Impact of Online Intelligence Searches part II

Monday, May 17, 2010

Bozidar Spirovski


In our previous article - "Open Source Intelligence Operations Part I" we looked at the generic process of information gathering. But what is this process looking for? The answer to this question is important to all parties:

  1. to the investigator - for proper focusing of his/hers efforts
  2. to the possible targets - in order to properly defend against Open Source Intelligence
So here are the items that the investigator is looking for when employing Open Source Intelligence against a potential target, and the methods of minimizing the possibility of someone discovering something:

The final goal of any intelligence action is to obtain information that can be sold or used as competitive advantage. This can be as simple as a password, or as complex as plans for a corporate takeover.

At the information gathering level, this translates into:
  1. Content of files indexed by search engines - In the ideal intelligence world, everything is contained in a single page document that can be scanned or downloaded from the internet. Although such documents won't surface on the internet unless someone is utterly dumb, bits and pieces of information can be found from files that have found their way on the web and got indexed by the search engines. In order to make such pieces of info useless, hire a person to perform regular 'Google Hacking' to find such documents. Bear in mind that once documents are on the internet and get indexed, you cannot destroy all publicly available copies. Instead, change the information within your company to render the public information useless or false. . 
  2. Operational or Potential Business Relationships - web sites, news articles, corporate newsletters of partners and providers can contain names and sites of the target company, even forum and support site posts . While these are harmless by themselves, using these names the investigator can establish that there is some relationship between them, even the nature of the relationship. This can be used in a competitive bid, in social engineering or simply leaked to the public. There is no real protection over such information, except of being aware that such information is 'in the wild'
  3. Real Person Identities - Publicly available names and contact info of any personnel related to the target are a potential gold mine. With the advent of social networks, once you know some one's name, the investigator can proceed with detailed investigation of such persons, and attempts at breaching of their credentials by trying common password combinations (pet names, birthdates, phone numbers etc). Most companies actually prefer to publish real person's names and contacts in the effort to appear closer to their potential clients and partners, so there is no direct protection. Much like in point 1, you should hire a person to perform regular analysis of which names are publicly available, and what information is available on such persons, with a combined penetration test on their accounts. You can also institute a policy and awareness trainings for such persons to make them aware of their exposure.
  4. Relationship Context - this is merely an extrapolation of real identities, business contacts and online communication. It can give the investigator an insight into 'who receives order from whom' or 'who is close to whom'. Such insight is crucial for social engineering attacks. Controlling is actually controlling the previous 3 points.
In summary, Open Source Intelligence is going to collect information about you and/or your company. You can do little to prevent it, but you can do much to render such information of very little value to anyone.


Possibly Related Articles:
Enterprise Security Vulnerabilities
Intelligence Gathering
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.