I'd like to invite Shane on stage to talk about, you know, give us direction in terms of
open-source intelligence. Thank you.
Mic handoff. That was good. You were all worried about it. Performance anxiety, right?
Thank you. All right. Let's see if this works. Because I am cursed with displays not working at
the worst possible time. Everybody, send your good karma to this machine. All right. No
looking. Whoo! What the? All right. All right. All right. All right. All right. All right.
All right. Here we go. Interview. You guys can't see all of the horrible notes I have. So...
my name is Shane McDougal. Yeah, I kind of changed the title of the speech. I'm sorry about that.
This keynote was kind of kicking my ass. Because I was thinking about, you know, talking about the
future of OSINT. And it's like, you know, where we're at right now is really fluid. I mean, talking
long term about where we're going to be is kind of a fool's errand. That said, I still am a
a fool and try to do it at some point in the presentation. But I want to talk about three
different things that I think are really key to the field of open source intelligence and
reconnaissance in general. So seeing is believing and the future of recon and you won't believe
what happens next all kind of tie together in a little bit. So the standard disclosure
right off the bat, this presentation and the ideas and the comments herein are those of
mine and only mine. They don't represent my employers or my clients, even though they should,
right? I mean, if the clients knew what was good for them, they would agree with me. But
managers, right? They were born to disagree. So a little bit about me. I've been a pen
tester since 1989. Spent the first half of my career being a person that attacked systems. I've
spent the second half of my career on the defense side. These days, I've been in the
military. I work on the threat intelligence part of the corporate networks. I work for a major
video gaming company. And most of my days are spent building and writing tools to harvest open
source intelligence data that can help my company identify attackers and that sort of thing. As my
gracious hosts mentioned, I do have two black badges from DEF CON by winning the social engineering
capture the flag.
And I mean, I don't want to sound like a bragger, but it's important to say I'm also the only guy to ever get 100% score in that contest. And I want to stress, you know, not to brag about that, but I completely attribute this, you know, my two successes to, I mean, not completely, but a huge chunk of it was because of the reconnaissance phase that I did, right? I mean, those extra points that put me over the top to give me the perfect score were things that I got from recon that nobody else was doing. And they were techniques that we'll talk about in a little bit.
But Chris, right here, also, he won the SCCTF last year. Chris, we're talking to you. Hey.
Oh, I'm sorry.
Importance of OSINT with social engineering attacks. Critical, would you say?
Absolutely. Absolutely. Asking someone to confirm what you already know is a heck of a lot easier than just asking them what you don't know.
Right. Push polling, right? If you can act and sound critical.
The type of attack you can successfully launch is, just boggle your mind.
The stuff that we've been able to get people to tell over the phone, you're just like, I can't believe you're telling me this, right?
But they do.
So I do want to talk a little bit, though, about my history of predictions, so that you know where I'm coming from.
1988, I guess it was, I was an undergrad at engineering school.
And, you know, one of my professors said, hey, do you want to work with the graduate students?
I'm a graduate student. I'm going to talk about this cool thing called hypertext markup language.
Whatever, you know, get some extra credit.
Went in, spent a day with these guys, and they're like, it's links from text articles to other text articles.
Boop-de-doo, right?
Spent a day, I'm like, yeah, scintillating, I'm out of here, right? Bounce.
Because obviously I didn't, you know, back then, we didn't have Netscape, there were no graphics, no, you know, no videos, none of that stuff.
It was like, articles to articles to articles.
Right?
So that's the thing.
visionary I am, right? I mean, I'm probably the guy that would have gone, Mr. Xerox, I
understand the concept, but I'm not sure there's a market for it, right?
So, Peter Drucker had a great line. He said, predicting the future is like driving down
a country road at night with your headlights off and you're looking out the rear window,
which is pretty close to accurate, I think. But we're going to take a drive anyway.
So, open source intelligence and recon as a tool. What makes OSINT so compelling is
that it's a completely passive process, right? We don't send a single packet to the target.
We send our packets to people that have already hit that target, or the target has already
hit, or people within that company have already hit, right? They have no idea we're targeting
them.
So, if we want to know what technology a company is running, we don't run scans in their network.
I mean, you can later, if you want, or you can up front if you want. But instead, what
I like to do is I go to LinkedIn. I look at every employee, all their future stuff.
What have they hired? What technologies do they have on, right? Retired, current employees.
