No more secrets Marty

1. Your life online: No more secrets Marty

2. Introduction • Roelof Temmingh (roelof@paterva.com) • Just Google • Not the classical music crowd (but family) Paterva / Maltego? • Just Google • www.paterva.com • CE version is free for non-commercial use • Be sure to check out the TDS – to extend Maltego capabilities and share transforms

3. Agenda • Introduction – what is Maltego really? • Stalking – a case study • An evil government could... • Counter Intelligence • Prevention • Detection • Who are you anyway?

4. Maltego introduction • Web browser is a tool to navigate web pages • Web sites are connected by hyper links • Links are ‘man made’ • Can we build a tool to navigate chunks of information? • Links could be • Rigid - man made • Flexible - implied • Links are determined in real time by software / plugins / transforms

5. Stop the Zen right now! Example (rigid / man made): • DNS Name -> IP Address • Mail.abc.com -> 100.100.100.100 • The ‘link’ here is DNS Example (implied / fuzzy): • Telephone number -> Email address • 202 555 1234 -> dave@domain.com • The ‘link’ here is some webpage where these are mentioned in close proximity • No context, no certainty • Very fuzzy like

6. Maltego concepts... • Entities: ‘things’ • DNS Name / Person / Phone number / more... • Can be extended with custom entities • Transforms: convert data types • DNS resolving / Searching / Database access / Deep web • Can be extended with TDS / local transforms Why is this really cool? • What are the private email addresses of people working at XXX agency? How? • Assume all phone numbers for agency starts with the same digits • Someone that gave out work number and their private email address – that appears in the same snippet

7. Man & Machine • Machines are good at automation • Transforms • Humans are good at pattern recognition • Visualization and Graphs • Let’s work together • Maltego

8. Google network* * Only a small part of it

9. Live demo Let me show you how... Please stop me if I spend too much time on this slide There are still 30 slides to go...

10. No kidding...for real !

11. Case Study • Given name and email address • Name is common, email address at Gmail • No references to email address on the web • Name too common to search for • Email address used on LinkedIn, high ranking military official • Email address also on Facebook, but completely closed profile • Email address used in the past with Flickr (thnxRapleaf) • Flickr profile has NO info, photos, only an alias • But alias is very unique • Alias hits on 2 porn sites – one has DOB, corresponds in year to LinkedIn info, but no other information • Other has very compromising photos • User’s photo is blurred • Seems unlikely, so have to be verified with other information

13. Case Study Profiling took 7 hours Profile: • Full names (x 5) • Work and private email addresses • Physical location • Work and education history (x 2) • Phone numbers – both work, home and mobile • I.M. Details • Children names, hobbies, interests • Photos of all • Friend lists Why would we want a profile? And what’s next?

14. When worlds collide

15. Digital but not online • Things you own • Property (public, commercial) • Transport (car, bike, boat, plane) • Money - bank account(s) • Things you use • Internet (proxy logs, RADIUS logs from ISPs) • Mobile phones (CDR), fixed line • Credit card, ATMs • Utilities (water, power etc.) • Travel info – passports • Things you are • Director, member of trust • Records • Major retail details • Criminal / court • Education • Tax • ID number

16. An evil government could... • Have to assume that .gov has all of the above information • Gets scary when combining real world with cyber world • No concept of ID number on the Internet • Mostly linked to email address • Can hope for phone number but unlikely • What can they do? • Example 1: Geo location to social net • Example 2: Tracking forum members

17. Demo (video)

18. Challenges we suspect they may have • Format of data across tables • 083 448 6996 != (0)83448 6996 • Temmingh R != RW Temmingh • Typos, bad captures • Multiple email addresses • roelof@paterva.com • benbrand@gmail.com • Scaling the solution with new sources • E2 – E problem • Cool problems to solve here..

