well uh hi
everyone and thanks for tuning my talk
my name is
charles roth i go by angus reed and
today we're talking about open source
intelligence
the gateway drug your mother never told
you about
right so the outline of my talk today
i'll give a brief introduction to myself
um we'll then talk about what is urcent
why we do oceans
sort of why it is awesome the highs we
get from that
the side effects you know what you can
gain indirectly whether you
continue down a sort of a professional
line of oceans or just stop
there and move on with your life and
then we'll talk about feeding the supply
and then uh we'll take some questions
afterwards i'll be
on the discord if you need me
all right that's a brief introduction as
i said my name is charles roth i'm a
league technical security recruiter
i recruit predominantly in the united
states i do a little bit in the
eu and the uk and then also double some
some stuff here in south africa
i'm a former british british airborne
and i did about six years in higher
security consulting predominantly in
east and west africa
and then also some time in the middle
east locally and in the community i
involved with fair amount of conferences
i'm a co-organizer of b-sides cape town
i'm the founder of hacksaws along with
some very great people
and i'm an avid open source intelligence
analyst um
shout out to cryptic monks and de vet
for the
third place in the recent trace labs
which i'll discuss
momentarily right so what is open source
intelligence
okay so take it from uh take it from
wikipedia
i read directly it says open source
intelligence is a multi-method
qualitative and quantitative methodology
for collecting analyzing
and making decisions about data
accessible in publicly
publicly available sources to be used in
an intelligence context
in the intelligence community the term
open refers to
overt publicly available sources as
opposed to covert clandestine sources
it is not related to open source
software or collective intelligence
okay so open source intelligence under
one name or another
has been around for hundreds of years
with the advent of instant
communications and rapid information
transfer
a great deal of actionable and
predictive intelligence can now be
obtained from public unclassified
sources
right so typically the sources will
include media uh you know like print
media
magazines radio television uh the
internet which is the predominance of
what i do now
will be you know your facebooks your
linkedin twitters
instagrams uh blogs uh
message boards um anything sort of in
that sphere
uh public government data especially in
south africa is quite rarely accessible
uh you know looking at uh birth records
death records
property records that sort of stuff
anything that the government will push
out
also crpc is quite helpful here in south
africa
uh professional academic publications
which is
not so widely used but it's still viable
example i can use of that is if i
typically want to know someone
something about someone in this industry
that's given a few talks i'll typically
watch the first four or five minutes of
their talk
together introduction to see how they
introduce themselves and i'll take
information from that
next up we have uh commercial data which
i
don't use that much which includes
accession commercial imagery
financial industrial assessments and
databases
hopefully legally acquired databases
uh grey literature something i'm not
very familiar with this includes things
like sezio technical reports
pre-prints patents that sort of stuff
um and says at the end open source
intelligence is distinguished from
research in that it applies
the process of intelligence to create
tailored knowledge supportive
of a specific decision by specific
individual group
right so this is directly pulled from
from wikipedia
okay so why isn't what what what do i
and what do we use it for
right so on the fun side ctfs so
these are usually based on fake
information with fake
accounts in order to test someone's
ability to gather intelligence and
pieces together to form a hypothesis
um examples of this such as hack the box
challenges i've done a fair few of them
a friend of mine bushido he also spoke
at a recent con i was at conant
he's got one or two really fun
challenges to do that's called like a
story
line to it and then on twitter you also
get things like
ocean challenge which is trying to
identify the location
of where a photo was taken literally
just from a picture
or from a google maps uh um
screenshot right so typically a
challenge looks like this
so this is on hack the box so you'll see
here super secure startups
our private information is leaked can
you find out how there'll be a file to
download
now typically what you would do with
this is you would look for information
related to the company super secure
startup
you will try to find them on linkedin
try to find them on twitter
you'll see sort of where the path takes
you you'll see it who's
engaging with who who messages who
um and from that you basically pull a
password that unlocks this document
and then gives you the flag it's quite
fun but can be quite challenging on on
hack the box
right so the ocean challenge that i
mentioned this is one example so you've
got
uh jocksmith here i will originally went
on holiday about
three four weeks ago uh on the way to
pick a newscliff
um so i took a photo while i was driving
or while uh i was in the passenger seat
of course
uh took a photo and then i said you know
try find me
um and you see here he has the picture
that i took on the left and on the right
is a director paul from google uh where
he'd use the
mountains in the background uh
route markers and then a house on the
road to identify exactly where
the photo was taken and he was pretty
much bang on
right so the next thing is trace labs
so tracelabs is a ctf based on 2j812 it
can be
like the recent one five five to twelve