Go to Indeed. Go to Monster, the job sites. Who are they hiring? What apps are they looking
for? What technology? Just using open source intelligence, you can pretty much do a really
good job.
You can do the high-level technology stack analysis, again, without sending a single
packet to the target, right?
And why does this keep going? So, this is actually what OSINT used to look like. Anybody
remember using this back in, like, 89? Yeah, right? Would I be far off by saying, gigantic
pain in the ass? Right? Finding the little nugget. You're like, I know that they built
this data center out, and I want to find articles about it, but, like, you're scrolling
and scrolling and scrolling. Yeah, it was a nightmare. But this is literally what open
source intelligence and recon was for the longest time. And that's not to say there
wasn't online data available. There certainly was. And ironically enough, back in the day,
I know, old-timer, government data was the most readily accessible. But that's because
they'd actually had databases and data and big stuff. There was a time when government
had their shit together, believe it or not.
I know, hard to believe. Newspapers didn't have their stuff online, though. That's only
very recent, right? You see them on the scanning projects, and that's because now we have Hadoop
clusters, and they can distribute this work, and it's a lot easier for them to do now than
they could back then. LexisNexis, however, did exist back in the time, and that was kind
of like the ultimate source for OSINT or for personal recon. But where are we now? Well,
obviously, as my career has progressed, open source intelligence and successful recon
has become a much bigger part of the attack and defense profiling for most engagements.
This is obviously due to the explosion of the internet and social media, right? We went
from a little tiny drip, drip, drip of data that we could get to the biggest tsunami of
data that the world has ever seen. I mean, if you look at the charts, the amount of data
and the way it's going up, it's just exponential, right? And as OSINT professionals,
this is the field you get into, or recon or doing any sort of this stuff, it's one
of the first things you're going to have to deal with is the data overload, right? It's
unbelievably hard. I mean, we're actually at a point now where we literally have internet
connected toasters. Internet freaking connected toasters. That's more data that we have,
right? But again, it's also a pivot point within, you know, a target. So this was, I
put this up, it's not even close. This was like from four years ago. So take these numbers
and times them by what? A hundred. I don't know what the number is now, but just unbelievable
amounts of data that are surging over the wire at any given time. And these are things
that you are going to want to go through, right? It's like, I want to look for anything
that refers to this piece of data. And we start trawling through this. And this pile,
you're never going to get through this pile because it's growing all the time.
So why do we use open source intelligence? Well, we said before, you know, it's usually
free or at least relatively cheap. I mean, usually to obtain. The data has already been
provided, so we don't have to mine it. Well, I shouldn't say that. We have to get it.
We probably have to mine it, but it's been pre-mined for the most part. The other nice
thing is it's publicly available, which frees us, hopefully, from privacy law violations,
which can be very costly. And we'll talk about that in a minute.
So Wall Street uses open source intelligence so that they can analyze companies. They can
check the supply chains, look at threats to their income streams, and analyze risks, right?
Law enforcement uses it to track people, shut down protests, discover crimes, that sort
of thing, right? NGOs use it to protect their employees because a lot of them are in war
zones.
Interestingly enough, social media, in many cases, is the most honest, up-to-date, real-time
source of truth in war zones, right? So you'll see a lot of NGOs relying very heavily on
mining social media.
And then journalists and others use it to investigate targets, uncover stories, document
war activity and crimes, and that sort of thing.
But in my humble opinion, the most important use of OSINT, well, actually, that's not
true.
This is the second most important thing.
So we can pwn all the things, right? I mean, it really makes our life so much easier. Nobody
else really has a need for OSINT like we do. Babies spy agencies. But other than that,
we really need it to do our job.
But in my opinion, the most important thing that you use OSINT for is online dating.
Anyone here online dating? So I, you know, out of a 20-year marriage, I had a couple
of things.
I, you know, I started online dating for the first time 3 weeks ago, and I'm trying to
think of the word to put for it.
Freaking nightmare, maybe?
Right?
I can't stress the value enough of recon and OSINT in online dating.
Yeah. You know?
It's really good. If you really want to bounce someone who's, you realize this relationship
isn't working out, you can go, oh, I can't find someone. It's really good. If you really want to bounce someone who's, like, you realize this relationship isn't working
You know, quick Google search and hunting.
Hey, are you Libby Morgenstern who lives on 7th
and works at Whole Foods and you've got that dog, Peanut?
And she's like, how do you know that?
