[Music]
okay so this is Osen welcome thank you
for being here the first day thank you
so we're gonna suck I should probably
try my song so we're gonna talk a little
bit first about what identity is
identity is not just our names and our
address and things like that things that
an identity thief would want our credit
card numbers it's also who we are
it's our fingerprints it's the the
things that we like it's the things that
we do its qualities preferences all
kinds of different things so identity is
not just something someone can steal
it's also something that makes us unique
that we can't change so int is a
military term for intelligence there are
multiple different kinds of int there is
human and signals intelligence and
things like that
Osen is a particular type of
intelligence gathering that is uses data
that's collected passively the internet
or from other sources so open means that
we're not we're not like doing
clandestine things we're not doing like
CIA operations where we're trying to get
information that's a totally different
kind of intelligence so we're just
looking at publicly available sources
and we're gathering data from that it's
obtained legally hopefully and this I
love this quote from the CIA that
information does not have to be secret
to be valuable because the things that
we share on the internet every day on
social media and other things it can be
a danger to ourselves or companies or
friends or families so who uses Osen
basically everybody you do everybody
does be there
on a date if you've ever applied for a
job if you've even neighbors all kinds
of different things
advertisers use it a lot that's that's
something we see with Facebook and
things like that but everybody uses it
at some point and once you start to see
what we're doing you will understand
that so the parts of Annecy attack are
just like any other attack
it starts with reconnaissance we're
gathering information we're just trying
to figure out what we can figure out we
and then we move it into more active
types of the attack phase so we're
actually scanning we're actually
connecting to things we're gaining
access elevating privilege command and
control and from on from there but we're
gonna focus on the first stage which is
just gathering information about humans
human targets so OPSEC is operational
security and it's a defense against
intelligence so if you practice OPSEC
then you are aware of the possibility
for intelligence to be gathered about
you and you take active measures to
prevent that data from being collected
so if I am going out of town or
something I may not say when I'm leaving
how long I'm going to be gone if I post
a picture I may look to make sure things
in the background aren't giving anything
away about where I am these are this is
OPSEC and we'll talk about this later
later we can also do things to mislead
people into with off sex so we can say
yeah I'm gonna be in town all week and
go into this but you're really out of
town so you're you're using adversarial
information to mislead in order to
your own self an identity so if when we
perform enough sea attack recon helps us
in a lot of ways we want to gather as
much information as possible and we
don't always know what we're gonna find
so you start out and you have kind of a
basic idea of what you're gonna do who
you're attacking you might know a
company name you might know a website
you might know it let's say you're you
want to install ransomware or something
you might want to go after people in a
certain income level so you're looking
for certain targets so so you want to
try to figure out common threads and
then follow them down the rabbit hole
and then we analyze what we found and
build a profile that becomes more
helpful so another I love this guy so
they talk about other offline and things
that we wouldn't necessarily think about
for intelligence school newspapers are a
really good one
journals photos everybody's looked at
Google Maps Street View to try to figure
out if there's parking or something
that's image intelligence what
information is valuable basically
anything you can think of in addition to
the things that make us unique versus
the things that we can't change
anything that could potentially be a
vector for attack is valuable so if you
can find out who picks up the trash at a
company that could be a way in if you
can find out are they using Excel versus
Google sheets that could be useful if
you're if you're gonna design an attack
later you need to know what you're
attacking so we're trying to get as much
information as possible we're building
organizational charts we're trying to
figure out if they have Wi-Fi if they
have any documents that are out there
that could be helpful when we go into an
attack and we have information it makes
us seem more credible so if I went up to
somebody and I said hey that barbecue
the company barbecue last week was great
what did you think you would think that
I was at the barbecue most likely or a
normal person would so when we when we
have those little pieces of information
when we say like yeah we both know this
guy and Jimmy and and we can talk about
him a little bit then that that creates
a bomb but that makes them feel like
they can trust us so it also makes it so
that we can customize attacks when we
send a Spearfish we need to know
something about the person we're not
