PG - Applied OSINT: Enabling Better Social Engineering for Better Pen Tests - Joe Gray

all right sorry about that so again you're drawing it from publicly available sources sometimes you may have to pay for some of these sources for access to some of these sources but it's still publicly available so where can you get it where can you gather oh send and wouldn't you know that my clicker is taking a nosedive so where can you get a cent I like to get it in bars malls restaurants there's a Thai restaurant I go to a Knoxville and I always like to sit in the section by the bar because there's this giant pillar with little portholes in it I've heard some crazy business stories about problems they're facing I was like

you really you're saying this publicly right I could easily use this against you later but I just stay in creeper mode and don't say a word family and friends I mean who here has a mom with a Facebook account that over shares all the time it's like don't put that picture up and they'll do it or die every time job boards I mean are you going to burn a windows exploit on a Linux system no how do you prevent this aside from fingerprinting save yourself some time and look at their job boards because they're probably going to tell you some of the technologies that they do use in the description social media of course and then my personal favorite

back windshields with back windshields so what can we see here dad he either works out or he likes to think he works out he's a real gym rat mom's a teacher John was old enough to be on a competitive soccer team I mean if you want to get in with Neal just wear a Thrasher shirt to a skate park you might be alright Jessica's kind of a curve ball because you don't know if she's old enough to like babysit herself and then beaker and Ruby they they throw some loops as well because when you're looking at profiling the house are the dogs going to bark how big are the dogs are they vicious what so with this it's just a harmless

sticker right so I went on an exploration in eastern Tennessee to find the best Oh scent that the public could provide here's some more so what can we tell from this they have Shelties so there's a ye upper they think on the right we we see that they like snow white and they think they're grumpy and they've got a lot of kids so just based upon that here's another one so again a lot of kids some pets so this has become such a habit that basically I have to keep my phone almost I joked that I should put in the trunk of my car because I'll swerve trying to take these pictures so don't try it at home but so

with a scent what what are the aims and the goals that we have so you know everyone here can appreciate a good meme right so erm occurred collector or the derp derp so you're gonna collect it all but you have to make it meaningful and that's why we have the underpants gnomes because a lot of times today you hear people talk about collect the data and do something with the data but they don't know the middle of it so if you think back to the South Park underpants gnomes it was step one collect the underpants step two step three profit so what is step two I like social engineering for step two with this you've got you've got

to really think about the timing of it if you do it too fast you could make mistakes if you're doing it in a very high-risk environment you get out yourself if you're just doing it to be a creeper or as part of say a pen test you probably want to go slow in the Navy we had a philosophy that slow is fast that didn't mean movement the speed of maternal when you're lining up a ventilation system because there's a fire that means take your time be methodical about it and try to avoid making mistakes don't rush through things so I still use that same mentality because with it you might find that one little shred that you would not

have found if you were rushing if you just take your time and explore all sources so the details are key with this because personally what I'm when I'm dealing with oh oh scent I'm typically doing it as part of a social engineering engagement and with that I need something to build that profile around the person so anything to appeal to that person which I'll kind of get into here in a minute and by a minute I mean right here so it deals with human psychology other sent deals with the nature of oversharing the nature of things being publicly available where social engineering places the six principles of persuasion and with it as I was starting to say it

provides better context for the contact you're not going to go in taking a knife to a gunfight so to speak to give you an example I was doing a pretexting engagement for work and we were given a list of ten targets and told to pick two so I immediately went to social media one of them I found out he was a single dad he was having some baby mama drama so when he got the phone call because this was a finance institution when he got the call the sound of Walmart and babies crying well a baby crying was in the background we were trying to appeal to his emotions he stuck to his guns but

the other one she she was like an O sent a gold mine I know when she got married I know who she got married to where she got married who her photographer was where she eats lunch every day I'll give you a hint it's chick-fil-a the nice the nickname that her nieces have for her and then her husband's favorite sports teams unfortunately for us fortunately for her when we called her she didn't answer she must've been at chick-fil-a I don't know but either way she didn't answer but had she answered we had enough stuff to where we could reasonably say we need to get this done so that we we were going to going to go

to Indianapolis that weekend because the Titans were playing the Colts he was a Titans fan so we were trying to employ urgency to be able to say we need to get this done to our account so that we can have access to it because we've got to get we've got to get out of town the the female on the call was going to be like I need to plan my wedding I'm meeting my mother-in-law we'd just complete honed into everything but again she didn't answer so in that vein you all want to see a little demo everybody like Facebook Facebook's beautiful Facebook is beautiful so right here who is who is familiar with the Facebook live map if