Discussion closed, unfriended.
Very good to know.
Right?
Do you think you've met Mrs. Wright or Mr. Wright?
It's really good to be able to look at this
and figure out if this person truly is Mr. or Mrs. Wright.
You can find out a lot of stuff about people
that they haven't let you know yet.
So you just wait for that piece of information to come out.
You know, oh, that teardrop wasn't from the teardrop festival.
It was from your five-year stint at Whole Foods.
Right.
So as we advance, though, I mean, we can use, well, yeah.
We can use, the way I see kind of OSINT evolving with dating apps
is we can actually use image and facial recognition.
We'll be able to harvest, basically,
a treasure trove of local information, right?
You'll be able to swipe with your little swiper,
grab the data, get their profile,
get all the personal information,
and start putting that together
into kind of like our own mini LexisNexis database.
It's really cool.
We can de-anonymize people really easily
and get their intimate details.
And it's really not that hard.
If we built a mini army of these automated swipers,
scrape the data, we can pretty much enumerate
the company's entire database very quickly.
I find OSINT is really, really good.
It's really helpful, too.
It's a great defense tool in online dating, right?
Because I don't know if you've noticed,
I think I must be the only, I know you guys are lying,
I can't be the only person that's online dating.
But I've learned the rules of online dating,
and that's if every photo is from up here,
and the duck lips, right, they're hiding something.
Usually 100 pounds.
So it's a really good defense tool
because you can actually find out someone's true,
true and fake information.
of this kind of useful stuff, right?
So in my dating world, I just wanna give you
a couple of quick examples that have happened to me.
Just with a first name on a dating app,
you can get a ton of information, right?
So one of the first people I started dating was a nurse,
got a very unusual first name.
So I put in first name and nurse, and Googled,
and it gave me four hits in the US.
Four hits.
That's pretty narrow, right?
Now she had a very run of the name.
If her name was Susan Nurse,
she'd probably have like, what, 50,000, 50 million hits?
So it was kind of interesting.
I matched an image I had of her to an image I had a name,
and all of a sudden, now I had last name,
now I start digging, right?
It all comes together real quick.
So I was able to find property she owned,
court action against her, family tree,
you name it, the whole thing.
Second thing happened earlier, or sorry, later that week.
I met another woman, had another very unique name.
And from that,
I was able to, I saw on the dating app
that she was 0.6 miles from my place.
So, took a little protractor on a map,
know the neighborhood she's going to be in,
put in her first name, the neighborhood,
and within seconds, I had her motorcycle makes and model,
her address, her occupation, her hangouts,
pretty much everything, right?
Just because she had a unique first name.
Although the really weird thing was,
there were actually two people in my neighborhood
with that unique first name.
So at first, I was all excited.
She's a doctor!
She's a doctor!
I'm going to be rich!
She was like, no, she's not a doctor.
You're going to have to keep working, you lazy bum.
So what makes OSINT and Recon so powerful for us as hackers?
Well, as an attack tool, like I said before,
it's as critical, if not more critical,
than pretty much every other stage
or every other phase of a pen test, right?
The proper intelligence gathered can be used
in a devastating social engineering attack.
And I mean, I've lost track.
The number of times in my life I've been able to come in
and drop slang, internal project names, site locations,
that sort of stuff, right?
The old adage, if you look and act like you belong there,
people are going to assume you belong.
Using OSINT, you can gather just insane things.
One of the courses I taught a few years ago at Black Hat
was I had teams go out and they were assigned
different companies.
And one of my team, I assigned them, just as it was a lark,
one of the largest defense contractors in the world.
I'm not going to say the name.
I'm too Chinese.
And they were able to find everything from employee names,
addresses, social security numbers, salaries,
black site addresses, locations around the world, you name it.
And they found that within an hour.
This is one of our most critical,
critical pieces of infrastructure.
And they were able to find this information within an hour
on the internet.
Like I said, this is the stuff you want to catch.
The TPS cover sheet report.
TPS report cover sheet.
So a physical layout, email addresses, phone numbers,
network diagrams, software.
That's the sort of stuff we're looking for.
So with an open source intelligence,
how many people here are really familiar with OSINT?
I should have asked that right off the bat.
OK.
So there's a lot that aren't.
So there are actually many, many different types
of open source intelligence.
Open source intelligence, do you even know what that means?
I guess I should have really framed what that is, right?
Sorry.
