1
00:00:00,000 --> 00:00:20,260
Well, people are filing in. Just a quick note about me. So I'm InfoSecSherpa on Twitter, in case you didn't know. So I'm Tracy Z. Mayleaf. I'm from the Philadelphia area. I actually started my first InfoSec job two and a half weeks ago. I am a cyber analyst in a SOC for a large multinational company.

2
00:00:20,260 --> 00:00:32,960
I was a librarian for 15 years. I have a master's degree of library and information science. And what I was doing, when I was doing OSINT, I didn't know it was called OSINT. I just thought it was called doing my job.

3
00:00:34,260 --> 00:00:44,400
So when I decided to have this epiphany and this career change into InfoSec, I all of a sudden realized that I had all these research skills that I could contribute to this community.

4
00:00:44,520 --> 00:00:49,560
So I am learning the tech, and I am presenting and sharing my research skills.

5
00:00:50,260 --> 00:01:00,360
So that's kind of why you should listen to me, basically, is, you know, I spend most of my time as a librarian at a law firm, so I know how to find things for court and stuff like that.

6
00:01:01,440 --> 00:01:10,940
So I love Twitter. I think Twitter is a great research tool. I know that there are a lot of downsides negative to Twitter. I know there's a lot of, you know, there's bad sides to Twitter.

7
00:01:11,020 --> 00:01:20,100
But today's going to be all the happy, shiny parts about Twitter. But again, if you, in case you didn't read the description of my talk, it's not about tweeting out.

8
00:01:20,260 --> 00:01:23,640
I can't help you get verified. I can't help you get more followers.

9
00:01:23,820 --> 00:01:32,080
I'm going to help you pull information from Twitter, because I have some facts here that will help prove my point about why Twitter is a great OSINT tool.

10
00:01:32,480 --> 00:01:46,280
As of June 30th, 2016, they had 328 million monthly active users. 82% of those were on mobile. 79% of those accounts are outside the U.S. and over 30 languages supported.

11
00:01:46,720 --> 00:01:49,720
So to break it down another way, there was...

12
00:01:50,260 --> 00:02:01,040
It's estimated that there's 6,000 tweets per second, 350,000 tweets per minute, 500 million tweets per day, and 200 billion tweets per year.

13
00:02:01,260 --> 00:02:06,100
So that is a lot of user-generated raw data that is low-hanging fruit that is easy for the picking.

14
00:02:06,400 --> 00:02:10,300
So what I want to help you do is find that better.

15
00:02:10,500 --> 00:02:17,480
So consider this part, you know, consider this talk and also this part, the whole, like, RTFM of Twitter.

16
00:02:17,720 --> 00:02:20,060
Like, I think, like, if you have a car, you should kind of read them.

17
00:02:20,260 --> 00:02:21,020
You'll know how it works.

18
00:02:21,140 --> 00:02:24,320
I think you should know how Twitter works before you go using it.

19
00:02:24,400 --> 00:02:26,460
So I have a couple other highlights and things I want to go over.

20
00:02:27,220 --> 00:02:32,880
March 21st, 2006, the current CEO and one of the original founders, Jack Dorsey, tweeted his first tweet.

21
00:02:33,500 --> 00:02:35,880
January 2010 was the first tweet from outer space.

22
00:02:36,300 --> 00:02:42,880
And the most important milestone, to be quite frank, was July 16th of this year, which marked the 10th anniversary of me being on Twitter.

23
00:02:44,680 --> 00:02:48,820
And that was as LibrarySherpa, because I started the whole Sherpa thing a long time ago.

24
00:02:48,980 --> 00:02:50,060
I was LibrarySherpa.

25
00:02:50,260 --> 00:02:51,040
Now I'm InfoSecSherpa.

26
00:02:51,680 --> 00:02:57,500
So the last thing I want to mention before I dive in is keep in mind, Twitter was not designed as a search engine.

27
00:02:57,680 --> 00:02:59,500
It's not, and it is not a search engine.

28
00:03:01,660 --> 00:03:04,840
Therefore, it cannot, it's not easy sometimes finding things.

29
00:03:05,000 --> 00:03:06,540
It can be, what's the technical word?

30
00:03:06,760 --> 00:03:07,160
Wonky.

31
00:03:07,740 --> 00:03:10,300
It can be very wonky to find things.

32
00:03:10,380 --> 00:03:11,200
So keep that in mind.

33
00:03:11,280 --> 00:03:14,420
True story, there are times I've done similar talks like this.

34
00:03:14,520 --> 00:03:18,640
The next day, somebody will be like, I tried one of your sample searches and it doesn't work today.

35
00:03:19,180 --> 00:03:19,800
That's Twitter.

36
00:03:20,260 --> 00:03:21,140
That could happen.

37
00:03:21,360 --> 00:03:23,400
So I'm going to have these slides posted.

38
00:03:23,480 --> 00:03:24,400
I'm going to have sample searches.

39
00:03:24,560 --> 00:03:27,440
Keep in mind, if something doesn't work, it might work the next day.

40
00:03:27,640 --> 00:03:29,900
Things change all the time, so bear that in mind.

41
00:03:30,140 --> 00:03:42,120
And also, if you're doing some research and you find stuff that's good information, screen cap it, print it, save it, something, because you might not be able to find it, again, the same exact way.

42
00:03:42,280 --> 00:03:49,480
So, again, since I was working with lawsuits and stuff like that, I had to save everything I found because there was no guarantee that I'd be able to find it.

43
00:03:49,480 --> 00:03:50,380
Again, necessarily.

44
00:03:51,560 --> 00:03:54,040
So, your first fun fact, the bird has a name.

45
00:03:54,160 --> 00:03:54,900
His name's Larry.

46
00:03:55,280 --> 00:03:56,040
He's Larry Bird.

47
00:03:56,260 --> 00:03:57,240
And this is the proof.

48
00:03:57,560 --> 00:04:00,960
Biz Stone is one of the founders, and he's from the Boston area.

49
00:04:01,080 --> 00:04:02,980
So someone asked him, hey, is the bird really named Larry?

50
00:04:03,300 --> 00:04:04,020
Yes, he is.

51
00:04:04,680 --> 00:04:05,600
So, fun fact.

52
00:04:07,140 --> 00:04:13,200
What I don't think that people know a lot about is in order to get information about Twitter, you can use their own resources.

53
00:04:13,440 --> 00:04:14,980
They have blogs and Twitter accounts.

54
00:04:15,340 --> 00:04:16,380
And I highlighted these.

55
00:04:16,820 --> 00:04:17,820
Engineering and developer.

56
00:04:17,820 --> 00:04:22,800
developer, if you're someone who wants to know what's going on with the API or just

57
00:04:22,800 --> 00:04:28,260
different search techniques and changes, you know, a couple years ago, remember, you used

58
00:04:28,260 --> 00:04:32,760
to have to use the at, a period before the at symbol if you wanted everyone to see the

59
00:04:32,760 --> 00:04:36,560
tweets. Well, they got rid of that. Well, those announcements are made through these

60
00:04:36,560 --> 00:04:40,320
internal accounts. Like, that's how the media finds them. So if you're really interested in

61
00:04:40,320 --> 00:04:45,120
knowing what the changes are, follow the blogs or follow things straight from the bird's

62
00:04:45,120 --> 00:04:50,720
mouth. Follow the Twitter accounts. So real quick, I just want to go over a landscape of

63
00:04:50,720 --> 00:04:55,760
social media. Because this is something that I did a lot of research on. And companies have

64
00:04:55,760 --> 00:05:02,060
paid me lots of money to tweet for them or to do research for them. So just know that for

65
00:05:02,060 --> 00:05:06,480
all these, you know, for all these social media platforms that you think you know, there's

66
00:05:06,480 --> 00:05:11,880
probably seven more that you don't. So if you are not finding the information that you need

67
00:05:11,880 --> 00:05:15,100
on Twitter, it's possible that you might need to find another platform. So if you are not

68
00:05:15,120 --> 00:05:15,460
finding the information that you need on Twitter, it's possible that you might need to find

69
00:05:15,460 --> 00:05:19,700
another platform. So I thought this was a pretty cool graphic of some of the ones there. And

70
00:05:19,700 --> 00:05:23,880
also, so, okay, so here, first candy one. Who tells, who, where is this country? Is this

71
00:05:23,880 --> 00:05:29,560
from? What country? There we go. I'm just going to throw this randomly. So, whoo, candy. Just

72
00:05:29,560 --> 00:05:35,040
whoo, heads up. There we go. There we go. Okay. So again, if you are not finding the

73
00:05:35,040 --> 00:05:39,840
information that you need, you know, there are a lot of countries that have their own native

74
00:05:39,840 --> 00:05:45,040
grown social media. China's one. The link there, the Shiner on security, he has a blog

75
00:05:45,040 --> 00:05:51,440
post about how to do research on social media with the censorship. So that's a good blog post.

