Hi, and welcome to the last video of this section called osint
threats. And countermeasures. This
is the more advice like approach to osint where
I will bring up different threats and countermeasures, you
can use to address Open Source intelligence questions.
Just to be clear. There are a lot more
threats and countermeasures out there than
we will mention here, but it's always in.
Approach a good starting point makes a difference when
things get more complicated.
First, let's talk about threats, probably on
this slide. You are seeing some familiar things. But
please allow me to go through each one of them. First.
He's hacking album goat into the HTML
etymology of the word rather to
Simply explain this threat. So hacking is
a set of skills and methods for breaching defenses of
a computer system, a network or a human. Although
hacking does not have to mean something bad, but
nowadays, most references to hacking.
Again, hackers goes to the unlawful activities of
cyber criminals, whose motivation could
be financial gain politically protest information-gathering
AKA spine and similar
things. Also, it is very important here because
based on the ocean to research this hacking activities
can get pretty much successful.
Next is social engineering. This is one of my favorite topics
because it correlates to the previous owners in
threats of hacking humans that I have mentioned. Social
engineering is the psychological manipulation of
people into performing actions or divulging
confidential information. Here
is where the word manipulation got its
bad reputation. Actually. What I'm doing now
is manipulating you we talking and presenting about
open source intelligence, the difference.
That my goals are not malicious. So everything is
manipulation. It just depends what
kind of looking glass are you using good or
bad after social engineering comes
fishing, which is almost a natural extent of social
engineering because it's a method where
fraudulent attempt is made to obtain sensitive
information in an electronic communication. You
probably get this kind of emails on
a daily basis only you don't respond to
Them or your email protection is doing a
really good job. I want to share a phishing email example
on which I almost fell for a recently. I Got
a cpanel notification that my email email
email inbox was full. That email
is a part of some other system that I use and
I usually get this kind of messages once
every six months or so. My first
reaction is to connect to the cpanel to check
my inbox storage. I did this not by
clicking on the
Link in the email and that is one of the countermeasures I
can give out right now. Never click rather go
and login separately to some service. So
I logged in my cpanel server. And
so that my inbox was not full at all.
Then it got clear to me. What a great phishing email
as you can see the sender. It
does not compute and it is fake. Our
fourth big threat is malware. So
Mouse.
Where is a software that is intentionally hostile
intrusive or damaging to a computer or
network? You have probably heard of malware like,
viruses Sorrento, very rootkits, spyware and
so forth. I think this is
pretty explicit self-explanatory. The
key thing here is that malware is usually deployed or
delivered through methods from the previous mentioned, hosting
threats, social, engineering and fishing. Next,
our data and information breaches, and
I try to separate data from information here. And please
allow me to tell you what is the difference between data and
information through an example. Here are the numbers 267
22:31 and
46 do these numbers mean
anything to you? The chances are very
slim that they do. So these numbers that
I have just said are just that numbers
some values.
And for them, we can say that they are data. These
numbers are pretty worthless. And and that's
data data does not have any meaning and
it doesn't have some real value. But what if I
told you that these numbers are the next Vinnie, the lottery numbers.
Now this data becomes information
and a very valuable information. If I might add
that is a difference, the context information
is data, but with context
around it.
And now to get back to our data and information breaches
and leaks a data breach is intentional or
unintentional release of secure or of private
/, confidential information to
an untrusted environment. That untrusted environment
is, of course, the public internet realm, as,
you know, breaches and leaks are almost weekly
think. Now, they happen as a targeted intentional
activity, like a planned Cyber attack and
they happened unintentionally.
Li, like exposing some database or a server on the internet with
a week or default. Password, the
last thread that I have listed here. Although there are
a lot of others out there is misinformation and
disinformation. These are false
rumors, insults pranks, hoaxes, and
different propaganda from different sources, like social media
and also, as our previous threat, they
can be accidental or deliberate misinformation
and disinformation are
The same things and people have the tendency to use these words
as a synonyms. Please. Allow me to explain the
difference.
Misinformation is when people spread or
share some information for which they believe is
true. A simple example of misinformation is
saying that, the, a simple example of misinformation is
saying that the Earth is flat. And
this information is shared with
a goal of misleading, others and doing some harm with
intentional wrong information. A typical example
of this information are the fake news phenomena. Allow
me to provide you with an example.
Remember the unfortunate beat Notre Dame firing 2019
when it happened. People
upload videos to YouTube and YouTube
classify. This video material as fake and
did not announce and spread the news as they should have. It
took about an hour for the YouTube and Engineers to
sort this problem out here a machine made
a mistake, but only because humans gave him
instructions what to do so we can be free to
say that humans spread the information.
This information about this.
So we can be free to say that a human spread the
disinformation about this.
Now, to talk about the open-source countermeasures, or
to better say what can we do to protect ourselves or
our organizations? I have listed in
my option opinion, 6.
The most important things we can all do first
is education parentheses and
testing education, educating employees and
yourself. How to successfully address cybersecurity
threats by conducting continuous awareness,
trainings and email phishing test. I
really think that through education. We have a chance to make
a world and our it system, a better and safer place.
I have also included testing because
through testing, like, fishing testing,
Which I conduct you can get a great Insight.
How good is your cyber posture. Next
is online, privacy hygiene here,
since open source, intelligence, main source of information is
the internet and there you can find endless
amounts of anything on anyone just
because their online privacy. Hygiene is not that good.
This includes careful, sharing and posting
personal information online using a safer web
browser like Firefox and brave.