Open source intelligence is basically
intelligence that we get that's out there,
that's publicly available.
That's open source intelligence.
It can be on a website.
It can be stuff that we grab from talking to people, whatever.
But there are different ways, different types of methods,
or different types, sources of open source intelligence.
There's human intelligence.
Cultural intelligence.
Geospatial intelligence, I think it's called.
Market intelligence.
Signal intelligence.
Technical intelligence.
Image intelligence.
And what's MassINT?
I can't even remember.
Sounds good.
I didn't even hear what you said.
Sounds good.
But there are tons of OSINT sources.
And predicting the future of each and every one of these
could be a conference into and of itself, right?
So what I'm going to talk about today is, you know,
the one type of open source intelligence
that I feel is woefully underused.
And I say that because I know people that pen test every day.
I've seen it.
I've done it myself.
And I know they don't do it.
People don't do it.
And they don't do it for a few reasons.
And we'll show why.
But my favorite type of intelligence
is called image intelligence.
And that's where, try and guess it,
we get intelligence from...
Whew.
You guys are super smart.
Ha-ha.
I mean, the stuff that you can grab from image intelligence
is just unbelievable.
And it's stuff that you will often only find in images.
Now, remember before I was talking about
all the different things that we could look for in an attack,
like email addresses, physical layouts of properties,
and network diagrams,
and all the stuff we'd really want as hackers
to break into a company.
Well, we can find those things.
So...
This guy...
If you've seen some of my talks,
sometimes I talk about this guy
because he's just one of my favorite targets.
You'll see why.
So I stumbled across this guy's Flickr account
a few years ago
and decided he was really worth checking out
for a variety of reasons, which you'll soon see.
But just from him posting this business card,
what did we grab from it?
We got his cell phone,
his work address,
his work phone,
his fax address, right?
That's pretty good to know.
And his employer, right?
That's good stuff to know.
So...
I started looking at his Flickr account, too,
and he posted this one.
So I started to grab some other things
I gleaned about his hobbies and his life.
So what did we get from this Flickr upload?
Carrier, correct?
And he's got a sucky battery life, right?
So there we go.
So we know he is an AT&T character,
and we know he's on an Apple,
on an iPhone, right?
Which is important if we're going to launch an attack on him.
So we have a cell phone number.
Let's see if we mesh it with AT&T.
So we went and we plugged it into one of these databases,
and sure enough, he is on AT&T.
So we can be pretty sure
that if he gets a call from AT&T technical support
or sales support,
probably won't bat an eye, right?
It's a legit call.
We know his number.
He's AT&T.
Right?
So this was another one that he posted on Flickr.
And it was starting to get more and more interesting
as I was going through his account.
And he was talking about an event on Eventful
that he had registered for.
He goes, you know, fail.
Eventful is a little too helpful with email addresses.
With email address correction, he said,
this isn't even my real email address,
but earthling.net is the correct domain.
So I'm like, oh, good to know.
So he's got an earthling.net email account.
And then he posted a follow-up,
which is, you know, the event fail-fail
just keep getting worse.
You know, this time with my real email address.
Fail.
I'm like, dude, you just told us your real email address.
So there we go.
And then he started posting things, you know,
he posts a lot of other things,
but he posts work,
pics of his work-related hardware,
including specific hardware like wireless adapters.
That's probably something we'd want to know, right?
Specific attacks.
And then he had a bunch of photos
of him doing asset scanning at some school.
And in this one,
we start to see some really helpful information.
He's scanning at Bird Rock Elementary School.
And I do a quick check of Google,
which shows me that's part of
the San Diego Unified School District.
I know from other posts he's made
that he used to work there,
so now I know he still is working there.
So, right, another piece of information.
He's using the Airy Jones Asset Scanning Program.
And we can see the school's code is 0029A.
Pretty useful information
if you get a schmoozer like me on the phone, right?
Or in person.
This could be very useful.
Also helpful,
the IP address of the laser printer there on the back.
I don't know if you see it,
but they've got it sharpied on the upper right corner.
10-40-17-252.
So, people, please do not hack this school.
No hacking the schools.
Here's another innocuous pic he took
of him doing the asset survey.
You notice, by the way,
right before his face, what's that?
Yeah, a map of the school.
And in other following pictures that he posts,
we basically see the entire layout
of the building, the facility.