you aren't you should be because right here we could see anyone who is public on Facebook live we can actually spy on blackhat right now because their keynote is on Facebook live but anyway so what we'll do is we'll hone in here you've got the the bubble style heat maps see what this is

what's she talking about I'll make up tutorial oh man I love me some makeup tutorials because everybody everybody does makeup tutorials but anyway so here we've got it going live take note of this right here this is actually the Facebook live ID for this her husband knows everything so okay everyone's heard of Michael basil and Intel techniques right okay good so on his website he has a set of tools and you go here to Facebook I mean what could possibly go wrong right now right not much so right here we go to video data and select all okay come on load don't throw me now so okay we see all this stuff what does this mean well remember that

ID oh look here and look what's right beside it latitude and longitude what could possibly go wrong right but remember this is a feature not a vulnerability and I got to cut some of this here out Oh what do we have here oh she's next to the container park oh hey there goo how are you doing bloop it only works with the sound effect what do we have here so apparently her husband's not allowed to park on the yard they have a Ford Focus they have a whatever this thing is Land Cruiser thank you thank you and then you know a lot of construction but you thinking a lot of really good sleep at night with all this construction but

sleeping in is a challenge for them but this is just one example of what you could do with ascent the only thing I had to do the only thing that I really had to do to accomplish this was log into Facebook and I just created a dummy account that has no friends to do this so in that sense I mean why would you do that right why would you why would you willingly give up this information well it's because you're just not aware so definitely be cognizant of that Google Maps or the geolocation itself that was Intel techniques dot-com

well it was an assumption but in that same regard just to take a little time and actually go over it briefly in the interest of time basically Michael Boswell authored the open-source intelligence techniques book he created this site you can do several things it's very similar to Justin nor Dean's assent framework calm but it's a little bit more centralized where you can take something like a real name a user name an email address a phone number Facebook Twitter information and you could do all sorts of things so here on the Facebook one will just kind of browse it once I can get my cursor back over and then with it you can look at where they

visited where they checked in who they liked apps used videos posts tagged like employers and then right here you can actually see common details between two users common places for inspire location and so on so there's just a lot of information here and this is just based on focused queries of Facebook you can do very similar things with Twitter basically you can do it from the command line or the user interface from the command line you typically have to have an API key which Twitter it's ridiculously easy to get API keys Facebook's a little bit harder but it's still doable you're welcome so back into the presentation so most ascent it starts with a single

piece of information it could be a name an email address a business an example of such I heard a story of some incident response in the past a few weeks where someone had went in and there was there was a suspicion of insider threat but then the contact at the business approached the incident responder and said I got this ransom note but it looks absolutely bogus is this legitimate well a quick search of the email address and yes it was a leader ransomware so and 36 hours had passed so bye-bye to your files so that would be an easy way to validate that it says hey email this e-mail address validated see what else is coming up where where is this

information also located so physical addresses that can be used Josh Huff last year at Derby con he did a lot of amazing things with an image of a gas price because what he did is he actually looked at the reflection and saw the vehicle that was in it and through some research he was actually able to enumerate the color the make and the model just based on the reflection because somebody was bragging about gas prices so if we want to pull the yarn a little more you know every time I think of this I always think of Weezer's undone the sweater song you know you're gonna just going to pull the string as we walk

a password dumps have I been poned it's a great place there used to be a slightly unethical website called bleep source for $4 you could find out all the passwords that you could consume in a day but it's in swim by bike social media again the moms that over share everything email accounts of course because email accounts are tied to things sometimes you can search by email account I was running open source intelligence against a friend just in preparation for this week and I was like hey are you still selling this on Etsy what what are you talking I don't have an Etsy are you sure yeah I'm sure screenshot here we go you oh forgot about that yeah you did

public records I mean arrest records court records something to that effect I had some friends that had some public judgements against them and boy are they getting spammed right now and there's nothing you can do about it because it's out there the news I mean it's just one of those things blogs you have to have if you want a public image to any degree even just speaking at a conference you've got to have some sort of public image and then that you're going to have to sacrifice some of some of your own privacy in the regard if you're going to go that route I mean I can provide you burner emails I can provide burner phone

numbers but at the same time here's my face here's my name so keep that in mind SEC filings that's a good place as well SEC Form 10-k is one of my absolute favorites because you can find out how the business is doing you can find out some of the things the business has been struggling with or what the business is looking at for the future SEC Form 10-k any publicly treated company has to produce it so publicly traded company in the US rather so is this once and done and the answer is no it's one of those things you need to take the time refine it and do whatever you need to do to keep getting more information you might