76
00:05:51,560 --> 00:05:55,900
That's all hyperlinked. So when you get my slides, you can click on that. Another thing to keep in

77
00:05:55,900 --> 00:06:01,400
mind, demographics. Social media platforms have their own, you know, age ranges that they cater

78
00:06:01,400 --> 00:06:05,380
to. So you see Twitter there in the middle. I know this is from 2014, but it's still pretty much

79
00:06:05,380 --> 00:06:10,320
accurate. Snapchat obviously skews a lot younger. So if you are doing any sort of like marketing

80
00:06:10,320 --> 00:06:15,020
research or something, and, you know, and Twitter doesn't fall into that demographic, you

81
00:06:15,020 --> 00:06:20,460
should try another platform. I like to joke that I hate the slide, but I use it anyway, and I'll

82
00:06:20,460 --> 00:06:26,320
explain why. I don't know how this got started, but somebody came up with the idea that the best

83
00:06:26,320 --> 00:06:32,020
time to post to Twitter was between 1 and 3 in the afternoon. I don't know where they got that

84
00:06:32,020 --> 00:06:36,740
from. I really tried hard to find the statistics. So this is why I show it. And this is more of

85
00:06:36,740 --> 00:06:42,780
like maybe a phishing sort of way, reason that I keep this in here. Because this is so prevalent,

86
00:06:43,380 --> 00:06:45,000
like everywhere you go, everyone is like, oh, my gosh, I'm not going to find this. I'm going to

87
00:06:45,020 --> 00:06:49,580
post between 1 and 3 in the afternoon. I feel like that's also a good time to go searching for

88
00:06:49,580 --> 00:06:54,740
stuff, because so many people are posting during that time. So that's the only reason why I keep

89
00:06:54,740 --> 00:06:59,280
this up there, is when I gave this talk one time specifically for like, you know, phishing

90
00:06:59,280 --> 00:07:04,640
exercises, I was like, check it out between 1 and 3. There might be people posting things. So

91
00:07:04,640 --> 00:07:08,780
something to keep in mind. These will be all posted, too, if you don't get forward stuff.

92
00:07:09,840 --> 00:07:13,740
And I already gave my little not a search engine talk. The last thing I want to mention is I

93
00:07:14,220 --> 00:07:15,000
purposely included this in here. I'm going to put it in here. I'm going to put it in here.

94
00:07:15,920 --> 00:07:23,020
Okay. I don't know why, but this is the way Twitter is. You can get different search results if

95
00:07:23,020 --> 00:07:29,920
you are on a desktop versus a mobile versus a tablet versus whatever. Also, if you are logged

96
00:07:29,920 --> 00:07:34,280
into your browser, you will get different, it will skew your search results if you're not logged

97
00:07:34,280 --> 00:07:40,280
in. So, again, the best way, the clean slate to do it is log out of anything, do your search. If

98
00:07:40,280 --> 00:07:44,860
you're not finding something, maybe try it on your phone if your laptop is not finding it. So keep

99
00:07:44,860 --> 00:07:48,780
in mind that these things are skewed, and you kind of have to play with it.

100
00:07:49,460 --> 00:07:55,460
All right. Next candy opportunity, heads up. Who knows that you do not have to be logged into

101
00:07:55,460 --> 00:07:59,360
Twitter to search it? Who knows that? All right. I'm just going to kind of throw in the general

102
00:07:59,360 --> 00:08:08,260
direction of people. I don't know. Here. In the back. All right. Awesome. Yes, you do not have to

103
00:08:08,260 --> 00:08:12,560
be logged into Twitter to search it. So the top graphic is just when you go to Twitter, what it

104
00:08:12,560 --> 00:08:14,840
shows. The magnifying glass is your friend. The other one is when you go to Twitter, what it shows.

105
00:08:14,860 --> 00:08:17,920
friend. If you click on it, that bubble will appear. You can just start typing whatever.

106
00:08:19,180 --> 00:08:25,780
All right. I'm going to run out of candy soon, so. Next one. Advanced search. Who knows about

107
00:08:25,780 --> 00:08:31,240
the advanced search? Awesome. We have a couple people. There you go. Somebody over there.

108
00:08:31,320 --> 00:08:38,320
Heads up. Sorry, dude. Don't sue me, please. You know, I'm two for two. The last time I

109
00:08:38,320 --> 00:08:43,020
threw candy at a security conference, I beamed someone in the head. So welcome to the club.

110
00:08:43,020 --> 00:08:50,660
It's an honor. So, okay. So the funny thing is, Twitter kind of hides this page. You used

111
00:08:50,660 --> 00:08:55,360
to be able to get to it, navigate to it internally after you did a search. I've tried, and they

112
00:08:55,360 --> 00:08:59,800
seem to have taken it away. But you can get to it directly with the URL. So the fill in

113
00:08:59,800 --> 00:09:04,060
the blank form is fine, but we're better than that, right? I'm kind of old school with my

114
00:09:04,060 --> 00:09:08,940
research. Like, you know, I used to do search LexisNexis with those whole, like, within

115
00:09:08,940 --> 00:09:12,300
five, near H lead. Some people are not. You know what I mean?

116
00:09:12,300 --> 00:09:19,020
So I can't fill in these bubbles. That annoys me. So think of, of the, the, think of this

117
00:09:19,020 --> 00:09:22,280
like the command line, but different. So you can do all kinds of stuff. So let's get into

118
00:09:22,280 --> 00:09:27,640
some commands. Basic one, to, from. If you want to see tweets that are sent to an account,

119
00:09:28,020 --> 00:09:33,040
you just tell it from, colon. I mean, sorry. Yeah, or to, colon, or from. Sorry, you can

120
00:09:33,040 --> 00:09:39,380
read. And then you can do between. You can see if people have gone between. Now, that's

121
00:09:39,380 --> 00:09:42,280
a great article at the bottom. If you want to see two companies have fought, probably

122
00:09:42,280 --> 00:09:47,640
on Twitter, you can do the to and from. Or people you know. But whatever. It's still

123
00:09:47,640 --> 00:09:51,200
interesting to find. So that's one way to find that. And you can do that with or without

124
00:09:51,200 --> 00:09:55,100
the at symbol. All right. So what if you want to get a little deeper? Now, remember,

125
00:09:55,200 --> 00:09:59,060
I came from a law firm environment. So finding out if things were defective were really important

126
00:09:59,060 --> 00:10:04,800
to the attorneys I worked for. So if I wanted to see if people tweeted at Walmart that something

127
00:10:04,800 --> 00:10:10,080
they bought was defective and do this later, you will see some weird things, you could

128
00:10:10,080 --> 00:10:10,520
do that.

129
00:10:10,520 --> 00:10:14,600
Now, Twitter might try to be helpful and be like, did you want Walmart detectives? No,

130
00:10:14,640 --> 00:10:18,400
Twitter. So you have to actually, like, force it through and say that you want defective.

131
00:10:19,200 --> 00:10:22,860
And I also found, like, if you were trying to get recalls, that you could see if a company

132
00:10:22,860 --> 00:10:28,060
put something out. So fun fact, if you know the stock symbol, Twitter recognizes stock

133
00:10:28,060 --> 00:10:33,200
symbols. The dollar sign and the stock symbol. So that's a way to find out some information.

134
00:10:33,940 --> 00:10:39,420
So the other red circle I have here is that Twitter will default to top. Top results will

135
00:10:39,420 --> 00:10:40,500
be skewed for a period of time. So that's a way to find out some information. So the

136
00:10:40,520 --> 00:10:41,560
red circle

137
00:10:41,560 --> 00:10:58,540
is kind of an indicator that if a company is not doing well on top, they're doing well

138
00:10:58,540 --> 00:10:59,480
in the market.