So, this at first glance looks kind of useless,
but what I did was I ran it through a high-res version,
took a high-res version, exported it,
put it in Photoshop, ran a high-pass filter on it,
and then I was able to start pulling out stuff, right?
So, how the bunch of laptops that they're scanning
are Lenovo E10s.
One of them has an asset tag ending in 78412.
That's pretty useful.
I mean, that's really specific information.
If I can call up and say,
I need you to pull out the Lenovo E10
that has asset tag 78412.
Who the hell's on the other part of the phone?
I don't know, but this guy
must be part of our organization, right?
But this one's my favorite.
So, you know, there's a basket with folders inside it,
and the basket has computer passwords
attached to it.
This school literally keeps a basket of passwords.
You may shoot me now.
Well, is it, though?
I mean, I don't know.
A basket of passwords sticking out,
that's like a battle of badness.
How do you use these passwords?
Well, actually, I mean,
I don't want to go down too much the rabbit hole with this guy,
but we knew for a fact that his dog's name
was one of his passwords,
and we were able to find his dog's name
from his Flickr account.
Fair warning, though,
the next ones are probably going to make your brain explode.
I grabbed this off his Flickr account, right?
And this one, right?
So off this one, we can glean that data center 2
has more capability and function than data center 1.
And in case, you know,
you weren't able to get the whole thing,
he's like, you know what?
The first two weren't good enough.
Let me make it so you can see the whole damn thing.
So this is totally stuff you should be putting online, right?
For future...
No, that's not right.
Oh, yes, he did.
Right.
So what do we have here?
A DSL number.
We have the gear name.
We have, yeah, lots of stuff.
And in fact, if we zoom in on the router...
Yeah.
This is like a huge fail sandwich, right?
I mean, with extra fail and less sandwich.
So basically, the wireless SSID,
the network key,
and the tech support number.
Could we do anything bad with that?
You could be the shittiest social engineer on the planet
and still get control over the school, right?
I mean, they don't make silver platters this big.
Let me put it to you that way, right?
But wait, it gets worse.
So that's it with that guy.
I mean, we could go...
That guy is literally a talk unto itself.
Google some of my talks,
and you'll see me kind of roast him.
But he's not alone in posting crazy shit.
This is a French secure data center.
They literally post a video
that is a video tour of their data center
that shows where the cameras are,
where the guards are,
where the car key readers are,
where the exits are,
the entire layout of the building.
But the guards are all yellow.
That's because they're afraid, I think.
I don't know.
Maybe it's a jaundice thing.
Do you think that's something
that you should be putting up online?
Probably not, right?
How about this one?
The stupid, right?
There is no patch for human stupidity.
If you can't see in the back,
push the number...
New door lock.
Push the number two and number four at the same time,
then push number three and press enter.
Thank you very much.
So why doesn't everybody do image intelligence?
Well, great question.
Thank you, Shane.
Because it's very time sensitive, right?
Computers could not have extracted the information,
or at least most of that information,
that we did from those photos,
because a lot of it takes human intuition, right?
At least not yet.
And while we do have good character
and image recognition programs,
they aren't quite as good as we need yet.
And we certainly don't have the AI for it yet.
Like, look at that.
I mean, that would be very hard
for any sort of character recognition system
to translate, right?
And I know me.
Like, I whiteboard all the time,
and I'll come back an hour later and, like,
I don't even know what that word is,
and I wrote it, right?
If I don't know what my handwriting is,
how am I supposed to expect a machine to know what it is?
So, you know, there are some issues.
There is a lot of research, though,
that's going on in scene text detection and recognition.
A lot of it's being done in China.
I don't know why I keep saying ah.
Sorry about that.
It's just a stupid thing.
Don't do it!
The Chinese are doing a ton of research into this stuff.
One approach that they suggested
that was initially kind of what they were doing
is they were doing a sliding scale per character.
So they take each character
and then match what the mathematical probability
and the sentence structure should be
to the character beside it.
But that's really not a good way to do it.
It's not efficient.
You need a big list of every possible characters
and for every word, a sequence.
I mean, it's just unmanageable.
So what they started doing now
is they do what they call component-based methods,
and that's where they'll do stuff like color clustering,
removal of background, so they start seeing
if this is blank, just cut it down.
So they start trimming stuff down
to the smallest possible readable chunks that they use.
And then they filter out non-text elements
basically according to a customized configuration.
And there's a really good paper out there
that you can see.
It's by these guys from, I think it's Beijing University.