just sending out hey I'm a prince and I
want a million dollars and then you can
have it if you give me ten thousand
dollars we're not we're not doing that
kind of thing
spearfishing we're actually going after
things people care about we're going
after charities we're going after
natural disasters we're going like
against horrible things that are
happening in the world so if we do want
to target something specific like PDF we
need to know what PDF version that are
using we need to know what is it Adobe's
and out-of-date the all these things
could be useful for us in an attack
not all sources are going to give you
credible information so we have to be
really careful about what we find what
we find something we need to consider
the source we need to consider is it
trustworthy as I've been news outlet or
is it somebody's blog
a photo or is it well I have a really
good example of this later you're gonna
love it
so good targets not just a CEO not just
the call center people but the admins
executive admins are huge targets they
have tons of access they know everything
about the CEO they're used to talking to
people they're used to setting up
appointments and and they they work fast
they're the quick on their feet and they
have just tons of power also new
employees are statistically one of the
most frequently targeted because they
don't they wanna they're really either
for everybody to like appreciate them
and they want to show that they're good
employees and so they may do things
without asking and they may not have
been trained in how things actually work
so going out of process may be less
suspicious to them so when we talk about
Osen versus espionage if we're talking
about publicly available data when you
friend someone that is not public
anymore then you have a potentially
private data that's being shared it
because of that friendship relationship
it's also illegal in some cases and it
does violate the Terms of Service of
various social networking sites as well
as copyright and privacy violations all
things we need to be careful about if
you're on a job these are probably
something that is covered in your
contract covered by your statement of
work but just things that you might want
to think about not all sources of open
source intelligence are free a lot of
those people search sites that you may
have seen you have to pay in order to
get access to their databases if you can
pay for them
can increase your intelligence
exponentially so I would include that in
any kind of budget that you have for a
job if you're doing this and even I mean
they're not that expensive even if you
just want to have it for investigating
dating partners or whatever it is that
you're doing there's it's still useful
to have some of these tools so on social
media we are proactively sharing
personal data about ourselves we are
doing the opposite of being private so
anytime we like a post anytime we
comment on something any of the groups
that we belong to that's all public we
unless they're specifically marked
private all of that information is
public especially your profile picture
your profile picture is always public
and anybody that likes your profile
picture can you can see who liked it you
can click right on the links so the kind
of data that you can gather is not just
name and phone it's it's things like
marital status political affiliation and
we saw this with the Cambridge analytic
a issue that happened earlier this year
where millions of accounts on Facebook
were mapped by this company the few
hundred thousand that actually took some
little survey and they linked the
account so they followed all these links
and they determined who was head what
political affiliation and things like
that and may have influenced the
election and all kinds of other crazy
things but it's all because of what we
share and who were connected to
so the basic innocent steps that I'm
gonna walk you through I think we start
with what we know we start with the
company name we start with a person's
name a URL we we try to figure out some
target data that we want to get do we
want to are we contesting the platform
are we have contesting the people we
gather the intelligence we connect dots
we try to connect people to people we
try to connect people to places things
like that and then we pivot as needed if
we can't find information about one
person we may want to go to another
person because they may have a deeper
intelligence profile around them so we
want any assumptions that we make we
have to validate because assumptions we
know what they do so then we we generate
a report if we're doing this as part of
an engagement and screenshots are
crucial for this so this is gonna get
creepy sorry so remember what I've done
here is not an invasion of privacy these
things were proactively shared with the
public at large I happen to find them
and talk about why they're dangerous but
I didn't do any pretexting I wasn't
friends with this person I didn't do
anything illegal I didn't penetrate any
networks I didn't add an email with
person I didn't attack this person and I
didn't get any information that was not
proactively made public that's the key
we also need to understand that
criminals don't follow those ethical
rules so a criminal will do those things
they will perform espionage in order to
get intelligence they will do anything