missing persons cases
it is the same as hack the box i seem to
challenge
your ability in open source intelligence
but with trace labs it is based on real
people and real cases and so it has a
real outcome
so with trace labs intelligence is
sought on cases
um we submit that we get points for the
things if they're validated
and then all that intelligence that we
gather is then given to law enforcement
i very often we do find the locations of
people or find locations within
the last couple of days or where someone
was despite them being missing for
hundreds even if not thousands of days
right really fun really good to do and
like i said it has a real
outcome at the end of it
all right so that's what it looks like
when you do well so this is from our
recent third place the trace labs
and this is a meme that big ldp from
tmhc made for us we became
seventh and one before last
was a very very very close competition
right so another use for
episode intelligence is red teaming and
social engineering
so many re-teamers will use open source
intelligence to gather intel on proposed
targets
they'll use that information to build a
picture of on their clients
in order to exploit vulnerabilities such
as the human factor using
social engineering and other
exploitation tactics
okay so this usually is formed uh forms
part of the recon phase
so you get you know a big name a red
teamer like jason e street
uh he just talked one said i think at
defcon or derbycon
where he mentions that he would do open
source intelligence but
to be fair to every client um he would
only start scratching around
to see who what and where people are
um i think he said only an hour before
an engagement or maybe the day before an
engagement
so you know so that everyone is given
equal opportunity to get get owned um
but yeah this forms part of the the
recon phase
okay so uh an indirect use and something
that i actually want to do a talk about
one day
is the indirect use so things like
property investment
so a straight example uh i was looking
at buying a property last year you know
buying something that's low-bulled and
then you know doing a fixed-wrapper
project
i found a a really nice house on a 2000
square property
in morisburg small farmers town
i want to understand as to why the house
was half a million rand
but it was two and a half thousand
square property
i then did some intelligence i i looked
up the
i've learned now that i need to find the
erf number the araf number
once found the artif number i looked at
uh
swat line departments uh records that
they
post every two three years on property
valuations so when they bring up their
rates
through that you i could find the the
name of the owner i can then do some
further intelligence
um and i quickly find out what was going
on at the house who owns a house
what activities gone and i quickly
realized you know
if i buy this house i'm gonna have a lot
of dramas probably a lot of debt
collectors coming in
and put a lot of people looking for some
stuff they shouldn't at two in the
morning
so you know i made a uh adverse decision
to
not invest in that property
okay so business development so you know
as a recruiter are the extensive open
source intelligence to understand my
clients or potential clients
what makes them tick and how to string
piece of information together
to execute a better pitch so support and
understand if you are a
you know a name brand company that most
people know about
i will know about it and i wouldn't
really have to do that much scratching
um it's all about you know just finding
an n
so um with companies that i don't know
so well but i know potentially doing
some interesting stuff
um you know i will i will do some basic
episodes intelligence
you know i'll conduct basic research on
the target and the people
i know and know them i'll build a
picture of the company and the people i
want to contact um
execute an outreach using some basic
info to help break the ice
and build familiarity you know i'm i'm
ex british army
so if i find someone in the company
that's ex-army works british on me i
will
try and go down that avenue to try to
break the ice
trouble some familiarity and then from
there i will attempt to
do you know a sort of a soft proposal to
see if i can work with that company
um i think some people see this as
business intelligence which it is to
some extent but
um it's just another useful for the for
the skill set
right interview prep this is actually i
i i it turns out i was doing open sales
intelligence a long time before
i knew it was called ocean so um
doing open source intelligence for an
int for interview prep
is really really valuable so as an
interviewer
and as an interviewee it's good to get
information on the company that you're
interviewing with
so that you can show them that you have
an interest and you have done your
research
so typically that'll be try
understanding where the company operates
um where the headquarters are what they
do
maybe understanding if there's any bad
press involved with the company
um what kind of people work there see if
you know any people there
um this kind of stuff will tend to help
you get a job you know when that
company will always ask you you know so
what do you
what do you know about us right and
that's your chance to say you know i
know you folks operate here here here
you do this that and the other
um i actually realized i have two
friends that work for you folks down in
you know joberg and durbin um
so you'll kind of give that information
until the company says like hey
you know that's that's cool thanks we
know we appreciate you did your research
but it takes that that that big box that
shows that you have an interest in the
company
and hopefully you get a job from that
right so canada vetting this is
something um i was asked in the lost
conference like
how deep will i do this so when i would