Bai Zhu, Yao, and Bai.
But you can see here,
these are all being read very clearly, right?
No problem there.
But here, we see it actually misses stuff.
And it's very hard for us to do image and text retrieval
because, especially in the real world,
you'll see things like different colored backgrounds,
you'll see different fonts and size,
unknown fonts, different colors, shading.
I mean, there's a ton of things that kind of boggle it up.
The good news is researchers really think
that big data and deep learning will help tremendously.
And the consensus is within the next 10 years,
we're probably going to have this problem solved.
If you're interested in getting into text recognition,
I would really recommend that you follow this.
The account name is called Carlos Tao,
which is probably the most weird Chinese name ever.
Peking University, awesome text,
awesome scene text recognition is the GitHub repo.
And I'll make these slides available
so you can just grab these things.
So what is the future of image intelligence?
Well, we're going to be able to unblur photos.
That's definitely something that's coming down the pike.
In fact, there are cameras now out there, right?
You take the picture, ah, it's kind of screwed up,
and you can roll it back.
We're going to start seeing super high resolution.
We're not going to have to be gleaning
and putting in high pass filters and that sort of thing.
You know, when you get to 4K images,
you can really scroll up stuff from afar
and see a lot of patterns quickly.
We're going to be able to detect and extract text.
We're going to have facial recognition down.
Location recognition is going to be a big thing,
where basically you take a shot of something
and just by the background,
they'll be able to start saying,
at least if they can't locate where you are,
we can start locating where you're not,
which is just as valuable in many cases.
Um, yeah.
And advancements in cameras
are already making image intelligence easier.
We're already able to script some things
where we can pull out things like names from name tags.
Right? That's something we can do.
So Amazon's already in on this.
They have a product called Amazon Recognition.
It's a deep learning based image recognition system.
You can identify and detect objects, scenes, faces.
You can recognize celebrities.
It can identify inappropriate content, so i.e. nudes.
They are literally deconstructing images
into their base elements.
So this is part of their marketing.
They can do object detection, object and scene detection.
They can do face detection and facial analysis.
Are you happy? Are you sad? Are your eyes open?
Face comparison.
Even do face search in a crowd.
Right? All these technologies should give you
a really good glance of where we're heading really quickly,
what's coming down the road.
And in fact, C-SPAN is already using this technology
to automatically put names to speakers.
So that they've saved thousands and thousands of hours
and a lot of money,
because now they don't have to do it by hand.
So there is some good news.
For recon.
And there's some bad news.
We'll go over the first, the good news.
The good news is people are creatures of habit.
So they're always going to be using the same username over and over.
We're going to be able to track them all over the internet.
Right? Stuff like that.
We're going to be able to do things like
have big data available to us.
So let's say somebody posts some anonymous
post about how it's raining like hell outside.
And we'll be able to pick up every weather station around the world
real-time data and go, where is it raining right now?
Start doing stuff like that.
So I think the big future of open source intelligence
is going to be crowd-sourced open source intelligence.
And we're already starting to see that happen.
We've had some, you know,
it's not like social media is going to go anywhere.
Because we, and anybody that does OSINT,
you know, we live on social media, right?
It's what feeds us.
But in order for it to survive,
there has to be one of two business models.
You either pay for it,
or you let us mine your data even deeper than we are now.
And this is going to become a real issue,
because most social media companies are not making money.
I mean, most Silicon Valley companies aren't making money,
but put that aside, right?
So most users will sadly go with the advertising.
They rather sell all their privacy, all their data,
instead of spending ten bucks a month to protect that,
which is kind of a sad state of affairs.
So all of a sudden, if you're taking specific supplements,
they can figure out what's going on, right?
You're taking some sort of, you know,
supplement because you think you're pregnant.
They can do that analytics, right?
Or if you're trying to boost your testosterone,
like I say, hopefully not at the same time,
they can detect that.
They can say, you know what?
I think this person has Cushing's.
They're already starting to do this sort of thing.
We've already started to see some spin-offs
of Reddit and Facebook that were community-driven.
Some were more successful than others.
Some are still going.
None, obviously, nearly as successful as the original.
We see very huge projects
where they're crowd-sourcing Wi-Fi maps.
We're seeing crowd-sourced phone books and contact lists.
And these will continue to grow,
most likely, you know,
either as a privacy-driven offshoot
or as a pay-as-you-go privacy-type site.