it takes to get their job done but I had
subscribe to a code of ethics whatever
whatever code of ethics you want to
subscribe to you that's fine I have my
own so so let's get
I was sent case study okay so there's a
couple of different ways that we can
start an attack you can start with the
organization and you can work your way
down researching you go to like LinkedIn
you click on the company and then it
says 800 people work here you can click
on the 800 people you can see all the
800 people and then you start targeting
individuals or you can just start with
individual so once you target the
individual you research the person you
try to figure out relationship so that
they have interests that they have
things they care about
and we start thinking about weaknesses
as we see these things we start thinking
about attack paths and and things that
we could potentially use as part of an
attack an active attack so the way I
started with this I just did some some
searching on Instagram for a new badge
work uniform my desk these are all
things that could be helpful that having
a knowing what the badge looks like if
you're trying to get in the building and
then you have one printed but when you
get there that's really useful I'm
seeing things on people's desks can
often give things away there was an
example there there's been several
examples where people have been on the
news in front of their monitors and
they've had sticky notes with passwords
on them right behind them so it desk
took can be very important I also look
for like new job first day working late
things like that so that brings me to
our friend here our friend here this is
Travis I actually I really like Travis
I've gotten to know him through
his Instagram account and he seems like
a really good guy and I kind of feel bad
for doing this but I mean he he
proactively shared all of these things
so Travis is a lot like us I mean we do
crazy things at work we dress up like
dinosaurs conferences I found this photo
he posted this on Instagram this is his
this is this is under hashtag new badge
photo and he says the best part of 2016
so far new badge photo and then somebody
says where do we get the new badges so
we've identified a co-worker we've
identified the site number you can't
really see it here but it says I went to
a site because I lost my badge so we
haven't leave eight things that we can
tell from this one photo we have the
likeness the photo of his face we have a
real name possible username Road air
that could be it could be like his login
or something like that there's possible
coworkers the location in Arizona we
know what the badges look like and the
barcode I haven't looked it up but it
could be like an employee number or
something like that so one photo we have
eight pieces of information about this
person and how and their employer but
where does Travis work well Travis works
for Amazon or worked for Amazon Travis
is an executive assistant and as they
talked about they have a lot of a lot of
reach they have a lot of info about the
CEO they book their travel they've
they have the credit card number they
know their passport number they have all
these things about the CEO so executive
assistant and one of the weakest things
in any company is a supply chain so
Travis is in charge of this North
American supply chain executive
assistant so it's I mean this is a great
vector of attack if we were going to do
that we've got a full address a phone
number and we also now have confirmation
of what we didn't have confirmation
before which is that his email addresses
are OD ERT at amazon.com so we now know
that is even an email or probably user
name - so that's confirm it validation
confirmation of an assumption that we
made in the previous he really likes to
post his because badges here's another
one this is this is all this is a little
bit earlier but same kind of information
and also we've got a number if you can
see it on there that could possibly be
the number of the badge I've seen that
before where that's that's the key for
the badge on the keep when they program
that keypad so we didn't know who
Travis worked for but now we do
because for national admin day we switch
roles for about five minutes and Travis
was VP for a second so we now know that
Travis works for VP and it's a woman
most likely and we can see some things
on the desk
so this is another post this is a I
seriously have the best boss Travis says
so now we know that the boss's name is
Romina which we do not know before we're
getting little pieces of information
we're making connections so we have we
have a partial name we can probably look
up this person their corporate website
or LinkedIn another bad photo but beyond
this bad photo we also see that Travis
is using Windows so if we were going to
send Travis and exploit we wouldn't be
sending a mac os/x boy we'd be sending a
Windows exploit that's important to know
and also it looks like it looks like a
spreadsheet we can't really see anything
but maybe we will find something else
later so happy birthday Travis lovely I
have some really nice co-workers this is
from July 26
so is July 26
Travis's birthday not sure that's
another assumption that we're making it
could be or it could be that it's a
weekday and Travis is at work and and so
and Brooke that was really over the
weekend we don't know here's another one
