my buddy Kevin view from my drone I
bought to take to Costa Rica with me
tracking our face face aware technology
so you could actually launch the drone
release it in the air and have it track
you and so in Costa Rica this Tama is
actually tracking and taking footage of
some of my friends surfing and some of
the instructors and after when they’ve
come in on the beach I’d show him on my
laptop some of the footage I got and
they had no idea that I was tracking
them never saw the drone didn’t see
anything but yet I was watching him kind
of creepy so let me show you a number
369 million five hundred ninety eight
thousand five hundred and thirty-one can
anyone guess what this number actually
means and no it’s not the amount of data
from the Equifax breach this is actually
outdated this is a number has increased
in just a week and a half since I pulled
the number but this is the number of
wireless hotspots that are known and
data based by a company called wiggle
this might look like an eye chart which
it is this is actually a Google map
image of the plaza centered around the
plaza theater and each of these black
blobs of data is an actual Wi-Fi hotspot
name
people use the technique called
wardriving where they take something
similar to what I’m wearing on my neck
and they drive around town with GPS and
they just start listening to wireless
signals capturing what wireless hotspots
are around digital pass o-h honors you
know security nightmare my home Wi-Fi
this information is being logged and
uploaded to a database right so what can
you do this information if I was to send
this information to you would you know
what to do with it did you know that as
you’re walking around you’re actually
publicly broadcasting what you were
trying to connect to what you’ve
connected to in the past it’s really
powerful if I know that for instance my
mother in the crowd is trying to connect
to H honors I can tell that she’s been
to a Hilton somewhere she’s connect to
their wireless and no she’s no longer
there obviously but there’s a lot of
things that bad people can do or someone
that wants to just track you can use
this information and use it to their
advantage see this screen it is a bunch
of wireless data it has a bunch of MAC
addresses which a MAC address is
essentially a hardware address consider
it your home address for your house but
your home address for your phone for
your watch for your Fitbit you know for
any sort of wireless device that you
actually have connected to you with a
device like something I’m wearing around
my neck I can view all the data being
sent in the wireless medium you might
think Oh
how how are you doing that will or Alice
it’s it’s not hardwired right it’s
susceptible to interference to injection
does it everyone have a cell phone out
in the crowd you can trust me I promise
take your cell phone out and pull up
your your Wi-Fi settings I’ll do it
myself
pull up your settings page open your
Wi-Fi if it’s not on turn it on please
and tell me if you see a igoogle heart
eye emoji TEDx El Paso SSID show of
hands anyone right does anyone try to
connect to that today no good because
that’s actually what’s around my neck I
am injecting a signal and just saying
that this network exists it’s not an
actual router it’s not a hotspot but
it’s something that I’m just telling you
that’s there and these lights that are
blinking around my neck you can see how
often they’re changing every time this
is changing is one of your cell phones
reaching out for previously known
network and trying to connect to it and
I’m actually receiving that data and
listening to it so I can see if you’ve
been to Hilton Honors if you’ve
connected digital El Paso I can tell
what your home Wi-Fi is and with that
wiggle net I can go look up and see
where that Wi-Fi location actually
exists and kind of see my locate where
you are kind of scary right
but don’t worry nothing’s to be fear
only be understood kind of anyway really
interesting and you can see as everyone
pulls their phone out in turn the Wi-Fi
on this thing is going crazy it’s a lot
of data a lot of fun but you know it’s
it’s just kind of the cost of doing
business one of the cool things that you
can do I’ll tell you later is how to
actually protect yourself against that
but just know that anything that we are
wearing today is IOT you know our smart
homes the devices that we were a
wearable technology you know I’ve got a
Garmin watch they track my heartrate
send help data across it’s all being
connected and anyone in the crowd is
listening to it potentially if you want
to know more you can come take my
youtube course switching gears
stiffing Wi-Fi is easy this cost me
about $35 to make I bought a Wi-Fi
device I put it in monitor mode and bang
got all your data profit right data is
money any big data people out in the
crowd it’s a big topic these days a
couple right so yeah with all this data
I’ve got things I’ve I know what you’ve
been doing where you’ve been going it
potentially dangerous information if I
was someone trying to locate you but not
only Wi-Fi Bluetooth is also a target so
as anyone familiar with that Verizon
commercial can you hear me now good
right a very popular headphone brand
company not to mention any names had a
set of headphones that when you would
actually pair them with your phone it
would ask for you would you like to
install their companion app does anyone
have that happened before show Vance
pair your Bluetooth device an athlete
installed the app didn’t want to install
the app couple of you did so some
security researchers one of the things I
love about security is things change
constantly right wake up one day I go to
bed secure the next day my informations
been breached
so this popular headphone manufacturing