use open source televisions to do
candidate vetting it happens on a very
rare occasion
it is only if i have a sixth sense about
them
or a strange inkling as to them
there being a risk involved with this
candidate and their background
and their history and maybe trouble with
the law um
it's happened a few times i've spoken to
people in the us and it turns out they
have federal indictments
um you know we all make mistakes but
it's important to have that information
before you send someone to a company so
um you know also if you think someone's
you know
you can't not hire someone based on
their beliefs or what they do on the
weekend
but it's good to have that kind of
information uh
before the time uh it's important to
reiterate me in recruiting i have done
this
literally a handful of times it's not
something i have to do very often
okay so the drugs so why is it so
awesome
right so it's important to understand
the ease of entry so what it takes
to to do open source intelligence or to
be able to conduct it
effectively right so let's look at what
we require
okay so these are the the prerequisites
right
so ideally you need a computer or
smartphone if you're smart you can use
your computer with a vm
as i typically use but you know if you
needed some basic stuff
a standard computer or a smartphone will
do
okay you needed access to the internet
as that's going to be where you find
the majority of your information
okay curiosity you have to have some
sense of curiosity
if you like watching murder mysteries on
netflix and
you know stuff like that it means you
have that curiosity
to go go out and find stuff
next is understanding uh the rules of
engagement
so the typical rules engagement to keep
safe
is what we call zero touch so it means
you will never engage or interact with
any form of intelligence that you find
if you find an instagram uh profile
you will not follow that profile even if
you have a sock account um
you never want that to come back to you
and your sort of
your data being tagged to that person's
profile and then they end up being
murdered
you know so the rule is always zero
touch
never get involved and never use your
own personal profiles
in order to do intelligence
okay understanding what you want as an
outcome so it's important in
intelligence and
you know i guess with most things in
life it's important to understand
what you're trying to get out of this
like what what needs to be the end
result
like with the property stuff i want to
find out uh
honestly i wanted to find out what the
circumstances were with that house
to see if i could make a lower offer the
house was actually on the market for
9.50
and i want to see if i can offer 500.
turns out the mortgage wasn't duress
right so um it's important to understand
what you're trying to get out of it so
you
know as you go down your path with open
source intelligence
um and you find a bit of interior in
there and you branch off
from that central line i.e away from the
target into
family and friends if it's not taking
you towards that end result
then you kind of will shut down that
branch and come back to
to to your main line
okay and understanding what you might
find
so this can include things of sexual or
graphic nature it can include
violence um you know if you're
investigating
you know underage children
you you have to mentally prepare
yourself for what you might find
typically you're going to find the edgy
stuff on the dark web
i have zero experience working on the
dark web um
but you have to you have to be prepared
for what you might find
um having all these in place
means you know you're pretty much good
to go
you see not like this that's not you
know you think it's complex but it's
actually
you could see how simple it is right and
that is it's open to anyone and part of
this talk in this journey is
getting people that might not be
involved in infosec or even technology
to see how
easy something like this is as as a
start to you know a journey towards
information security okay so what is the
result
okay so this is this is now the the
satisfaction that comes from doing good
open source intelligence right
okay so the fine so finding that last
loan location
of a missing person and reading an
article knowing that
you were perhaps part of finding that
person there's there's a lot of
good vibes that come from that you know
it's like popping a box on something you
know it
it brings a sense of joy and excitement
and and
satisfaction to you okay so getting that
new client and getting their new job so
you did your research you got to get in
with the company
and you managed to land them that's
always going to be good fives and good
feelings right
um or if you're researching to a company
you impress a company maybe the
president well on the technical side
um quite as much as they expected but
you smash them
knowing so much about their company and
what that company does
okay so when you know you know when you
know
you know when you sharpen your
abilities you know what you're able to
find and what help you can provide
and how to protect yourself your friends
and your family
by having a deeper level level
understanding of how open source
intelligence work and how you take small
piece of information stringing together
equips you better for making better
decisions and helping protect your
family and your friends when posting
stupid stuff on things like facebook and
instagram
there's a there's a there's a sense of
satisfaction in having that
understanding and many pieces
make one pretty puzzle so with open
source intelligence you'll find a bunch
of
small pieces of insignificant
intelligence right
when you get all those small pieces
together you can build an interesting
picture and you can understand
what was going on you know with with
trace labs we'll look at
an underage girl say no she's 16 and be
missing for
400 days you'll look and you'll find her
facebook profile where she's connected
with all her friends and family and
everything looks fine and there's a lot
of smiles a lot of happiness
and then you find their sock account so
they're alternative accounts
sometimes i'll have more than one i've
found people that have 10
alternate facebook accounts and then you
see the
the the the beast within you see the
the drugs you see the gang affiliations
you see the
the the tragic circumstances at the
house
you you you quickly get a better
understanding of what potentially led up
to this
this person going missing or what led to
the situation
so yeah those small pieces of
information they mean nothing but when
you
when you put them all together it it
pulls a fascinating picture
that's all knowledge so the knowledge of
knowing when you have a skill set
you know what you're able to find and
how to achieve something
right it's not with anything in life
when you have that understanding
you you know what you can achieve with
it you know
how you can use that skill set to
uh bring goodness into life or achieve
something in life it's
this there's great value in that
okay so side effects so what what can
you gain indirectly
from having a skills in open source
intelligence
okay so side effects okay so being a
champion of opinions uh
of opsec right operational security or
per se
personal security right so being a
champion of our operational security and
being
you know the family opsec troll you know
typically people in our industry have a
very good awareness and understanding
and we tend to be trolls with our
friends and family and say hey
like be careful posting this and this is
why you shouldn't post that and
stop doing those surveys on facebook um
having this understanding will help you
you know
protect your your friends and family
more and you know being like i said
you're the
champion of opsec
okay so the hunger so you had a taste
and you want more due to the ease of
entry of open source intelligence
and then achieving some success it is
only natural to one more
whether it is more ocean whether it is
more or
more ascent or whether it is just more
challenges right
so from the hunger you might fall into
the the part where you have you build
some form of intent
so once achieving the above one starts
to learn more about security and how to
find
other information on hacking right so
although the next step is more
technically challenging the hunger and
the intent
is enough to push people into this
direction right so that's what happened
with me when i started
um when i started exploring this
industry more from a personal
perspective
i started with oceans and i loved it and
from ostent i started
looking i started doing cts and i
thought hang on let me try something
else and i did forensics
and i enjoyed that so it's it's that's
why i said it's like a gateway drug it
starts you off down and
done a vicious path
okay so the past so once you've had the
drug you built the hunger and have the
intent
people tend to build a path in line with
security
right not everyone but some people right
i evolved from open source intelligence
into forensics challenges
uh and from their deputy style ctfs
um and then i got into stego and some
offensive stuff at
obviously an extremely basic level
and at a very slow pace from there you
know
formal plans evolve into things like
pain testing re-teaming social
engineering and forensics like i did
with me
right so this can lead down to
you know potentially a changing career
you know you're that i.t person or that
dev
that suddenly had an interest in this
you took a swing at
at trace labs or had some challenges and
you enjoyed what you did there
and then you evolved into something new
so now with with everything
you've learned you have added so uh you
have added many other skills
um and you are doing more technical work
but all the while you're using osint in
its many forms to add value to your new
and evolved career
okay so feed the supply
this will make sense shortly
right so going clean so you know this is
now you know you tried ocean
maybe the trace labs you did some
challenges and you just like well you
know this is dull this is boring
you know if you're an offensive security
specialist it's in probably not going to
be as exciting for you right you prefer
to you know sit behind a come online and
and do all your gucci stuff right but
you know at least there's some stuff you
can take from it
right so you gave it a shot you tried
and perhaps it's just it's just not for
you
and that's cool right you still gained
you know
no matter how in-depth you went you
still gained
a lot of experience and understanding
and operational security and personal
security
and that's always a value you've gained
a
different level of mindfulness by
understanding the risks and how
information can be strung together you
know it'll help you
be better equipped to make better
decisions related to what you post and
push out on the internet
ideally and you know if not any of that
you can just remember the good old days
you know i if i stop doing ocean now i
would always think about it i was
thinking about that one case
where we found this and we found that i
have some very fond memories from the
recent ctf
we did where we managed to track down
very
chance tracked on a location of someone
they've been missing for almost a year
and a half
um and you know those those bold
memories and i was like you know get
your first shell one day you know you
you tend to remember that shout out i
got my first shell thanks to toko that's
on on
axles
okay so you know you you you decided to
continue down your path with icing so
you didn't give up like the previous
slide you decided you know
where else can this go right so you can
go show and tell right tell your friends
and tell
your family about what you do and how
it will help them take better care when
they're posting information