this is from two days later July 28th
happy birthday which one is it this is
where we talk about validating
information and not all sources are the
same fortunately we know exactly what
Travis's birthday is because Travis
posted driver's license photos along
with birthday
some other things and signature so we
have a confirmed birthday but there's
probably some other things that we could
learn like his middle name so the part
that's covered up with the fingers
that's actually the issue date and
expiration date the part that's I
covered up at the top is the number
their passport number so I did contact
Travis about this and said you know you
really shouldn't have this hot up here
this has since been taken down so that's
good good Travis thank you
so here's enough we were going to be
trying to do physical penetration and we
needed to see what a loaner bags look
like we know what the loaner Badgers
look like we can easily make I could
easily do this in front up in like two
minutes
so we have this information Amazon
employee badges everyone some full
address for a previous job working at
Nordstrom I'm actually going backwards
in time through here an email with a
bunch of Pio numbers a bunch of I don't
know customer or supply chain people
with their email addresses phone numbers
on these other things yeah so it should
I can't even so this is a good example
of how we can expose our friends and our
friends can expose us soum is Brocks
ms Bronx's profile is private I can't
see anything about Ms Brock's except for
the information that you see at the
bottom but Travis posts
this conversation and tags Miz brats and
now we know Miz brats his real name is
Megan Gibson if you're trying to be
private on the internet you have to
educate your friends about being private
on the internet too it's it's not just
about you it's about everyone else too
that's why this is so important so
here's another great photo
we know that it's excel and not Google
sheets we've got you probably can't see
it but there's a fixture account number
sticky down there maybe for the office
you know like cubicles or something if I
had any inclination what these numbers
meant that might be helpful I have no
idea what it is though so this is where
we start getting into personal interests
Travis is very into musical theater I
found this and I I don't know if Travis
is a singer I don't know if Travis is a
dancer plays music something like that
have no idea but I know that if I sent
Travis a message saying hey we're doing
an audition in your neighborhood fill
out this form send it back to us and
we'll get you on the schedule
that's that email is gonna be open
that's gonna be filled out that's gonna
be sent in this is what we're talking
about real spearfishing this is getting
to the heart of why spearfishing works
it's not a deep personalized email it's
a deeply personalized email based on the
things that we share about ourselves
willingly so I left Instagram and all of
its glory I was trying to look on
Twitter for the same username I couldn't
find it so I started searching
the different people search sites so
this is PQ and I the username was not
the same it was to peace and biscuits
felt a little weird if you notice at the
top there is an opt-out if you find
yourself on any of these they all have
processes to opt out and do it it's a
lot of work but do it so now I know the
Twitter username even though it's
different if I scroll down I can get all
kinds of information and if I just pay
$40 or whatever it is I've got a partial
address just for free I've got a
hometown and we already know the age so
Travis has not been really prolific on
Twitter this is from 2013 but we still
can get information from this especially
if we're going after a company who had
Travis used to work for rather than
current company so here's a wonderful
photo from 2012 we know where Travis
worked in 2012 because we have his
LinkedIn information and all kinds of
other things we have a site ID with a
number down there we've got a save the
date for some kind of Alzheimer's
something something if this was current
we would know probably where Travis was
going to be maybe Alzheimer's is
something that Travis cares about so
that may be another Avenue attack we're
looking for donations we're looking for
runners whatever the thing is and also
you know who doesn't love cats with
tiaras the other great thing about this
is that now we know that it's also
Outlook for mail it's not Gmail it's not
Lotus or whatever it's Outlook and you
can actually see in this some of the
names of the people and subject
going back to see people search sites
this one actually gives us name of
family members I mean we could go down
that rabbit hole and we could look up
each of those people and use those as
vectors for attack I did not do that one
of the questions for password Risa is
what was your high school mascot I know
the town travis grew up in so i just did
high school in in that town and I looked
up so the answer to that particular
question is probably comments or the
comments another people search site this
one has an email address which we can
probably guess based on the R and the K
if I wanted to get a full phone number I
could do that if I paid and something
else Ghostlight theatricals director so
that may be another type of thing that
could be used later so this is LinkedIn