People that say, you know what?
I don't want my data trafficked anymore.
Here's an example of crowd-sourced OSINT that's out.
It's called Ushahidi.
And frankly, I hadn't heard of these guys
until earlier in the week
when their executive director
got fired for sexual harassment.
I mean, that showed up in my feed.
It was, oh, okay.
Who are these guys?
And you start digging into it.
These guys are actually doing
open-source intelligence tracking in war zones.
So they're tracking human rights activities
that you can report anonymously.
Now, anyone see an opportunity here
for an attacker, though?
Right?
You put up your own site
where people can report stuff anonymously.
We put a lot of trust into these vendors,
but we don't know who these vendors are.
This is a real problem with open-source intelligence.
It's open, but who's putting what out there?
Crowd-sourced geo-terrain and satellite imaging.
That's something that we're definitely starting to see.
We're already starting to see things like TomNod,
which is a crowd-sourced satellite intelligence analysis program.
Bellingcat, which is terrestrial.
I don't know if you guys have seen this,
but this is journalists around the world
doing some really amazing stuff with Bellingcat.
And so, especially in the Ukrainian war,
they've been able to really identify,
hey, guess what?
This piece of armament was in this location at this time.
And they can even say it was in this meadow.
Really cool stuff.
I would seriously recommend everybody check out Bellingcat.
And then there was something called satellite sentinel,
which was George Clooney.
It was a very temporary thing.
It was for the war in Darfur.
But very soon,
you might even be able to launch your own satellites.
Facebook.com slash space boffins.
These guys are talking about mini satellite swarms.
Nano-satellites.
So it's certainly not beyond the realm of possibility
that crowd-funding a civilian satellite project.
I mean, that's more than feasible.
Especially as lens technology comes down in price
and increases in strength and power.
Very soon, we're going to have civilian satellites.
We'll be able to track
what the government's doing.
I don't think they'll like that.
That's my guess.
Crowd-sourced public camera database.
That's something that I want to pitch at Chaos,
and I still might.
I want to do my own thing where we basically take
Raspberry Pis and set up our own network,
where we capture license plates,
just like the police do,
but make it totally open source
so everybody can see where the politicians are going,
where the police are going,
where the people that want to tell us
if we've got nothing to hide are going.
If I die, it was probably because of that, though.
The other question is,
license plate, you know,
I don't know if you saw the thing on Facebook this week,
you know, the new flying car, right?
Are we actually going to have license plates on flying cars?
So, I don't know.
It might not be worth the investment.
Future of recon, though, bad news.
Social media's going to definitely come under pressure
to address hate speech, defamation, terror, porn,
and that sort of stuff.
Not terror, terror, comma, revenge porn.
Maybe terror, revenge porn.
I don't know.
I've done some crazy shit.
But they've already got fines,
so Germany just gave them a massive,
well, not massive,
but five to $50 million euro fine
is what they're proposing now
if material is not taken down
within 24 hours of a complaint.
So, guess what's going to happen?
Guess what the default action is going to be
when someone says,
yeah, this offends me,
or this is bad data.
Do you think they're going to wait 24 hours
for some minimum, you know,
$2 above minimum wage person to check it out?
No.
That data's going to disappear like that.
Right?
That's what the attack's going to be, obviously.
So it's going to be really easy for us
to suppress speech and data.
So France has this thing called the CNIL,
the Data Protection Authority.
They're saying that Facebook does not have
a legal basis under EU law
to combine all the information it has on account holders
to display targeted advertising,
i.e., their frickin' business model.
Right?
That's an existential threat to the company.
It also finds that Facebook engages in unlawful tracking
via data cookies of Internet users.
They continue to act in noncompliance.
The maximum fine for next year
will be 4% of global turnover,
or $20 million, whichever is greater.
That sounds horrible,
until you realize they made
$2.5 billion last quarter, right?
So it's a drop in the bucket.
It's a price of doing business.
But not everybody's making money, right?
Here's some other bad news for the future recon.
I'm sorry, I'm going to be, like,
two minutes over time.
Our old problem with recon was
we were designed to try and find
needles in haystacks, right?
Well, now we've got a bigger problem.
Now we actually have to find
which needles are actually legit needles.
We have fake news.
We have data poisoning,
deliberate data poisoning.
So now every time we find a piece of data,
we actually need to validate
that that piece of data is legitimate.