be at the end of your rope you might be about to say I have found everything I can find you find that one username and then you back through and there's the keys to the kingdom I'm sure Micah Hoffman up here could actually enumerate that or speak to that at some point but you know it's one of those things that you've just got to take the time to look a lot of times it's there in plain sight sometimes when I'm running the operation I'll see stuff on some of those paid websites and I won't click it but I'll be like hey that was a Facebook account let's take a look ooh image search where does this image exist so earlier I

mentioned in social engineering the six principles of persuasion take a moment and think about the last time you bought a used car or you were at some big-box retailer about to buy a TV with a car Oh some guy just left here he really wants it he said he was gonna go to the bank and come back with financing but if you'll do it now I'll give you five hundred dollars off right I'm gonna stay here and wait for this dude to come back first if that dude comes back I'll pay you five hundred dollars more or with the TV all the cool kids have those curved TVs now don't you want a 3d TV I

mean there's not a lot of 3d movies out right now but YouTube has a pretty awesome 3d video of a butterfly flying around reciprocity you scratch my back I scratch yours authority when you see those ransomware domains or ransomware demands that say the FBI that that's playing to the authority and then of course likability it's like you know I'm just a good guy man buy this car from you I've got to feed my kids sorry I hate to be mean but if this is how you're going to feed your children if you cannot provide for them perhaps you should look at another career just being honest so with that we apply these principles to fishing fishing whatever

impersonation why do we do this well I guess gave in the example before if you know enough about your target you can play to their emotions you can you can understand enough about them you can kind of get in their head and be able to say you know it's just a shame that that happened let-let's let's take a stand against it whatever something to that effect it's very simple so a quick story actually about a fishing engagement I did recently so there was a company that wanted to get fished and they they did not want something out of the box like fish me or go fish or something like that so I was like okay I'll do it let's

do some open source intelligence first let me see what I can find well the CEO was retiring the next week the CEO was taking over a quick email got his out of office so I got a signature line there from there I bought the dot us to their calm I bought a Google domain got a digitalocean droplet and he was let's encrypt so at this point I've spent about 20 bucks we cloned Survey Monkey we put their logo on it I write up a well-crafted email to the tone of the CEO thanking the employees as part of the team for doing all the great things that they do and then I sent it out with a link using

bitly flag number one I had 150 targets I decided to go low and slow I was trying to avoid any filters and I got shut down three and a half hours in not before I got 85 emails out I got about eight out of office replies 17 usernames 18 passwords 17 sets of password reset questions all because I took the time to find out that their CEO was taking over for the CEO and put together an email and actually quoted the CEO in the email based on a press release that it came out three weeks prior because I took the time I had the credibility to get the fish and it was very simple no heart no big deal so I'm

gonna go a little bit out of order here any questions and then I'll tell you how to contact me yes sir do I do mentoring Caroline do I do mentoring yes I'll give you a card afterwards so actually she's one of my mentees we did some data carving for up beside Cincinnati earlier this year so I take a very active stance in mentoring just because when I first started out in industry I had a few people to take an active interest in my success and I believe wholeheartedly and paying it forward so any other questions all right so I've got some I'm sorry was there a question all right so as all good talks exist I might have some goodies and buy

goodies I mean giveaways because we all like free stuff right so we have Christopher head and Aggies social engineering and we have Michael Basil's Intel techniques so trivia time let's see here first person to raise their hand with a principle of persuasion yes reciprocity take your pick these books are courtesy of sword and shield is that when you want or do you want the other I'll take this one cool oh well if you have both in okay cool next question this is for open source techniques as if I had enough hit the keyboard

just getting caught up here alright so hmm where can you find a boat scent first-person internet be more specific here we go so social networking absolutely so within the books I've included my business card from my podcast and all of that fun stuff there's no cool NSA sticker it is a monitor device so that's in there as well but aside from that it's really about all I have if you want to follow me on Twitter I'm at sea underscore 3pg oh I'm on LinkedIn so again sword and shield if you're interested in that to contacts Norton shield this is the obligated part if you want to talk to them about working or something secure me at sword shield comm we are hiring

but we're looking mostly for people in the Tennessee area we don't really have the remote presence yet but it's definitely something that's going to come eventually so any other questions I think we're out of time thanks [Applause] [Music] [Applause]