we're trying to figure out so 2012 with
that site ID and all the information
that was probably Nordstrom
[Music]
we have a full education history we know
the Travis is good at social media so
I've taken the gun back to the Instagram
and I've taken them a username and I've
shot I'm gonna take that and try to see
if it's used elsewhere because we tend
to use the same usernames
so I did a search on Facebook did not
find it but did find a miss tag and if
you can see that it's definitely Travis
if you know what Travis looks like so
Travis is probably on Facebook but not
with that username so I did find Travis
eventually Travis is really good on
Facebook he doesn't share anything he's
all locked down he doesn't share
anything nothing I mean we know now that
Travis works at Facebook kind of funny
but none of the other information is
shared here so but photos like we talked
about are always public so there are a
lot of photos here that to go through if
I wanted to click on that link of the 68
people that liked this photo and I
wanted to do it 204 times I could
enumerate most if not all of Travis's
friends and connections I could probably
write a script to do that or something
you know probably not do it manually but
there's no they're also all the comments
on your profile pictures are public too
so if I was going to pretend and pretext
as someone
Phylis here would and if I was trying to
pretend to be like an old friend I
probably wouldn't want to be Phyllis
because Phyllis is a current friend
Phyllis lives nearby Phyllis
does things with Travis actively so
that's probably not the best pretext so
these are not friends these are
followers and I love this the the top
left
it's a hacker at Facebook that's
following him so these are people that
maybe Travis doesn't know real well but
let's say that the ash here sent Travis
an email and/or a Facebook message or
something and said we don't really know
each other but I'm interested in the
theater that you work at or something
like that you know we're we're just
trying to think of ways that this person
could be vulnerable the reviews on
Facebook even though everything was
locked down reviews are still public if
I wanted to call the Hair Studio and
this gets really evil and creepy if I
wanted to call the Hair Studio and say
what time is the next appointment for
Travis I'm Travis what time's my next
appointment and then find that out and
then call Travis as the Hair Studio
spoofing the number then I could say hey
Travis you know we got a new system your
for your appointment coming up on the
28th we need a credit card to hold it
it's it's simple I mean it's terrible
but this is what criminals do
so the groups that are not private are
all public so if I went into any of
these groups and look for posts or
comments that Travis made those are
public even though
Travis's post arm so this is how I felt
after I did all this
I felt bad I was shocked I've never seen
that I've never seen that much shared
anywhere ever so going back we've looked
at Instagram we found flags which are
the little bits of information the
address the hometown the mascot friends
site IDs things like that looked at
multiple sources I did do other searches
on like DuckDuckGo and some other things
and I've looked at multiple sources of
twitter facebook Instagram followed
links there we found some false info
about the birthday and we verified a
good info and we made note of that so
that's that's like a case study of a
sense so I've been asked before with edu
and Judy PR and some of these other
privacy laws that are coming into effect
is it still possible to do searches like
this they're bushes here where they have
stricter laws and yes
it absolutely is and also we should
never underestimate the fact that people
want to share things about themselves
even if the even if their personal data
stored on Facebook is extra private and
they can have it removed the things they
share that's not covered by GDP are
so geolocation is a really interesting
piece of information that we can find
when we're doing intelligence gathering
sites like Facebook and Twitter and
Instagram they're gonna strip this data
off they're gonna get you're not gonna
be able to if you download the photo and
you look up the properties you're not
gonna be able to see the geolocation but
if you find an image on a open web
directory if you find the image on a
bulletin board something like that that
isn't stripping the data then you may be
able to look at the properties and
figure out exact locations google
dorking we've all done this to some
extent just really well-crafted Google
searches there's a great database the
Google hacking database they have all
kinds of examples of how to find like
sensitive directories files containing
passwords things like that very useful
Google Maps is awesome we've probably
all done this too but it does have a
cent value if you're looking at
somebody's house or somebody's you're
looking at the cut the building that is
an attacker perspective you're looking
at a building trying to see how would I
get in is there a side door that doesn't
have a camera is how is it how are the
doors situated would I be able to get
through the doors there's all kinds of
different things that we can tell based
on Google Maps
DuckDuckGo I highly recommend in
addition to Google Google is gonna give
you like what it thinks you want and dr.