139
00:10:59,840 --> 00:11:04,500
But if they're doing so wrong, well, then they're not doing so well on top. So if they're

140
00:11:04,500 --> 00:11:09,480
doing so wrong, then they're doing so wrong. So, if they're doing very, very wrong, well,

141
00:11:09,480 --> 00:11:14,700
You can search tweets by location if the person keeps their geotagging on.

142
00:11:14,840 --> 00:11:17,260
But we're all smarter to do that, right?

143
00:11:17,840 --> 00:11:21,320
So let's take advantage of the people who aren't as smart to do this.

144
00:11:21,880 --> 00:11:28,840
So you see in the top left there, if you want to search a key term, you can use the airport code or you can use the city name.

145
00:11:29,120 --> 00:11:32,440
And sure enough, I did get different results when I searched those.

146
00:11:32,580 --> 00:11:34,560
Over on the right, who knows what a lorry is?

147
00:11:34,840 --> 00:11:36,000
Tell me what a lorry is.

148
00:11:36,120 --> 00:11:37,200
Yay, truck.

149
00:11:37,200 --> 00:11:37,580
I don't know.

150
00:11:37,620 --> 00:11:39,360
I'm afraid to throw any candy now.

151
00:11:39,840 --> 00:11:40,420
There you go.

152
00:11:40,480 --> 00:11:40,820
There you go.

153
00:11:40,860 --> 00:11:41,120
Get one.

154
00:11:41,980 --> 00:11:42,500
All right.

155
00:11:42,580 --> 00:11:46,160
The only reason why I included this example is I want to show that it also works outside the U.S.

156
00:11:46,160 --> 00:11:50,160
So BL3 is the first three characters of the postal code for Bolton, England.

157
00:11:51,080 --> 00:11:55,020
And you can see, actually, it was a fun way to see traffic in that part of the world.

158
00:11:56,240 --> 00:11:57,380
And then, so flooding.

159
00:11:57,460 --> 00:11:58,360
I wanted to see flooding.

160
00:11:58,440 --> 00:12:00,860
I could tell it within a city, within certain miles.

161
00:12:00,980 --> 00:12:03,780
The first one got me Dover, England and Dover, Delaware.

162
00:12:03,940 --> 00:12:04,960
I just wanted Dover, Delaware.

163
00:12:05,180 --> 00:12:06,260
So I put in the zip code.

164
00:12:06,260 --> 00:12:09,180
And then you can also just do near, near somewhere.

165
00:12:09,640 --> 00:12:10,480
So that's location.

166
00:12:11,820 --> 00:12:12,720
Before and after.

167
00:12:12,780 --> 00:12:20,880
Because why would, you know, why would until and since, you know, roll off the tone there?

168
00:12:20,940 --> 00:12:22,960
So before and after is until and since.

169
00:12:23,240 --> 00:12:24,560
So this is kind of interesting.

170
00:12:24,700 --> 00:12:31,140
If you want to see, like, a term like cybersecurity, if you wanted to see how it was used in Twitter before a certain date.

171
00:12:31,380 --> 00:12:33,280
So I used big data in this example.

172
00:12:33,400 --> 00:12:34,460
But that could easily be cybersecurity.

173
00:12:35,000 --> 00:12:36,040
So it would be tweets.

174
00:12:36,260 --> 00:12:38,040
Up until January 1st of 2008.

175
00:12:38,540 --> 00:12:42,740
Once in a while, I'll do this and you'll look at it and be like, oh, that was so sweet and innocent then.

176
00:12:42,920 --> 00:12:44,660
Or, oh, my God, we're still dealing with that.

177
00:12:45,100 --> 00:12:46,920
Those are the two, like, reactions you get.

178
00:12:47,800 --> 00:12:50,780
You can search between dates if you look on the top right there.

179
00:12:51,120 --> 00:12:54,960
I will warn you, though, it's not that, it doesn't narrow it down that great.

180
00:12:55,040 --> 00:12:57,720
I think about three days is the best I've been able to get.

181
00:12:57,920 --> 00:13:00,440
But play with it and see what you can get.

182
00:13:01,020 --> 00:13:02,280
You know, since is after.

183
00:13:02,420 --> 00:13:05,720
And then if you also just want a specific handle, you can tell it.

184
00:13:05,720 --> 00:13:08,180
But, oh, okay, I want to see what the specific handle does.

185
00:13:08,280 --> 00:13:10,360
And you can try different variations and stuff like that.

186
00:13:11,380 --> 00:13:12,820
So what if you don't want something?

187
00:13:12,980 --> 00:13:14,520
And this is not any political statement.

188
00:13:14,620 --> 00:13:18,520
This was just the only other Chelsea's I could think of where I wanted and couldn't.

189
00:13:18,660 --> 00:13:19,640
But say you didn't want that.

190
00:13:19,700 --> 00:13:23,320
Say you wanted, you know, you wanted some other Chelsea's.

191
00:13:23,320 --> 00:13:26,280
So you can, you know, separate out with the minus sign.

192
00:13:26,540 --> 00:13:30,500
Or if you didn't want the debutantes and you just wanted the Hiltons.

193
00:13:31,820 --> 00:13:32,860
Now, just be careful.

194
00:13:32,920 --> 00:13:35,560
If you start taking away too many things, you know,

195
00:13:35,720 --> 00:13:37,120
again, it's going to skew your search results.

196
00:13:37,400 --> 00:13:40,040
But it's a good way to take out something, you know, common.

197
00:13:40,640 --> 00:13:43,000
Like I said, if you don't want, if you were searching something about Hilton,

198
00:13:43,060 --> 00:13:44,560
but you don't want Nikki to keep coming up.

199
00:13:45,220 --> 00:13:48,040
And you can also use minus RT if you don't want retweets.

200
00:13:48,440 --> 00:13:50,120
Because, again, you're just going to get duplicate information.

201
00:13:50,460 --> 00:13:54,660
So you can take away another layer of data if you take out the retweets.

202
00:13:55,560 --> 00:13:58,620
Okay, so what happens if you string these all together?

203
00:13:59,140 --> 00:14:00,700
You get a cool search like this.

204
00:14:00,960 --> 00:14:04,060
So this is one I actually came up with when I was still a law firm librarian.

205
00:14:04,320 --> 00:14:05,220
One of the lawyers was like,

206
00:14:05,720 --> 00:14:08,340
hey, I think there was a gas explosion in Manhattan.

207
00:14:08,580 --> 00:14:10,620
I think it was like the end of March, beginning of April.

208
00:14:10,900 --> 00:14:12,620
Can you find out something about it?

209
00:14:12,860 --> 00:14:15,560
You know, we really need to get some photos of the scene and yada, yada, yada.

210
00:14:15,820 --> 00:14:17,080
I crafted that search.

211
00:14:17,360 --> 00:14:23,080
I had a whole string of people who were walking home from work who stumbled upon the scene.

212
00:14:23,320 --> 00:14:26,840
And I was able to hand that search string over to the attorney.

213
00:14:26,940 --> 00:14:29,520
And, you know, they dealt with insurance and things like that.

214
00:14:30,260 --> 00:14:34,480
So, yeah, you can string a bunch of things together and get different results.

215
00:14:34,640 --> 00:14:35,320
And, again, if...

216
00:14:35,720 --> 00:14:38,760
If nothing comes up for your search string, you know, tweak it a little bit.

217
00:14:38,840 --> 00:14:40,680
That's why I don't like using that fill-in form.

218
00:14:40,880 --> 00:14:43,620
You have a lot more power and control over your search this way.

219
00:14:47,820 --> 00:14:48,620
So, okay.

220
00:14:48,700 --> 00:14:51,140
I make fun of this poor woman posting this.

221
00:14:51,280 --> 00:14:53,200
She was like, hey, is it National French Fry Day?

222
00:14:53,280 --> 00:14:56,780
Those are the most pathetic excuse for french fries I've ever seen in my life.

223
00:14:56,980 --> 00:15:02,240
But the point is, you can find on Twitter where things originated from.

224
00:15:02,360 --> 00:15:05,560
So this woman originally posted to Instagram and, secondarily,

225
00:15:05,720 --> 00:15:06,400
sent it to Twitter.