19. Use it to your advantage! • Entering your details in (digital) forms • 44B vs 44b vs 4 4 b vs 44 B • 0834486996 vs 083 448 6996 vs 08344869961 • Roeloftemminghvsroelof.temmingh • Catch all addresses • Roelof-govform1@myowndomain.com • For non-digital forms • Write like your doctor

21. Preventing data mining • Infrastructure / networks: • Use generic address to register domains or use domain registration services • Keep your fwd DNS zone as generic as possible • Make sure you control zone transfers! • Keep your rev DNS zone as clean as possible. • Keep as much away from your real network - NS/MX/www

22. Preventing data mining • Photos • Reverse image search is possible (TinEye) so don’t share photos • Getting tagged on other people’s photos! • Don’t geo tag photos • Beware of identifiable objects (car, bike, house, office, logos) in photos • EXIF info on photos • Email addresses • May not be used outside organization - policy • Don’t use firstname.lastname when registering (I.M. too) • Make sure your mail server does not allow verifying (!VRFY!) • Keep your email address off PGP key rings

23. Preventing data mining • Websites/blogs • Links to your site, links from your site • No staff lists, internal phone lists, email list • Use generic email addresses for things like sales/info • Also consider generic addresses for domain registration • Keep XLS, DOCs away from the site (duh) • All in PDF. Clean meta information ! • Robots.txt / sitemap.xls (?) • Javascript phone numbers and email addresses or make them images

24. Preventing data mining • Phone numbers • Use a generic number for office, never direct lines • Don’t answer your phone with your name • Listing of company phone numbers on public sites (ads) • Javascript or image phone numbers where possible • Common sense • Friends and family is your weakest link • Never mention your DOB online / star sign • Bios, interviews and videos – ‘Jane said...’ Everything ends up on the ‘net. • Be careful with who you leave your CV • Don’t use unique aliases • Guest books and blog comments • Do them a favor and name your children ‘Bob’ and ‘Mary’

25. Detecting data mining • Infrastructure • Monitor your DNS servers for signs of brute force / zone transfers • Check your web server logs for mirroring & look at User Agents • Inspect the referrers in your web server logs for referral from search engines...and the search term.

26. Detecting data mining • Personal • How do I know if someone has a Google alert on me? • Setting up fake blogs, social network profiles • With CAPTCHAs and email alerts • Cannot make the jump too obvious • Perfect place for counter intelligence • Referrer • IP address • User Agent • Browser exploits ? • Analytics on websites, blogs • Listing ‘red’ phone numbers on 2nd jumps.

27. Think outside the box • How do I know when people Google for something? • I run a super secret project called Sookah. • I don't ever want people to know about it. • When someone search for the word Sookah I want to know it leaked out somehow • I don't want them to find out that I know I register an Adword...isn't Google wonderful?

30. Trick question • Which is better: • No Internet profile at all / Closed profile • Open, Full blown Internet profile? • None / closed == open for impersonation • Open / Full == open for stalking • Impersonation • Competing with real person • Complete new, fake • Easy, ask Robin Sage

31. The Curious case of Eugene Eugene Gregoria Location: Singapore Industry: Telecommunications Employer: Pacnet (formerly Asia Netcom) • Last Facebook status: On basketball: 'I liked the choreography, but I didn't care for the costumes.' ~Tommy Tune, on why he never considered playing basketball • Last 2 Tweets: • German school reports 30 cases of A/H1N1 flu [link] • I saw this nice web site on poker called "Bill's Poker Blog" [link] • Blog: I like watching western movies. We watched 'Giant' directed by George Stevens. I really enjoyed it. I found this really interesting: It was the highest grossing film in Warner Bros. history until the release of Superman (1978).

32. WYSIWYG? Not always... Investigator /target will follow the crumbs… …but nothing is real on the Internet (Eugene is made up from many different people, algorithms, headlines and snippets from the Internet)

33. 2 of 2:fakes ;

34. Mandatory ‘Profound’ quote “If we assume that only a small percentage of the Internet consists of unique information then creating acceptable content and human-like behavior becomes no more than a complex copy and paste process. If we acknowledge the existence of a single fake identity on the Internet an entire automated community should soon be within our reach. “

35. How to make friends and... • So what’s the big deal? • Manipulate ratings of anything • Sway public opinion • Influence political polls • Alter stock prices – directly or indirectly • Perform social denial of service Keep in mind that people are flock animals – you just need to be the initial catalyst and get critical mass

36. Thus in conclusion • The gap between the real world and the online world is closing every minute... • ...So is the gap between your online profile and your actual life • Information itself is a vulnerability • Network->OS->Application->Information->People • It feels like the 90s again! • Think of the children...

37. Questions? Eric (the iPhone guy) threaten me already so let’s grab a beer / coffee..