Koh is going to just dump everything by
relevance and it's not going to be as
filtered or curated so it's really like
a lot more raw so if you're going to be
looking for oesn't data
DuckDuckGo is awesome the corporate
website has all kinds of information
that you can get it talks about who the
customers are talked about who the the
sea levels are sales people support how
to get in touch with people the about
page we get human targets jobs we get
technical information investor pages
there's all kinds of things you can get
in I want to touch them corporate travel
listings because this is this is really
important if you are trying to find out
what kind of technology you're going to
exploit and you're looking the job
listings and you want to figure out what
kind of firewall they use and they're
looking for a network person they may
list the brand of firewall that they are
or even the version of the operating
system that they're using because
they're trying to find people that know
that exact thing so it also gives you an
idea of the culture of the company if
you're going to go in there in a suit
and tie and the culture of the company
is that they wear jeans you're gonna
stand out so it's important to
understand these things it also gives
you information like about hierarchy
inside of the organization so it might
say this role reports to the CEO or this
role reports to the VP or something like
that so we can start mapping out people
within within the organization also does
it accept a word or a PDF because that
could be I mean that could be some way
to exploit it as well
robots.txt I can't believe this still
exists but people do still use this and
one of the first things you should
always do when you go to a website that
you're trying to look at from this
perspective is looking robots up text
let's see if there's anything look at
the things they don't want you to see
Google only indexes about 1% of the web
so everything else is in the Deep Web
we're not talking about the dark web
we're not talking about tour all that
stuff we're talking about the Deep Web
Deep Web is like the people searches
it's it's Instagram its Facebook it's
things like that so a Deep Web is
anything that's stored in an internal
database that you either have to do a
search on it's separate website from
Google or you end up in a database from
a Google search and pretty much anytime
you navigate away from Google and do a
search here in the Deep Web so this is
where all of the information is it's
estimated to be like hundreds of times
more information than Google has so
really important that you don't just
stick to Google you you do outside
searches and you do use multiple sources
paceman is awesome from an attack of an
attacker perspective people will post
dumps of passwords though the pace dumps
are basically anything that they find
about companies so you can search for
your court your company name your domain
name and you can see if you are in any
of those you can set up alerts too that
will tell you if you are in a pace that
comes out
here's an exact this bookcase it looks
like you can see here's logins from
Facebook from 2017 it's got the email
and my password just in a text file all
kinds of leaks go out through this and
they don't always stay up for very long
so it's important to keep checking show
Tim is great for open source
intelligence especially if you're doing
technical attacks which is se attacks
there if you want to find camera feeds
if you want to find open telnet things
like that this is an amazing tool it'll
show you there's different types of ways
that you can drill down you can look at
cities ports host names so let's say
that your pentesting google.com well
that would be hard let's say your friend
testing company comm and you're putting
company comm and you can see all of the
records associated with it that's a
great start for a totally open-source
you haven't connected to anything you're
totally passive at this point just
gathering information about what's
available on the Internet
some of the things that have been found
dan count loveth he he posted it he
found a damn control this person has put
their RSA token in front of a camera
that was open to the internet because
that way they don't know if they have
the RSA token on them
there's all kinds of cool things like
cameras in people's homes unsecured
stuff
it's a lot of fun but it's also scary
but and it's useful convincing it's not
just fun there's another side have I
been poned calm you can put in your
email address your personal email
address your boss's email address your
aliases and it will tell you if you've
been included in any breaches so if you
are it'll say okay so this one was March
2015 the free web host provider triple
zero web host suffered a major data
breach and they talked about what it was
and how it happened and then you can
look that up more in-depth and try to
figure out what was exposed the wayback
machine is another great tool it's on
archive.org and it it shows you versions
of websites in the past as they've
changed so I mean want some things on
the internet and it never really goes
away and this is a great example of it
some other sources assent framework com
it has shows you like a tree tree
decision tree on how to do au sent email
def format com if you don't know the
email like let's say you don't know that
its first initial last name or if it's
first name dot last name you can find
out more about that with email format
who is it's kind of going away so
reverse image search if somebody has a
profile picture and they have like
they're you know I'm an executive is
like profile picture they probably use
that everywhere that they have have
accounts so you can reverse image search
on that and find other places they've
used it job search sites you can find
all that information about the
technologies they use photo sharing
sites looking for the same username
looking for their name whatever it takes
there are lots of places to look these
are all social sites
that people may be part of kind of kind
of scary so some of the software that we
can use to look things up this is an
example of Google Dorking we're looking
at metadata for any kind of document
from the website so what we do with that
is we can there's this called meta goof
fill and it's a command line tool that
will pull out you give it a list of
files and then it will pull things out
of it this pulled out a whole bunch of
usernames out of a bunch of files very
useful it can give you people names user
names all kinds of good info Foca is
another good one it's it's sort of
similar but this one automates it a
little bit more it can actually download
all of the files from the website and
then do all of the analysis on it that
way
melty go if you haven't used it it's
amazing for for any of these kinds of
mapping of people mapping of
relationships things like that and
there's lots of free add-ons on github
just paid out on Scoob but there's tons
of free ones so I would just use those
if you take one website away from the
stock in South techniques com
this is the best tool ever for Osen
michael basil is amazing he is like the
King of ascent there's he has all these
cool tools where you've put in like the
phone number once and then it populates
everything and it pops up a whole bunch
of windows so you don't have to do it
manually also he has these wonderful
maps if you have an email address it
shows you what you can get from the
email address or if you have a domain
name it shows you all the things that
you can get and how you can get them
there's a whole bunch of these up there
and it's all free
so the browser is an excellent tool as
well there's lots of add-ons this is
wrap eliezer it looks at the underlying
technologies for a website so if I see
jQuery 1.8 - I just search jQuery one
deletes the two vulnerabilities easy it
will give you all of the information
that you can find this is passive recon
it'll look up DNS IP information Whois
information just from the browser it
makes it easy down the mall is another
good one you can download every piece of
a website every piece of a page and then
you can do that metadata type extraction
open source intelligence browser
extension is probably my favorite
because it has all these different
things built-in telephones domain
searchers IP addresses and it works in
Chrome and Firefox so when we talked
earlier about how you need to write a
report if you're doing this for you know
pentesting reasons you want to take
screenshots it's really hard to take
screenshots as you're going because
things happen quick you get distracted
there's a really cool tool it's like not
that expensive I have no affiliation
with them but I use it it's called hunch
lee and it will take screenshots of
everything you browse in that session
and it will save it with a hash so that
you know if it's change it's useful for
investigations as well not just for
intelligence gathering
so how do we defend against this so we
know that how to attack so uh listen
shows us weaknesses it shows us how
people are vulnerable we can get we can
give information about architecture
technologies that may be vulnerable we
may figure out third parties that could
be used as a vector and spearfishing to
get all kinds of corporate compromises
most most of the attacks that happen
with social engineering come in through
email so OPSEC we we just want to be
careful about what what we post we want
to think about what we post we want to
look at things in the background we want
to lock down our social media
permissions but not rely on them because
a coding mistake could make your private
Instagram profile public for six months
like happened a couple years ago and
stripping geolocation data before you
post things and assuming yourself
regularly I look up myself up all the
time and try to opt out of those stupid
people search sites and search for
aliases search for anything you know put
yourself in LT go and just through your
own personal one as you try to learn how
to do this your linked apps can expose
you as well
Facebook anytime you have a third party
that's linking back and forth you're
giving them way data about yourself the
whole thing that happened with Cambridge
analytical
shows exactly how that works also if you
ever upload your contact list you were
exposing all of your friends and family
so you want to teach your co-workers
your friends your family about OPSEC and
why this is important because you're
only as secure as the link to you we
want to be careful about accepting
friend requests and things like that
listing too much information about
ourselves on LinkedIn we don't need to
have every single detail addresses and
and all those other things so basically
just think before you post anything can
happen if what's private today may not
be private tomorrow I am out of time so
I'm gonna give you there's a great
article by Joe Grey where he talks about
how to profile a family based on those
little stickers on the back of the car
Michael basil has a few books that are
on Intel techniques calm as well kevin
Mitnick has a great book about removing
yourself from the internet which is
basically impossible but I think it's
more reasonable is just be careful so
that's my thing thank you for being here
[Music]