226
00:15:06,680 --> 00:15:07,840
Why would this be important?

227
00:15:08,080 --> 00:15:13,180
Well, if you were in marketing and you're seeing that a lot of people are originating their tweets on Instagram,

228
00:15:13,380 --> 00:15:16,860
maybe you would put some more money and attention to funds into Instagram

229
00:15:16,860 --> 00:15:18,700
because that's where people are going first,

230
00:15:18,780 --> 00:15:21,680
especially if you're doing, like, sponsored posts and things like that.

231
00:15:22,140 --> 00:15:25,320
You can also do source for other platforms.

232
00:15:25,620 --> 00:15:28,180
So it's just interesting to see because, like, you know, if you've ever been in Instagram,

233
00:15:28,360 --> 00:15:30,400
you can see, like, secondarily also send to.

234
00:15:30,800 --> 00:15:31,820
That's what this is doing.

235
00:15:32,420 --> 00:15:35,620
It knows that it was posted somewhere else and it was going to Twitter.

236
00:15:35,720 --> 00:15:37,060
So that's kind of a cool one.

237
00:15:38,980 --> 00:15:39,340
Filters.

238
00:15:39,360 --> 00:15:40,000
Now, this is a good one.

239
00:15:40,000 --> 00:15:41,360
This is definitely from my law firm days.

240
00:15:41,620 --> 00:15:47,460
So a lot of courts tweet out their documents for free.

241
00:15:47,500 --> 00:15:52,620
So if anyone's ever been on a court's website, you know what a hot mess it is, what a dumpster fire it is.

242
00:15:53,580 --> 00:15:57,280
So sometimes it's easier just to kind of pick it from the Twitter handle.

243
00:15:57,440 --> 00:16:03,920
So this one, the Securities and Exchange Commission has, you know, a Twitter handle just for enforcements.

244
00:16:04,020 --> 00:16:05,020
And they tweet out.

245
00:16:05,160 --> 00:16:05,700
All right.

246
00:16:05,700 --> 00:16:08,240
So they tweet out all these PDFs with their documents and things like that.

247
00:16:08,440 --> 00:16:11,380
So I told it that I wanted from that account.

248
00:16:11,620 --> 00:16:15,780
I only wanted tweets that had a link in it because I knew that a link would be a PDF.

249
00:16:16,260 --> 00:16:17,280
And then I gave it.

250
00:16:17,340 --> 00:16:19,360
I was looking for somebody with the surname of Monroe.

251
00:16:19,860 --> 00:16:20,920
And bing, bam, boom.

252
00:16:21,160 --> 00:16:22,140
I didn't even have to go.

253
00:16:22,200 --> 00:16:23,760
I didn't have to go to the website.

254
00:16:23,960 --> 00:16:24,540
Just had it there.

255
00:16:24,620 --> 00:16:25,420
Clipped up the PDF.

256
00:16:26,020 --> 00:16:26,640
Good to go.

257
00:16:26,700 --> 00:16:27,760
Got the attorney out of my hair.

258
00:16:28,100 --> 00:16:29,180
It was all good.

259
00:16:29,940 --> 00:16:32,060
Oh, and I did this on purpose for cats and puppies.

260
00:16:32,220 --> 00:16:33,160
Everyone likes cats and puppies.

261
00:16:33,400 --> 00:16:35,560
So you can tell Twitter that you want.

262
00:16:35,700 --> 00:16:36,780
You know, pictures of cats.

263
00:16:37,080 --> 00:16:38,300
So do filter images.

264
00:16:38,560 --> 00:16:39,660
Or native video.

265
00:16:39,780 --> 00:16:46,340
If someone is actually filming video on their phone using the Twitter app, that's what native video is.

266
00:16:46,460 --> 00:16:48,880
As opposed to any other video source.

267
00:16:49,320 --> 00:16:50,400
So that's kind of cool.

268
00:16:50,840 --> 00:16:51,360
Okay.

269
00:16:51,520 --> 00:16:54,220
And I did this on purpose because it was this week.

270
00:16:54,400 --> 00:16:59,900
So this one, I'm not really sure, honestly, how much OSINT value this has.

271
00:17:01,380 --> 00:17:02,820
But it's kind of interesting.

272
00:17:02,960 --> 00:17:05,360
So you can tell Twitter that you want.

273
00:17:05,360 --> 00:17:10,840
You want to see, you know, a tweet from Jack Daniel that had at least a minimum of 100 favorites.

274
00:17:11,700 --> 00:17:13,180
Or minimum retweets.

275
00:17:13,400 --> 00:17:14,600
And you can put those in.

276
00:17:14,780 --> 00:17:18,240
And, again, those are just interesting to kind of see the popularity of stuff.

277
00:17:18,860 --> 00:17:21,700
And those are real examples from that search.

278
00:17:23,640 --> 00:17:24,080
Cool.

279
00:17:24,180 --> 00:17:27,800
Does anybody here do search in non-English languages?

280
00:17:28,140 --> 00:17:28,820
Raise your hand.

281
00:17:28,880 --> 00:17:29,560
I don't have a candy 30.

282
00:17:29,680 --> 00:17:29,900
Awesome.

283
00:17:30,060 --> 00:17:30,460
Okay.

284
00:17:30,500 --> 00:17:35,340
Well, if you search in non-English languages, Twitter has 34 languages.

285
00:17:35,360 --> 00:17:39,720
And if you want to tell it how to search in those languages, those are the codes.

286
00:17:39,980 --> 00:17:40,800
There's a lot more.

287
00:17:40,880 --> 00:17:41,600
But there's some of the codes.

288
00:17:41,740 --> 00:17:43,180
You know, Spanish is ES.

289
00:17:43,800 --> 00:17:45,780
You know, do you see German is TE.

290
00:17:46,060 --> 00:17:47,120
So it's pretty cool.

291
00:17:47,320 --> 00:17:54,600
Now, the things you have to remember is you can search Twitter in non-English in the native English platform.

292
00:17:55,080 --> 00:17:56,660
And you can get one set of results.

293
00:17:57,000 --> 00:18:01,500
Or you can go to German Twitter and search languages.

294
00:18:01,900 --> 00:18:03,420
And you'll get slightly different results.

295
00:18:03,640 --> 00:18:05,060
I have an old slide.

296
00:18:05,060 --> 00:18:10,040
Where I have side-by-side, where they're pretty similar results, but one or two were different.

297
00:18:10,180 --> 00:18:13,960
But in my world, I'm thinking, you know what, those are probably the two that I really need.

298
00:18:14,220 --> 00:18:18,920
So, why would I want to, you know, I want to cast a wide net and see what I can find.

299
00:18:19,580 --> 00:18:21,000
So, do you speak Twitter?

300
00:18:21,580 --> 00:18:32,160
So, how you tell it to go to the other platform, it's just Twitter, question mark, language equals, and then French or those other, or the other two-letter thing.

301
00:18:32,660 --> 00:18:35,040
I picked Bradley Cooper because he does not have that.

302
00:18:35,060 --> 00:18:36,040
He doesn't have an official Twitter handle.

303
00:18:36,340 --> 00:18:37,640
And he also speaks French.

304
00:18:37,980 --> 00:18:45,140
So, there's a good chance that you are going to find information about him in French because the French love to write about him since he speaks French.

305
00:18:45,780 --> 00:18:53,760
But if you're just doing a regular search in your little search bubble there, if you don't want to go to the actual website in another language,

306
00:18:53,860 --> 00:18:58,320
because maybe you're not that strong in the language and you don't know what all the other things are.

307
00:18:58,500 --> 00:19:03,840
Like, you know, the, I think in French, instead of, whatever it says in English to tweet, it's in French it says,

308
00:19:03,840 --> 00:19:06,140
I'm quite enough or something like that.

309
00:19:07,120 --> 00:19:15,600
So, if you're not that comfortable with the language, you can also just tell it in the native, you know, English platform just to do whatever language.

310
00:19:16,940 --> 00:19:17,600
All right.

311
00:19:17,700 --> 00:19:19,680
Who knows that Twitter lists are a thing?

312
00:19:19,780 --> 00:19:20,940
Who knows what a Twitter list is?

313
00:19:21,260 --> 00:19:22,020
Raise your hands.

314
00:19:22,280 --> 00:19:22,940
All right.

315
00:19:22,940 --> 00:19:24,660
That is a lot better than past ones.

316
00:19:24,780 --> 00:19:24,920
Yay.

317
00:19:25,080 --> 00:19:25,500
Congratulations.

318
00:19:25,620 --> 00:19:27,020
Just come up and get your candy later.

319
00:19:27,100 --> 00:19:27,820
I'm tired of hitting people.

320
00:19:27,980 --> 00:19:28,980
So, all right.

321
00:19:29,180 --> 00:19:30,940
So, true story about Twitter lists.

322
00:19:31,160 --> 00:19:31,560
Um.

323
00:19:31,560 --> 00:19:38,020
I was hired by a security company to do competitive intelligence research on one of their competitors.

324
00:19:38,560 --> 00:19:41,960
They were going to pay me, but I couldn't spend any money to do research.

325
00:19:42,160 --> 00:19:44,300
Does that sound familiar to anyone else?

326
00:19:44,640 --> 00:19:49,640
So, I was doing all this, you know, OSINT, trying to figure out who their customers were, because they wanted their competitors' customers.

327
00:19:50,780 --> 00:19:54,760
And I was just through a Hail Mary, which is a sports reference, football, I didn't want to know.

328
00:19:54,920 --> 00:19:55,240
Anyway.

329
00:19:55,800 --> 00:19:56,400
Thank you.

330
00:19:56,480 --> 00:19:57,500
The women are nodding.

331
00:19:57,500 --> 00:19:57,720
Yes.

332
00:19:57,740 --> 00:19:58,060
Thank you.

333
00:19:59,280 --> 00:20:04,240
And I was like, let me check this company's, this target company's Twitter handle.

334
00:20:04,380 --> 00:20:05,380
So, I'm poking around their Twitter.

335
00:20:05,580 --> 00:20:07,940
I go to their list, and sure enough, they have lists.

336
00:20:08,780 --> 00:20:09,180
Clients.

337
00:20:09,860 --> 00:20:10,660
Potential clients.

338
00:20:11,980 --> 00:20:12,760
Past clients.

339
00:20:13,340 --> 00:20:13,740
Everything.

340
00:20:14,240 --> 00:20:16,580
And I was like, ding, ding, ding, ding, ding.

341
00:20:16,900 --> 00:20:17,300
Jackpot.

342
00:20:17,500 --> 00:20:20,000
And I was like, man, they can't possibly be this stupid.

343
00:20:20,320 --> 00:20:21,160
Yes, they were.

344
00:20:21,240 --> 00:20:21,880
They were right there.

345
00:20:21,960 --> 00:20:22,540
I clicked them.

346
00:20:22,680 --> 00:20:23,700
I opened it up.

347
00:20:23,700 --> 00:20:24,360
I did screenshots.

348
00:20:24,600 --> 00:20:25,480
I saved the URL.

349
00:20:26,060 --> 00:20:28,040
My, you know, the client thought I had the URL.

350
00:20:28,060 --> 00:20:28,960
I was a genius.

351
00:20:29,440 --> 00:20:30,580
And I got paid.

352
00:20:30,660 --> 00:20:31,380
And it was awesome.

353
00:20:31,560 --> 00:20:35,880
And I have not checked back to see if that company has ever shut down those lists.

354
00:20:36,000 --> 00:20:40,940
But I love to tell that story because make your list private.

355
00:20:42,360 --> 00:20:44,320
So what do you, so let me back up.

356
00:20:44,460 --> 00:20:49,760
So for those of you who don't know, a Twitter list is basically like a file folder on your

357
00:20:49,760 --> 00:20:52,400
desktop that you go to when you want to to look at something.

358
00:20:53,380 --> 00:20:57,000
One time I gave this talk to a less tech savvy crowd, I said it was a filing cabinet.

359
00:20:57,640 --> 00:20:58,040
Basically.

360
00:20:58,060 --> 00:21:01,120
It's a list of something that you tuck away.

361
00:21:01,240 --> 00:21:02,160
You look at it on demand.

362
00:21:02,380 --> 00:21:03,860
It doesn't affect your main feed.

363
00:21:04,140 --> 00:21:10,560
So if you want to have a whole Twitter list of, say, like, entertainment, you know, Kim

364
00:21:10,560 --> 00:21:14,480
Kardashian stuff or whatever, and you don't want that to mix with your cybersecurity stuff,

365
00:21:14,680 --> 00:21:17,240
I'm not saying I have a Kim Kardashian Twitter list, I swear to God.

366
00:21:17,520 --> 00:21:17,880
Anyway.

367
00:21:19,100 --> 00:21:22,200
I'm just saying, if you want to keep your stuff separate, it doesn't interfere with

368
00:21:22,200 --> 00:21:22,800
your main feed.

369
00:21:22,900 --> 00:21:24,340
It's something you go to on demand.

370
00:21:24,900 --> 00:21:26,840
So how you do it is you go to your main.

371
00:21:26,840 --> 00:21:32,560
On the main page, you go to your handle, you tell lists, and you create a new list.

372
00:21:32,780 --> 00:21:36,920
It just wants, you know, a name of it and a little short description, and you can make

373
00:21:36,920 --> 00:21:37,800
it public or private.

374
00:21:37,960 --> 00:21:38,940
So here's a little thing.

375
00:21:40,360 --> 00:21:42,020
Back in March, I was all excited.

376
00:21:42,100 --> 00:21:48,980
I thought I figured out a hack that if I made something private initially that I could make

377
00:21:48,980 --> 00:21:49,460
it public.

378
00:21:49,520 --> 00:21:50,260
Oh, let me back up.

379
00:21:50,300 --> 00:21:51,640
I'm missing a crucial step here.

380
00:21:52,220 --> 00:21:56,360
If you make a public list, the person you add to the list is notified that they're added

381
00:21:56,360 --> 00:21:57,040
to that list.

382
00:21:57,380 --> 00:21:57,740
Okay?

383
00:21:57,800 --> 00:22:00,700
So if you're trying to be sneaky, I'll add a private list.

384
00:22:01,480 --> 00:22:05,020
But sometimes people still want to see your lists and stuff like that, you know, maybe

385
00:22:05,020 --> 00:22:06,620
like a colleague that you work with.

386
00:22:07,380 --> 00:22:10,600
If you, as soon as you change that to public, those people are still notified.

387
00:22:10,840 --> 00:22:14,120
But back in March, I was testing it, and it wasn't notifying.

388
00:22:14,240 --> 00:22:17,400
I have all kinds of other Twitter handles that I have for research purposes.

389
00:22:17,760 --> 00:22:22,440
It wasn't notifying my other handles that I had made that list public, and I thought

390
00:22:22,440 --> 00:22:23,200
I found something.

391
00:22:23,280 --> 00:22:24,800
I was getting ready to go to B-Sides Charm.

392
00:22:24,800 --> 00:22:26,340
And I'm like, I'm going to introduce you.

393
00:22:26,340 --> 00:22:26,660
I'm going to introduce this.

394
00:22:26,860 --> 00:22:28,100
I'm so excited.

395
00:22:28,440 --> 00:22:29,940
Oh, and then they fixed it a month later.

396
00:22:30,500 --> 00:22:31,560
So womp, womp.

397
00:22:31,740 --> 00:22:36,160
But the moral of the story is, if you are creating a Twitter list and you're absolutely

398
00:22:36,160 --> 00:22:41,820
certain that it needs to be under wraps, test it on maybe yourself first to make sure that

399
00:22:41,820 --> 00:22:45,180
even if you label it private, that it still doesn't send a notification.

400
00:22:46,200 --> 00:22:47,140
But that's the difference.

401
00:22:47,260 --> 00:22:50,520
So anyone, if it's a public list, anyone can look at it.

402
00:22:50,540 --> 00:22:53,520
You can send the URL on Twitter and be like, hey, I've created all these cybersecurity

403
00:22:53,520 --> 00:22:54,040
people.

404
00:22:54,280 --> 00:22:55,500
You know, it's this great list.

405
00:22:55,580 --> 00:22:56,120
And follow it.

406
00:22:56,340 --> 00:23:01,220
For private, if you just want to have employers I'm interested in or whatever, keep that private.

407
00:23:01,480 --> 00:23:07,480
So Twitter lists are a great way to manage the fire hose of information that comes in.

408
00:23:07,780 --> 00:23:10,020
So you're like, that's great, Tracy.

409
00:23:10,040 --> 00:23:11,300
How do I find a Twitter list?

410
00:23:11,580 --> 00:23:17,600
So a couple years ago, Twitter got rid of the functionality to find lists within their

411
00:23:17,600 --> 00:23:18,160
own website.

412
00:23:18,780 --> 00:23:23,900
And they did away with it like a week before I was to give a big Twitter presentation at

413
00:23:23,900 --> 00:23:24,280
a conference.

414
00:23:24,360 --> 00:23:25,260
So that was awesome.

415
00:23:25,260 --> 00:23:26,640
I had to redo my slides.

416
00:23:26,840 --> 00:23:28,640
So this is how you find Twitter lists.

417
00:23:28,760 --> 00:23:29,700
You have to go to Google.

418
00:23:30,120 --> 00:23:31,240
You have to Google dork.

419
00:23:31,420 --> 00:23:33,360
And that's why I have the little thing down there.

420
00:23:33,560 --> 00:23:36,880
Because if you do this a couple times, it wants to know that you're not a robot.

421
00:23:38,240 --> 00:23:41,980
So which, try to explain that to like a not tech savvy crowd.

422
00:23:42,600 --> 00:23:45,180
That was hard for me to explain to them.

423
00:23:45,380 --> 00:23:49,580
So they thought I was telling them to do something illegal if that, I was like, no.

424
00:23:49,960 --> 00:23:52,620
But Google doesn't really like you searching like this.

425
00:23:52,740 --> 00:23:54,220
But if you've Googled dorks, you know that.

426
00:23:54,220 --> 00:23:56,040
So anyway, that's how you find Twitter lists.

427
00:23:56,120 --> 00:24:02,420
So you need to do some sort of combination of, you know, of hashtags or quotation marks

428
00:24:02,420 --> 00:24:03,020
or keywords.

429
00:24:03,460 --> 00:24:04,860
And that's how you find Twitter lists.

430
00:24:04,900 --> 00:24:07,000
So unless they bring the functionality back, that's how you do it.

431
00:24:07,640 --> 00:24:08,000
Okay.

432
00:24:08,040 --> 00:24:12,520
So now I'm going to move on to, there are some other websites and other things that

433
00:24:12,520 --> 00:24:14,800
interact with Twitter to help you organize all this information.

434
00:24:15,640 --> 00:24:16,800
I love Nuzzle.

435
00:24:16,900 --> 00:24:18,420
N-U-Z-Z-E-L dot com.

436
00:24:18,500 --> 00:24:23,340
If you follow me on Twitter, you probably see me obnoxiously, shamelessly plug my Nuzzle

437
00:24:23,340 --> 00:24:23,700
newsletter.

438
00:24:24,220 --> 00:24:26,320
Pretty much every day, except for here while I'm out here.

439
00:24:27,300 --> 00:24:28,760
Nuzzle works with Twitter.

440
00:24:29,420 --> 00:24:36,000
And what it does is it will aggregate stories that people in your Twitter network follow.

441
00:24:36,220 --> 00:24:41,160
So if I log in, I look at it, and I see that like 25 people, and they're all in InfoSec,

442
00:24:41,340 --> 00:24:46,880
that I follow on Twitter have tweeted or favorited a certain article, you damn well bet I'm reading

443
00:24:46,880 --> 00:24:47,420
that article.

444
00:24:47,960 --> 00:24:52,940
Because that means, you know, then the community's talking about it, it's something that's going

445
00:24:52,940 --> 00:24:53,220
on.

446
00:24:54,220 --> 00:24:56,640
Most of you kind of rank things of what people are seeing.

447
00:24:57,460 --> 00:24:59,380
You can do a handcrafted newsletter.

448
00:24:59,900 --> 00:25:00,640
And it's all free.

449
00:25:00,880 --> 00:25:05,140
There's no, now they just implemented a paid platform, which I haven't had a chance to

450
00:25:05,140 --> 00:25:05,520
check out.

451
00:25:05,700 --> 00:25:07,160
But all this functionality is free.

452
00:25:08,160 --> 00:25:12,800
You can use it without logging into Twitter, but I think it's really kind of diminished.

453
00:25:12,980 --> 00:25:15,840
I think to get the most value out of it, you really need to be logged in.

454
00:25:16,700 --> 00:25:20,160
And they have a Twitter handle, and they have, you know, the website here.

455
00:25:20,300 --> 00:25:21,320
So it's a really great resource.

456
00:25:21,980 --> 00:25:24,200
It's a just, it's a good way to see what, like, influencers are doing.

457
00:25:24,200 --> 00:25:28,500
What influencers are talking about, and, like, also to find other people to follow.

458
00:25:28,820 --> 00:25:34,720
But I just love the functionality of it tells me what is going on, what is popular, because

459
00:25:34,720 --> 00:25:36,020
then that's the stuff that I want to read.

460
00:25:37,660 --> 00:25:38,060
Storify.

461
00:25:38,980 --> 00:25:40,180
Anybody know about Storify?

462
00:25:40,800 --> 00:25:41,500
Okay, awesome.

463
00:25:41,540 --> 00:25:42,020
A couple of people.

464
00:25:42,140 --> 00:25:48,760
So the first functionality for Storify is that you can stitch tweets together and make

465
00:25:48,760 --> 00:25:49,640
it like a story.

466
00:25:49,780 --> 00:25:52,460
So you guys all know DA667, right?

467
00:25:52,560 --> 00:25:53,360
You know, you know him?

468
00:25:53,360 --> 00:25:55,120
He likes to tell Twitter stories.

469
00:25:55,320 --> 00:25:58,820
So one day he was telling a Twitter story, and I asked him afterwards, do you mind if

470
00:25:58,820 --> 00:26:00,300
I Storify your talk?

471
00:26:00,620 --> 00:26:06,980
So what I did is I went in, and it enables you to graphically just stitch them all together

472
00:26:06,980 --> 00:26:08,860
so that it reads like a story.

473
00:26:09,020 --> 00:26:10,200
So it's not just a clever name.

474
00:26:11,340 --> 00:26:14,500
And so this is on my Storify feed for people to go to.

475
00:26:14,580 --> 00:26:15,620
So I would tweet out that link.

476
00:26:15,840 --> 00:26:17,240
Hey, did you miss his great talk?

477
00:26:17,460 --> 00:26:18,200
Here it is.

478
00:26:18,280 --> 00:26:22,480
So you're not trying to go back into your Twitter feed and piece together where he tweeted,

479
00:26:22,480 --> 00:26:25,200
and where somebody responded to him, and all this stuff.

480
00:26:25,360 --> 00:26:30,040
I used to lead Twitter chats a lot, all the time when I was in the library world.

481
00:26:30,320 --> 00:26:33,960
So I would go in after the fact and pull this together so you would have a cohesive

482
00:26:33,960 --> 00:26:39,000
story about the question and the answers and not all the back and forth garbage of

483
00:26:39,000 --> 00:26:41,180
people fighting and whatnot.

484
00:26:41,640 --> 00:26:45,820
But not only does Storify do that, but if you see the lower left-hand corner, they have

485
00:26:45,820 --> 00:26:47,860
an amazing little search engine here.

486
00:26:47,940 --> 00:26:50,040
We did a demo at B-Sides Charm.

487
00:26:50,040 --> 00:26:54,760
You can search all those different social media platforms, but Twitter specifically.

488
00:26:55,640 --> 00:27:00,200
If you go in, they have all kinds of expanded features that you can use, like geography,

489
00:27:00,520 --> 00:27:02,640
like maps, and a lot of other things.

490
00:27:02,700 --> 00:27:04,340
Their functionality is pretty darn good.

491
00:27:04,460 --> 00:27:08,240
So I highly recommend Storify as another resource to search on Twitter.

492
00:27:09,640 --> 00:27:13,160
Now any OSINT person worth their salt knows this site, right?

493
00:27:13,540 --> 00:27:19,720
So in case you didn't, as a reminder, I wanted to remind you that Michael Bazell has this

494
00:27:19,720 --> 00:27:22,540
whole Twitter part here that's good to use.

495
00:27:24,960 --> 00:27:27,840
And I talked a lot faster than I thought I was going to.

496
00:27:30,320 --> 00:27:35,040
So yeah, so that's my presentation.

497
00:27:35,380 --> 00:27:40,380
I threw a lot of search strings at you and things like that, but I'm happy to answer

498
00:27:40,380 --> 00:27:42,940
questions and things like that.

499
00:27:43,040 --> 00:27:47,280
So thanks for listening, but please stay, and I have more candy if anyone wants candy.

500
00:27:54,680 --> 00:27:55,640
Question, yes?

501
00:27:56,120 --> 00:27:59,700
So how sensible is the source filter for Twitter?

502
00:28:00,640 --> 00:28:04,660
Is it just other social media sites, or have you put any domain in there?

503
00:28:05,040 --> 00:28:07,420
To the best of my knowledge, it's just social media sites.

504
00:28:07,700 --> 00:28:09,740
I haven't tried it with any other domains.

505
00:28:10,160 --> 00:28:16,000
Whenever I've seen the source filter explained, it gives it in the context of other social

506
00:28:16,000 --> 00:28:16,360
media.

507
00:28:16,620 --> 00:28:17,020
It is good.

508
00:28:17,520 --> 00:28:18,740
But links?

509
00:28:18,740 --> 00:28:21,320
You could probably maybe try, hmm.

510
00:28:22,420 --> 00:28:27,900
You can also try doing a Google search that way, going in from Twitter the other way of

511
00:28:28,580 --> 00:28:31,620
links with, because you can do, like, with the site search and things.

512
00:28:31,960 --> 00:28:33,440
That's another talk I give, by the way.

513
00:28:33,520 --> 00:28:36,860
I give other, like, deep dive Google and deep dive other things.

514
00:28:37,220 --> 00:28:39,300
To the best of my knowledge, it's just other social media platforms.

515
00:28:39,640 --> 00:28:40,760
You can try it.

516
00:28:40,800 --> 00:28:44,000
Maybe shoot me a note if it works, but I think that they just pull from other social

517
00:28:44,000 --> 00:28:44,340
media.

518
00:28:45,080 --> 00:28:48,720
From this site, you can get a deep check using GooseGrid or something like that?

519
00:28:48,740 --> 00:28:52,880
Do you do, like, emulating of, like, Android phones and all kinds of different things,

520
00:28:52,940 --> 00:28:56,100
like switching it out to use, you know, get those search results that you were talking

521
00:28:56,100 --> 00:28:57,500
about as you were logged in on the phone?

522
00:28:57,800 --> 00:28:58,140
No.

523
00:28:58,180 --> 00:28:58,420
No.

524
00:28:58,440 --> 00:29:01,360
And my talk was just basically emphasizing on the GUI.

525
00:29:01,440 --> 00:29:01,740
Sure.

526
00:29:02,240 --> 00:29:02,600
Sorry.

527
00:29:02,700 --> 00:29:04,120
I meant to mention that in the beginning.

528
00:29:04,440 --> 00:29:04,680
Sure.

529
00:29:04,980 --> 00:29:05,520
So, yeah.

530
00:29:05,580 --> 00:29:11,780
I mean, I don't have the scraping and script writing skills that you all have, but I know

531
00:29:11,780 --> 00:29:12,380
the GUI well.

532
00:29:12,720 --> 00:29:14,020
So, I know.

533
00:29:14,080 --> 00:29:15,920
I have not tried that, because I just kind of didn't.

534
00:29:15,920 --> 00:29:17,280
It's just a really interesting way to do it.

535
00:29:17,280 --> 00:29:18,260
I've heard the name.

536
00:29:18,320 --> 00:29:18,520
Yeah.

537
00:29:18,520 --> 00:29:22,560
Actually, I'm in the process of learning a bunch of stuff in my new job, so, yeah.

538
00:29:23,120 --> 00:29:23,520
Okay.

539
00:29:23,580 --> 00:29:23,840
Awesome.

540
00:29:23,920 --> 00:29:24,280
Thank you.

541
00:29:24,380 --> 00:29:25,140
Any other questions?

542
00:29:25,340 --> 00:29:25,420
Yeah.

543
00:29:25,600 --> 00:29:25,940
Yeah.

544
00:29:26,000 --> 00:29:29,540
Kind of on a similar note, have you noticed any rhyme or reason for changing between

545
00:29:29,540 --> 00:29:31,560
mobile device and web reader?

546
00:29:31,800 --> 00:29:32,820
Like, why the results?

547
00:29:33,140 --> 00:29:34,240
How the results differ?

548
00:29:34,880 --> 00:29:35,980
Like, is it filtering out?

549
00:29:36,120 --> 00:29:36,200
Oh.

550
00:29:36,300 --> 00:29:37,920
Definitely location-based results.

551
00:29:38,040 --> 00:29:42,520
Like, I'll notice, like, people, like, near me if I, like, if I have some sort of, like,

552
00:29:42,540 --> 00:29:42,820
geo.

553
00:29:43,660 --> 00:29:46,000
If something is picking up geo.

554
00:29:46,200 --> 00:29:46,580
Yeah.

555
00:29:46,680 --> 00:29:47,840
If it's not even geotagging.

556
00:29:47,900 --> 00:29:47,960
Yeah.

557
00:29:48,020 --> 00:29:48,500
If it's picking up something.

558
00:29:48,500 --> 00:29:52,180
If it's picking up where I am, I'll notice a difference for that.

559
00:29:52,520 --> 00:29:53,940
The ads will definitely be different.

560
00:29:54,700 --> 00:29:55,400
Things like that.

561
00:29:55,560 --> 00:29:56,880
And they don't let you close those anymore.

562
00:29:57,060 --> 00:29:58,120
I used to be able to dismiss.

563
00:29:58,780 --> 00:30:00,000
And you can't do that.

564
00:30:00,380 --> 00:30:01,360
But, I mean, I do love Twitter.

565
00:30:01,460 --> 00:30:02,120
It's a great resource.

566
00:30:02,380 --> 00:30:03,420
But it, I said, it's wonky.

567
00:30:03,880 --> 00:30:04,960
It's wonky as all hell.

568
00:30:05,120 --> 00:30:08,480
And I just, I don't know that people fully understand all the capabilities it has.

569
00:30:08,640 --> 00:30:10,720
But you just have to be patient and try different things.

570
00:30:11,140 --> 00:30:11,980
And stuff like that.

571
00:30:12,020 --> 00:30:12,540
But it is weird.

572
00:30:12,640 --> 00:30:12,760
Yeah.

573
00:30:13,220 --> 00:30:13,540
.

574
00:30:17,700 --> 00:30:18,020
No.

575
00:30:18,120 --> 00:30:18,300
Sorry.

576
00:30:18,360 --> 00:30:18,480
I was asking.

577
00:30:18,500 --> 00:30:18,800
I just said.

578
00:30:19,060 --> 00:30:20,020
I apologize.

579
00:30:20,200 --> 00:30:24,200
I meant to add a disclaimer at the very beginning that all my background in this is just GUI

580
00:30:24,200 --> 00:30:24,480
based.

581
00:30:25,740 --> 00:30:27,520
So, no, I haven't done any of that.

582
00:30:27,720 --> 00:30:30,720
So when I gave this talk the first time, like I said, somebody said I didn't know Twitter

583
00:30:30,720 --> 00:30:31,440
had a website.

584
00:30:31,860 --> 00:30:35,640
And somebody else said to me, oh, well, now that I know all the stuff they can do, I can

585
00:30:35,640 --> 00:30:36,360
write better scripts.

586
00:30:36,780 --> 00:30:40,020
And so it took me showing them the GUI side of what it can do.

587
00:30:40,220 --> 00:30:44,400
So that's kind of what I hope to give to the InfoSec community is let me share my GUI wisdom

588
00:30:44,400 --> 00:30:44,820
with you.

589
00:30:44,860 --> 00:30:47,860
And then you guys can figure out, you know, what to do with it from there.

590
00:30:47,860 --> 00:30:49,200
So, if that helps.

591
00:30:49,300 --> 00:30:49,480
Thanks.

592
00:30:49,660 --> 00:30:50,300
Anybody else?

593
00:30:50,420 --> 00:30:50,580
Yes.

594
00:30:52,020 --> 00:30:52,460
.