company had security researcher found
that the permissions that this app was
asking for actually allowed them to
record your conversations that you were
having over the Bluetooth connection and
what you’re actually doing that’s
amazing that as you pair your device
with your headphones it’s asking you to
download this app and use it you know
take full advantage of the technology
that you’re trying to use but you know
is that a violation of trust is that
does that violate your privacy yeah it’s
kind of interesting but Bluetooth is
very similar to Wi-Fi or wireless in
that as your device is on
you’re constantly sending out
information there’s something called
Blee or Bluetooth Low Energy and that’s
what’s essentially happening every day
if you can see right here this is kind
of a screen capture of some Bluetooth
data that I was sniffing and if you
could read it I don’t know if you can
really well it says Williams air pods
now air pods if you’re unfamiliar are
the apple’s new wireless bluetooth
headphones really awesome very portable
but when you connect to them they write
information to the device itself so
every time I turn my air pods on it’s
broadcasting the signal that Williams
ear pods around Williams ear pods around
so as I’m walking into Starbucks and you
can see that hey Linds here right go on
to a plane and start just listening to
data you can see Joe Bob Frank all in
first class their Bluetooth headphones
the other Bose you can tell anyone
that’s on the plane I did a talk at
Harvard in January and one of the Nokia
guys was in the crowd talking about IOT
security and I came up after him and I
told him hey Jim do you own a Nexus 5
phone I could tell because you were
telling me all about it yesterday when
you were just had your Bluetooth off
it’s kind of fun that information but
what’s really fun is monitoring
Bluetooth is not hard and it’s free you
can do it too right go to your Android
store go to your Apple Store and
download these Bluetooth explorers and
just see the amount of data that’s going
out there and I mentioned security
always changing right very lucky they
didn’t they made my slides get delivered
last week because this slide deck
would’ve just blown up all right I’m in
Costa Rica I come back to the states I
turn on the internet and I look new
vulnerability introduced blue born blue
boards kind of interesting in that it’s
not just one vulnerability but Isetta
bluetooth vulnerabilities that allows
you as an attacker to actually take
control of a person’s phone without
being paired to it and that’s the
important key here is being paired and
the same with the wireless sniffing and
this Bluetooth sniffing I am never
connected to your device itself I am
just sitting there as an innocent
passive bystander listening to your data
thanking you secretly for giving me your
information right but yeah it’s fun
stuff I urge you to download it and I
urge you if you have an Android phone to
go update because you might want to
anyway but some things that you can
actually do as I mentioned nothing’s to
be feared it’s only to be understood
everyone’s device the way the wireless
networks work and to make it easy for
you to connect to the Internet is they
remember your previous known connections
and when you’re not there it’s going to
reach out for them and just like I
injected I heart TEDx El Paso I can also
inject Hilton the honors and say yes I’m
Hilton honors connect to me so some
things that you can do is turn off your
Wi-Fi and Bluetooth when you’re not
using I’ve actually modified my Garmin
watch and I only use it when I want to
connect my healthcare data in my house
other than that I turn off all the smart
functionality it’s kind of changed my
way of life and how I’ve kind of thought
about things there’s an option in your
phone and say asked to join networks
this is important because someone like
me that might say hey I’m Hilton Honors
joined me it’s gonna ask for the ask you
to join that network before it Auto
joins it itself there’s also a button
called reset network settings if you’re
really paranoid about sending out all
the previous known locations you can hit
that button and it will reset all your
network connections and all there’s no
networks will go away so I’ll no longer
know that I went from San Francisco to
Costa Rica slight segue through Atlanta
and international customs to El Paso
right if I clear my network settings you
no longer is my phone actually reaching
out to previously known good networks
but most of all just be aware you know
know what you’re green to when these
applications we asked to install just
kind of think about what am I giving
this permission to do do I want to do
that does it matter maybe it doesn’t
anymore everyone’s data is in the
Equifax breach just about so maybe it
doesn’t matter anymore but you know my
data was breached a long time ago with
the OPM breach so I kind of just you
know it’s in the wind to me but true you
know to today I still kind of keep track
of what I’m connecting to what I’m doing
but you know the point of this was
really just be aware of what you’re
doing what kind of data as we continue
to grow more and more connected
and as I connect to you in the crowd and
you know if we had a live chat going
during this TEDx imagine kind of did I’d
be connecting then all right but just
kind of be aware of what is actually
around you what kind of data you’re
sending what your grantee because
privacy is important and just because
I’m on that remote beach in Costa Rica
doesn’t mean that I’m actually alone
because that bar called Lola’s turns out
has a wireless hotspot as well so just
cuz I’m on that remote beach you can
find me anyway thank you very much
[Applause]
Please follow and like us: