Are you familiar with open source Intelligence otherwise known as OSINT? 2 2
If that is not a familiarized term with you then you should stick around. 3 3
Cuz we're having that conversation starting right now. 4 4
>> You're watching ITProTV. 5 5
[MUSIC] 6 6
>> Welcome back to Security Plus here at ITProTV. 7 7
Today is OSINT day and if you're going, what the heck is OSINT? 8 8
Well then you've come to the right place cuz we will be talking and 9 9
discussing about that very thing. 10 10
And I'll go ahead and just throw it out there, OSINT stands for 11 11
open source intelligence. 12 12
And that is where I'm gonna leave it because we have Wes here. 13 13
Who's gonna actually get us into the weeds of this thing. 14 14
Explain the usefulness of OSINT, why we do it, what it is. 15 15
So let's start there if we could. 16 16
>> Absolutely. >> What the heck do we mean when we're 17 17
talking about OSINT? 18 18
Why is that important? 19 19
>> Sure, well, its basically when you talk about open source threat intelligence. 20 20
Let's step back from that definition and 21 21
just really talk about threat intel for a second. 22 22
What is threat intelligence, all right? 23 23
Well, when we look at threat intelligence, we can define it a couple different ways. 24 24
But this is the one that I'm gonna use. 25 25
The gathering and analyzing of data to basically identify threats, right. 26 26
Whether those threats are potential threats or actual, realized threats. 27 27
We should know about a threat intelligence and 28 28
be able to just define it and understand what it is for the exam. 29 29
So, if that is what threat intelligence, 30 30
then well what is open source threat intelligence, all right? 31 31
Well, this is data that essentially is available to the public. 32 32
Want you to think of it this way, right. 33 33
If I sat down at a Google search engine right now. 34 34
We always joke around, we say, I got googs right. 35 35
I'm gonna sit out here with the Google search engine and I'm going to look for 36 36
information on a company. 37 37
What might I find? 38 38
What is not behind a lock and key? 39 39
Let's say, sensitive private information that really is stuff that is encrypted, 40 40
probably under some compliance regulations. 41 41
But, what is out there in the wild? 42 42
>> So when we're using the term open source. 43 43
A lot of people, probably, if you've been in the IT industry for any amount of time. 44 44
You think open source, 45 45
you think of code that is open that runs on a program of some sort. 46 46
You're able to modify it and change it. 47 47
But here we mean just that publicly available- 48 48
>> Out in the wild. 49 49
>> Is the idea when we say open source. 50 50
>> That's exactly it. 51 51
So just think about any company information that is made public, right. 52 52
And to kind of build on what Dan was saying. 53 53
Not only do we have to think about it as information that's made public when we 54 54
talk open source. 55 55
It's like Dad said, might not be exactly what you think, right. 56 56
Some people that have been around the term open source for a while in time, 57 57
might think of something like the GPL, right. 58 58
GNU Public Licensing, free software when we talk open source. 59 59
That's not where we're talking about. 60 60
Dan pretty much explained it, rightfully so, open as in available to the public. 61 61
Think about this, think of it as a threat actor. 62 62
And let's just be clear here that security professionals use this, so 63 63
do threat actors. 64 64
But think about it, what are you serving up to the attackers out there. 65 65
What information in your company are you just saying, hey, it's out there, 66 66
go find it, alright. 67 67
That essentially is what open source intelligence is. 68 68
>> Yeah, it's kind of a good precursor to 69 69
the conversation of why it's important for us to classify information. 70 70
Have we vetted what is available to the open public? 71 71
Because if we haven't, there might be some things that we would normally 72 72
deemed sensitive that has found its way out into the public sphere. 73 73
And we wouldn't want this. 74 74
So it's always a good idea to try to classify all your information before it 75 75
becomes a public resource. 76 76
Now let's move on. 77 77
We talked about OSINT and we talked about open source. 78 78
Can you give us some resource examples of what we might be talking about? 79 79
Just to give us maybe some legs on this. 80 80
>> Most definitely, 81 81
one of the first ones I think about, some of the examples that we have here. 82 82
If you think about, well, news media, right. 83 83
News media is not the only source but it's definitely one of the major sources for 84 84
open source intelligence, right. 85 85