595
00:31:02,720 --> 00:31:03,160
.

596
00:31:03,160 --> 00:31:04,800
Well, that would be under links.

597
00:31:05,060 --> 00:31:09,380
It's not as sophisticated as a Google search where you can specify file type.

598
00:31:09,880 --> 00:31:13,840
No, because you can't add a file type to a tweet anyway.

599
00:31:14,180 --> 00:31:15,660
It would be a link to something.

600
00:31:15,980 --> 00:31:17,660
Like, you can't add a PDF.

601
00:31:17,680 --> 00:31:17,840
.

602
00:31:17,840 --> 00:31:19,440
It would be linked somewhere.

603
00:31:20,500 --> 00:31:24,620
So if you search for links, because, like, remember I showed you the Securities and Exchange

604
00:31:24,620 --> 00:31:25,020
Commission?

605
00:31:25,320 --> 00:31:29,520
That was a PDF, but it was a link to a PDF that was on the Securities and Exchange Commission

606
00:31:29,520 --> 00:31:29,940
website.

607
00:31:30,720 --> 00:31:34,640
So it wouldn't understand, Twitter wouldn't understand if I was searching for a PDF, it

608
00:31:34,640 --> 00:31:36,060
would understand that I was searching for links.

609
00:31:36,900 --> 00:31:40,300
And then I was smart enough to know that that link was to a PDF, but it didn't.

610
00:31:41,760 --> 00:31:42,120
.

611
00:31:42,120 --> 00:31:42,200
.

612
00:31:42,200 --> 00:31:42,880
.

613
00:31:42,880 --> 00:31:42,980
.

614
00:31:42,980 --> 00:31:43,540
.

615
00:31:45,060 --> 00:31:45,460
.

616
00:31:45,460 --> 00:31:45,740
.

617
00:31:45,740 --> 00:31:46,480
Is that still around?

618
00:31:46,560 --> 00:31:47,440
I thought that went away.

619
00:31:47,600 --> 00:31:48,140
That is still around.

620
00:31:48,420 --> 00:31:48,720
.

621
00:31:48,920 --> 00:31:49,100
.

622
00:31:51,100 --> 00:31:51,500
.

623
00:31:51,500 --> 00:31:52,640
I am not sure.

624
00:31:52,740 --> 00:31:54,980
I didn't think it existed anymore.

625
00:31:56,680 --> 00:31:58,420
I hope no one is here from Periscope.

626
00:31:58,560 --> 00:31:58,900
Sorry.

627
00:31:59,720 --> 00:32:00,120
.

628
00:32:00,120 --> 00:32:00,720
.

629
00:32:00,720 --> 00:32:01,040
.

630
00:32:02,120 --> 00:32:02,520
.

631
00:32:02,520 --> 00:32:02,640
.

632
00:32:04,340 --> 00:32:04,740
.

633
00:32:05,180 --> 00:32:05,580
.

634
00:32:05,580 --> 00:32:05,660
.

635
00:32:15,640 --> 00:32:21,300
Yeah, if you can find it online, I'm sure Iron Geek, I think Iron Geek recorded it.

636
00:32:21,520 --> 00:32:27,080
I co-presented with Joe Gray at B-Sides Charm in April, and we did the battle for OSIN,

637
00:32:27,160 --> 00:32:28,680
are you Team GUI or Team Command Line?

638
00:32:28,900 --> 00:32:34,100
So the first half was I showed all my, not just Twitter, but other Google and social

639
00:32:34,100 --> 00:32:38,720
media stuff on the GUI end, and he came in and did the command line, and at the end we

640
00:32:38,720 --> 00:32:43,520
came together and did like a combined search, and yeah, we were like finding like who was

641
00:32:43,520 --> 00:32:46,180
doing a live video sort of, yeah, sort of thing.

642
00:32:46,380 --> 00:32:52,700
If you put filter, try filter periscope and see if that would work, and do that.

643
00:32:52,800 --> 00:32:55,940
I saw another hand over there somewhere.

644
00:32:56,080 --> 00:32:57,000
Oh, oh, yeah, okay.

645
00:32:57,580 --> 00:32:59,360
Can you try to filter by GitHub?

646
00:32:59,920 --> 00:33:03,100
I know there's a lot of people that have those in reference, but I think if they do

647
00:33:03,100 --> 00:33:04,000
have a...

648
00:33:07,020 --> 00:33:10,520
I'm not sure if it, I mean, it might fall under links still.

649
00:33:11,020 --> 00:33:15,580
I'm not sure that it would be smart enough to know GitHub versus, because it's just reading

650
00:33:15,580 --> 00:33:16,020
a link.

651
00:33:16,140 --> 00:33:21,300
I don't think that it can read where it's from necessarily, like, because when you did

652
00:33:21,300 --> 00:33:26,040
the source, you used the name so it knows to match the name with the name, but I don't,

653
00:33:26,040 --> 00:33:29,840
I mean, you could try source GitHub, but I don't know if it does that.

654
00:33:34,000 --> 00:33:35,960
Well, yeah, but I don't know if it knows GitHub, though.

655
00:33:36,000 --> 00:33:39,100
I don't know if it's, if, I mean, that's one of those things for that, like, developer

656
00:33:39,100 --> 00:33:43,320
blog, that I don't know if they've told Twitter to recognize that.

657
00:33:43,560 --> 00:33:45,140
Remember, I'm garbage in, garbage out, you know.

658
00:33:45,180 --> 00:33:49,580
If you don't, if you don't tell it to recognize GitHub, it's not going to recognize GitHub.

659
00:33:49,740 --> 00:33:54,620
They probably told it to recognize, like, the top five social media platforms, you know.

660
00:33:54,940 --> 00:33:55,640
So, yes.

661
00:33:55,940 --> 00:33:58,000
I know that part of this does work for the account.

662
00:33:58,600 --> 00:33:59,980
Could you repeat that again for everyone?

663
00:34:00,020 --> 00:34:00,360
Can you hear it?

664
00:34:00,420 --> 00:34:02,860
I know that that part itself does work for the account.

665
00:34:03,100 --> 00:34:03,940
So you can't...

666
00:34:07,680 --> 00:34:11,000
Can you get, tell, in the microphone, so tell everyone how to do that?

667
00:34:11,260 --> 00:34:11,500
Yeah.

668
00:34:11,760 --> 00:34:12,160
Sorry.

669
00:34:12,280 --> 00:34:16,540
So, if you play around with the Twitter API, it has a lot of the things you mentioned,

670
00:34:16,700 --> 00:34:21,500
and one of the things you definitely can do there is search for links based on the domain

671
00:34:21,500 --> 00:34:23,120
name or fragments of the URL.

672
00:34:23,480 --> 00:34:27,160
So you could do an API query for links to GitHub.

673
00:34:28,000 --> 00:34:28,400
Okay.

674
00:34:28,460 --> 00:34:28,640
Awesome.

675
00:34:28,780 --> 00:34:29,120
Thank you.

676
00:34:29,460 --> 00:34:32,980
Yeah, like I said, I haven't been a librarian for a year and a half because I just started

677
00:34:32,980 --> 00:34:33,920
my soccer.

678
00:34:34,000 --> 00:34:39,900
I got a job three weeks ago, so, yes, I am not on, I admit I am not super on top of some

679
00:34:39,900 --> 00:34:43,420
of the things, but that's a, it's a good foundation to get you started.

680
00:34:43,520 --> 00:34:46,900
That's basically just I wanted this talk to be, because so many people I talk to after

681
00:34:46,900 --> 00:34:50,000
I give these things don't realize what all Twitter can do.

682
00:34:51,320 --> 00:34:51,880
So, yeah.

683
00:34:51,940 --> 00:34:54,180
So, I hope you liked it, and if you want candy, I have more candy.

684
00:34:54,340 --> 00:34:56,260
I don't want to take this home, so please take the candy.

685
00:34:57,300 --> 00:34:57,940
And, awesome.

686
00:34:58,100 --> 00:34:58,880
Thank you so much for coming.

687
00:34:59,020 --> 00:34:59,420
Thank you.

688
00:35:03,020 --> 00:35:03,660
Thank you.

689
00:35:03,660 --> 00:35:03,980
Thank you.

690
00:35:04,000 --> 00:35:04,380
Thank you.