right so my missus this talk somehow
inspired her and she's not starting to
learn more about
open intelligence right by telling your
friends and family you not only make
them aware but who knows maybe some of
them might have an interest in doing
this because of its ease of entry
right so keep that in mind right
understanding the entry
is now you know getting involved uh you
know it took a
it took a lot from me to take on an
ocean challenge and hacked the box
which then led me to trace labs which
led me on to more diverse etfs
all this has led me in a direction of a
career change so i hope yes i'm a
recruiting now
but i hope to be a digital forensics
consultant one day or you know do cyber
threat intelligence or something down
that line
right by understanding the ease of entry
you may be more inclined to take your
first shot
or challenge uh a ctf
right so it took me
touching ocean to want to dub my toes
into things like jpd style cts
because everyone else is doing stuff i
smashed all the ocean challenges and i
was like you know what
let's look at forensics and once i sold
one forensics challenge
thanks to google you know i was like you
know i can do forensics and let me let
me learn more about this
let me take it and that's now evolved
into a complete career change
right so the evolution so walk the path
that ocean takes you it might lead you
uh to just being more mindful and more
aware it could lead you down a path into
information security
right so take away and and summary
right get involved with open source
intelligence in whatever form
you're probably doing it already if we
know it's like you know if you
dating online you're always going to try
fine
but inflation to find out if they're
crazy or not right
a lot of us are doing it without being
away um maybe this talk just helps you
label that and
that's fine but you know see where it
takes you and and try it out come
come join us on on hacksaws and do some
challenges on on act the box
come join us for chase labs you know
there's no more challenges this year
but this but next year i plan to win it
and i will win it right so come join us
um i know like the vet that's on here he
works in the legal space he has
very little understanding about
information security but
he he had he built an interest in osint
and
he took part with us and me and him have
done well with that you know with him
and the rest of the teammates
with him i've come seventh and and
seventh and third globally with trace
lab so don't be
don't be adverse to to to walking down
that path
right if you're scared remind yourself
of the ease of entry and take a swing
so this talk might necessarily be that
well catered to
you know advanced offset or offensive
security people
but it's there to help inspire everyone
and and and have a try at it like we try
other challenges
on a ctf that we have no understanding
of right it's
it's it's it's a new skill to learn okay
remember the rule
uh the rules of engagement remember zero
touch
try use stock accounts or alternative
accounts um
use a vpn uh try stay as as secure as
you can and be
mindful of that which you might find
along the path
as i said earlier tell your friends tell
your family and tell your colleagues
about open source intelligence
some people love it it's good sometimes
that are bright it's pretty good
conversation starter in showing people
what you can find with them you know
doing a typical thing like asking
someone's email address or scratching
around trying to find the emojis you
find the email address
you put in have i been phoned and then
you explain to them you know
what it means when the email address has
been in like four different breaches
which is something i
i had recently happened at a bride um
taking all that can show people how
vulnerable they are and will make them
more mindful
and also might interest them and you
know what better way to defend
yourself and then up skill and and and
learn from the best
okay follow the path that ocean takes
you whether
whether it takes you down just a simple
doing the ctf side
or whether it takes you on a path into
information security
see where it takes you and and and
follow that road
right if you like it keep learning and
evolve your skills
i i am very good at basic oceans i don't
use
any tools really um you know and that's
this kind of thing is like a vm and
stock accounts
there's a lot of good tools out there
and that's what i plan to use to sharpen
my skills
but it's pretty straightforward stuff
you just gotta understand what to look
at
and what pause to walk down right and
if you if you evolve with that you can
get better and you can evolve into other
new things
yeah and i'll say yeah learn new things
so
i am trying to work i am i'm not very
good at geospatial intelligence so
finding places on a map i'm really bad
at that
um but i'm trying to work on that so one
thing i'm focusing on now
is getting better at triangulating where
a photo is taken
and trying to identify where a location
is purely based on
a photo so yeah learn new things and
this is typical of of this industry
we're always required to learn learn fun
and interesting
new things my links attributions are the
only thing i took idea was from
wikipedia and obviously there's a lot of
giffy gifts on here
right so a quick one about hack south
obviously it's a server that we're
hosting the con on this year um please
be sure to follow us on twitter
we're on linkedin as well uh
if you want any cool roles we've got a
bunch of reaction roles
if you've got a role assignment you can
get some new stuff there
and come join our team on ctf time uh
this is actually the list of the cts
we've done so far this year
so as you can see we're quite active
it's usually the usual faces in the cts
but we'll have to have more people join
us
thanks i'll take some questions on
discord
and here are my socials thank you very
much