We think not only news media, things like census information, right. 86 86
Information that if I requested it, could be made publicly available to me, right. 87 87
Things like conferences and webinars, not only conferences and 88 88
webinars, things like supplier websites. 89 89
And again, these are just some examples, 90 90
there are a lot more than what we just put in this list. 91 91
But it will hopefully give you an idea of where the security professionals and 92 92
the threat actors essentially can find that information. 93 93
Things like phone numbers, email searches, right. 94 94
Think about phishing scams. 95 95
If you've got a public email database, right. 96 96
Where we can find, this is your email address, right. 97 97
In fact, we were talking about legal counsel for 98 98
another company at a board meeting I was at. 99 99
And one of the things they said is hey, has anybody got that person's email? 100 100
And I'm not gonna, Email here and I said well, 101 101
wait a second here let me just pull out Google. 102 102
I pulled out Google and sure they were the chief legal counsel for 103 103
this company an I could find their email just in a Google search. 104 104
So that will kind of give you some examples of where you could 105 105
potentially find some of this information. 106 106
Remember these are just a small sampling of the locations where you can 107 107
actually pull that information. 108 108
Yeah, I like how you pointed out the idea of this isn't only used by threat actors, 109 109
but it's also used by security analysts and engineers and professionals to say, 110 110
if I were acting in this way, how would I use this information? 111 111
So really good that you pointed out. 112 112
Now that being said, let's talk about some maybe examples. 113 113
>> Yeah. >> That's what we could do with an open 114 114
source intelligence. 115 115
How do we use this? 116 116
Yeah, definitely. 117 117
So, like we talked about, remember two people and will come back to this. 118 118
Both sides of the tracks can use this, but if we look at it, 119 119
why would we use this right? 120 120
We wanna find out what is the information that's being available. 121 121
You can use it for things like external threats. 122 122
We've talked about, am I leaking information out of my company? 123 123
Company that information that should be sensitive an should be kept under lock and 124 124
key, and I say that just meaning probably some encryption. 125 125
Only authorized user should see this. 126 126
Well, we could find that there is a potential for or 127 127
already existing data links or leak excuse me, not links, data leaks. 128 128
The other thing the real good thing your security professionals is it can help them 129 129
to increase things like your defense strategies as well too. 130 130
Now I will kind of build on what Dan said here. 131 131
We always have to remember this is a double edged sword, right? 132 132
We're gonna show you some examples of some utilities that you can use it, but 133 133
if we've got access to this, guess what? 134 134
Not only do your security professionals have access to it? 135 135
Those well groomed hoodeid attack or threat actors also how bad handsome man. 136 136
>> That's absolutely it. 137 137
I guess it's a requirement right? 138 138
Maybe a hoodie in the beer. 139 139
[LAUGH] >> You'll see the Corvette drivers 140 140
uniform? 141 141
>> No. [LAUGH] >> This is like an guy with white tennis shoes and 142 142
Bermuda shorts and it's funny. 143 143
>> Perfect, all right so Don those you know those are some of the concepts 144 144
when it comes to OS Intel that we really got to be aware of being where some 145 145
of the characteristics and be aware of, what it is that it could be used. 146 146
>> And you're gonna give us some examples of this? 147 147
>> Absolutely yes. 148 148
Yeah, I'm glad I'm glad you're keeping me honest here. 149 149
So some of the tools we have for instance, 150 150
some of the OSINT tools that we have Maltego is one of them that's out there. 151 151
We'll kind of just open up the interface here and show you it's a very, 152 152
very robust platform. 153 153
You don't have to know how to work and configure Maltego for 154 154
this exam, but I would be aware that it is an open source Intel based 155 155
tool that is in Cali not only Cali Lennox. 156 156
Remember it's supported out to things like Windows or 157 157
even got one installed here on Mac so its cross platform. 158 158
Other tools to the recon-ng is another one so 159 159
one is a graphical user interface that's Maltego here. 160 160
The other one is CLI based, so that's going to be command line or terminal only. 161 161
And then some public websites, for instance, just to give you some examples. 162 162
It's kind of interesting too that both of these utilities up here at the top. 163 163
If you get an API key to, you load that in things like showdan.io and Censys.io. 164 164
These will actually be, scraped if you will buy these open source 165 165
Intel tools Maltego and, I was always want to say recon-ng. 166 166
>> [LAUGH] Recon-ng. 167 167
>> I've got it in my mind that that's how you say that it's recon-ng, so 168 168
those are some of the tools that we need to be aware of for the exam. 169 169
>> So let's take one of these tools that you just explain to us how about Maltego 170 170
could we maybe take a look at that? 171 171
>> Definitely, so here on our again, I'm using this on Kali, keeping my Kali Linux. 172 172
You can get this for Windows. 173 173
You can get even a DMG package if you want, if you're running Max. 174 174
So up here we're just gonna go to the what would be their start button drop down 175 175
application locker. 176 176
I guess you would say. 177 177
And then in information gathering you'll see that you've got a few and 178 178
you can see the recon-ng, I'm not gonna be able to say it. 179 179
And then maltego here. 180 180
>> I want to colored objects so bad. 181 181
>> [LAUGH] >> Every time. 182 182
>> That's right. 183 183
So if we go ahead will launch up maltego. 184 184
This is registration based and they have a paid version but 185 185
they also have a community version which is the one that I've logged into. 186 186
You do have to do a registration boy man, speaking is a kind of difficult here. 187 187
But she could see essentially a graphical user interface here and 188 188
it gives you access to a whole bunch of different information. 189 189
Again, you could set this up. 190 190
It doesn't look like I have any feed set up here, but that's essentially 191 191
it's a graphical user interface and it's an OS or an OSINT tool to be aware of. 192 192
If I go ahead and I'll just cancel this one down Shut it down, 193 193
we could go back into information gathering here, and 194 194
there's also the Recon-ng, finally got it right. 195 195
Didn't took a little to admit it time. 196 196
You'll notice that there are a whole bunch of red lines here. 197 197
Errors, errors, errors, errors, that's to be expected, 198 198
especially if it's the first time you've launched it up. 199 199
What it's doing is it's looking for API keys and you need to 200 200
download API keys to, like for instance being LinkedIn, Twitter, I could show you. 201 201
In fact, if I do a keys list, I believe I've got a Google API key here. 202 202
Yep, so again, >> I have a Google API key. 203 203
>> Now you have a Google API key that's right and 204 204
you could see a whole bunch of different keys here. 205 205
And again, this would just be the command line OS or 206 206
a OSINT tool that I would definitely be aware of. 207 207
Last a couple of ones that we've got here Censys. 208 208
Here's one, and again, this can show you a lot 209 209
of information about devices that are connected directly to the Internet. 210 210
Shodan is another one. 211 211
Same thing here, you can search a major showdown list here and 212 212
again look for all different kinds of devices that are connected to the Internet 213 213
as well other things to. 214 214
For instance, icann you can do The Who is look up. 215 215
So for instance you can see this is all public information by the way and 216 216
I just did a Facebook look up here and of course not for any malicious reasons. 217 217
But you can see things like their nameservers, right? 218 218
If we were doing DNS poisoning now these are probably huge server farms. 219 219
Don't let that one little name fool you, but 220 220
you could see registry expiration information. 221 221
You could get a lot of information that's publicly out there in a while 222 222
if you know where to search. 223 223
And these are some examples of where you could go 224 224
if you were performing the open source intelligence gathering. 225 225
>> All right, well there you go. 226 226
Open source intelligence. 227 227
Now we've dispelled any kind of understanding or 228 228
misunderstanding that we might have when we use that term open source. 229 229
And what we're doing, 230 230
we're just trying to gather that information that's publicly available. 231 231
So that we can properly profile our organizations for 232 232
the purposes of either offensive security or defensive security. 233 233
Either way you slice it, it's a really good way to go. So there you go. 234 234
Hopefully that helps you out. 235 235
We have more in security plus. 236 236
Just comments for us in this episode we are out of time and out of material, so 237 237
we have to give move on to the next thing and we will see you guys next time. 238 238
>> Thank you for watching ITPROTV. 239 239
[MUSIC]