Twitter, I don't know if you saw this study,
they showed that 9 to 15% of users are bots.
They're fake.
Fake news.
Stuff that we can't trust.
There's a site called botometer.com,
or the botometer tool.
You should check it out.
And in data poisoning,
we see this all the time,
offensive and defensive poisoning of data.
So we could use that for really good and bad.
We can jam up social media with fake accounts.
Content for keywords we know
that oppressive governments are mining,
we can just put that in every frickin' tweet
and over, you know, drown the analysts.
As anti-bot detection rises,
so does the barrier to entry, right?
So fake accounts are really easy to prevent.
You need to tie it to an actual phone or credit card.
But companies don't do this
because it would impact their earnings.
So the government is moving towards requiring this.
And as that happens,
we will start to see a lot of this go away.
There's a thing out there
called the Crowdsourced Intelligence Agency.
It's really neat.
What these guys do is they actually,
if you, you can put in a tweet,
and it will rank the probability
and the highness of it being flagged
by government filters as being offensive
or needing real, you know,
law enforcement follow-up.
So let's flip that OSN tool
that was designed for good
and flip it into bad.
So let's find out that our target
is traveling in a few months.
So what do we do?
We create an account for someone that exists.
We have a bunch of sock puppets accounts
follow that target.
That someone that exists is him.
We begin to interact with him.
Now we set up a Twitter account
impersonating that person.
We fill it with content from his social media.
So we basically clone this guy on social media,
take stuff from his Facebook account,
whatever, post it.
So now it's his account as well.
It's his clone account that he doesn't know about.
Over time we start feeding the puppets
following our impersonation account as well.
Care and feeding of these bots is important.
They need to be legitimate accounts, not mindless.
We tweet the occasional anti-government
but nothing too bad.
Now we know the guy is about to hop on an airplane
and as he's at the terminal,
we type in something like,
today is the day I blow up an airliner.
He's on the air.
Right?
All those filters are going to find him.
The way we find out the tweet to use,
we just use that CS,
the open source intelligence bot
to tell us what the ideal tweet is to send out.
Like I said, data poisoning is going to increase.
We're going to see that.
It's very important that you as a reconnaissance analyst
always seek the validity of the source,
always question who your source is
and what their intent on releasing that information is.
Some dark and vice data is going to lose its value right now.
You can blackmail people by geolocating them on Grindr
or gay ads.
Nobody's going to care in a while.
Sorry guys, I'm coming.
A couple other things that I think are really cool
that you should check out.
Something called stylometry.
It assesses sentence structure and writing style
to identify users.
If someone's typing stuff and you don't know who they are,
you can actually start to find commonalities
between different posts on different sites.
You're definitely going to see increases
in both stylometry techniques and countermeasures.
There is a countermeasure called Anonymouth.
There's also an R library that lets you
rule your own stylometry lab at Google.
Like I said, I'm going to make these all available.
Then there's a researcher, Kim Jouts,
who also has a blog that you should check out.
The good news for us as pen testers,
people are always going to continue to leak information.
They're going to be looking for jobs,
they're going to be government records,
social media, GPS, sex and dating.
People are going to do anything to get their groove on.
It is inevitable that most, if not all,
of the libraries that we've talked about before
are going to be released to the public
or will at least develop our own versions of them,
and they'll be open source.
Just imagine the power that's going to give the individual.
But the really bad news is,
pretty much everyone's going to have access to this data.
And the really bad news to all of us in this room
is that as these technologies improve,
along with AI,
and as the TAC tools get more automated,
while perhaps edge case stuff requires a bit more digging,
there's not going to be very much that AI can't do.
We're not going to be employed to do the digging.
We're going to have machines do it.
Pen testing is not going to be a job.
It's not going to be a career.
I hate to say it.
Who has the most power?
The government.
The government works for us.
There are some big decisions for us to make.
Let's make the government make the right decision.
We as hackers have competing interests.
We should be the guardians of data.
I know we're paid to attack that data,
but we need to have an ethical and moral discussion.
What side of this fence are we on?
Are we aiding and abetting just for a paycheck?
Is that who we really want to be?
That's it.
You can always call me or email me.
Shane at tacticalintelligence.org.
You can get me on Twitter.
Tactical Intel is my tech account.
Planet Shane is my comedy account.
Thank you very much for coming.
Thank you very much for inviting me.
It was a big honor.
Thank you so much.
Sorry.
Sorry for running over now.