"All we did was use the existing functionality of Google Android - we chose it because it was a little easier for us to develop in," said Mr Munro.
"We gave ourselves permission to use the microphone on the phone, set up a listening server on the internet, and everything that microphone heard on that phone, wherever it was in the world, came to us and we could then have sent back customised ads."
The whole thing took a couple of days to build.
It wasn't perfect but it was practically in real time and certainly able to identify most keywords.
The battery drain during our experiments was minimal and, using wi-fi, there was no data plan spike.
"We re-used a lot of code that's already out there," said David Lodge.
"Certainly the user wouldn't realise what was happening. As for Apple and Google - they could see it, they could find it and they could stop it. But it is pretty easy to create."
"I'm not so cynical now," said Ken Munro.
"We have proved it can be done, it works, we've done it. Does it happen? Probably."