They've also using privacy and security web browser
extensions. For example, https everywhere,
extension, that forces you to only visit HTTP
web sites, then maybe
using disposable email services
like 33 mail.com. This
is a service which allows you to not to give out your
real email, every time some service or someone. Once
you're a real email rather use a great for
Dean Elias. After that, I
have to mention using a virtual private Network or
VPN to protect your online identity. A
great example is proton. VPN.
It looks like it is secure. It has no lock policy
and it is fast. And my
favorite thing about proton VPN is that they're a company based
in Switzerland, then be sure to
use an anti-virus software. I personally use
f-secure for this and have good
experience with it. My advice on antivirus is
it is better to use the inbuilt one
or a free antivirus. Then. No kind
of been, no, kind at all.
I also have to mention the it system security hardening.
This is dedicated to making your it system
harder to hack. You
should surely use the antivirus software after
that. The firewall actually, today's next-generation firewalls
have antivirus engines included
in themselves. So I encourage you to check that also,
then the use of vpns a
Crip ssion, make regular software updates,
because hackers use it.
Vulnerabilities of a system and a software to get in.
Do appropriate network security like a use of
a good Wi-Fi password or Port based network
access policies, the 802.1
X standard also
do not forget about physical security, like access control
cameras, even simply putting a
webcam can cover is a good physical and
privacy habit. And next countermeasure is
password management. And by that,
I mean, on the procedure of where are the password, stored,
how they look like? Are they complex enough? And
how are they used using a password manager
makes all the difference. A good example is the
password manager called keepass XC. This
is an open source, cross-platform password
manager, which you can use on all the platforms to store
your most valuable logins. It also generates
passwords. So you don't have to worry about making passwords
up. You only have to remember one.
Big password. And that is it. I could make a separate
course for passwords, but I will give you just one advice when
you create your passwords use a passphrase, just
search it on the web. The last two
countermeasures itss Discovery and leaks
and breaches monitoring are actually very much
tied together because a leak or a breach
usually happens. If your assets get exposed on
the internet, you can and should conduct
at least yearly discoveries.
Cans of your it assets. A software used
for that is an example nmap. I
think that your personal information is also an
asset but here we focus only on
the system. Side of assets monitoring of leaks
and breeches is also very important with
these methods and techniques. You can do a cross referencing
of email, addresses and usernames to
check. Have you or your company being a part of
some data leak or a breach.
I have to put a little disclaimer here because this info is only
for educational purposes. The main reason is because
all these publicly available content concerning
leaks and data breaches was
acquired by criminals. I cannot give you legal advice
on this since I'm not an attorney, but I
can make a suggestion to be careful and to ask for advice if
you come across something potentially harmful for you and people
around you.
I will mention a few of the online sources of, for
this kind of information. First is have I
been Pond? Which is the probably, which is probably the
golden standard nowadays to check if your email or username
has been a part of any known data breach. After
that is leak Peak.com, which is
a UK site or at least that's what they say. They
are. And I like this one because you can also search
for an email or username and it will show you the first
three characters of a password and from which
database /. Breach, it comes from after
that. I will mention we leaked info.com, which
is a very popular service that grants you to see
password details. If you pay, which I wouldn't recommend
current. Currently this side is not active,
because the domain has been seized by the FBI. I
put this on the list, just for you to understand, the seriousness of
this kind of sites and data you are after. And
also, I will mention ghost project that f.
Are according to the owners. We
are talking about the 41 GB dump,
that was found in late 2017. In
an underground Community Forum. You can
search for emails or usernames and they will come with
a clear text password if available. Also,
there is a paid version to see the whole data,
which I also wouldn't recommend for you to
check out in that way. Almost all of these
sites offer a paid feature to unlock me.
Maybe passwords usernames emails, give
you out some advanced search filters. And
so on post, personally, speaking. I would
not recommend paying for access to any of these data
because of the privacy and security issues that could arrive
at your table. Be aware of the legal repercussions
because learning how to search
for these data is totally different from using that
found data to access someone's account, or
do any other malicious activity.
These countermeasures are not things that can be
implemented, very fast, especially if
you are building a security aware company through employee
education. The main thing here is that
these often little changes in your cyber habits,
make makes it exponentially harder
for the hackers to even
approach. Your it system, a typical example
is a good long password. Now,
for the oh, Cynthia countermeasures, I would like to share too.
Cool sources of two lists. This is
used, not only for Euro Cent investigations, but also
as a countermeasure method, they
are called the ocean, framework.com, and
fagin. Finder.com. Now,
allow me to show you how each of these web hosts and
resources look like first the website hosting
framework.com, which was created by. Mr. Justin
nordine in your favorite Olson, browser
in my case is the brave browser.
To the osint framework.com address,
as you can see here.
When you click on any of the Care categories, like
the username email, addresses
domain name. A lot of
useful resources will appear on the screen in the form of
a subtree in my example. I'm interested in
the host discovery.
So I will choose IP addresses.
Host / Port Discovery. And
one of the tools listed is the nmap which
we discussed earlier.
When you click on the target, when you click, when
you click on the table?
Searching for users email addresses, IP addresses, or social network
details become super easy. Easy. As you have all
the tools available in one single interface. It's
just like a giant hose in bookmarks Library. The
second resource. Web resource is called
fagin, finder.com
That will develop by. Mr. Michael Fagan. I
will cite description from the website, S
Finder page brings together, the largest broadest
and most significant tools for finding information. The
focus here is on resources. Anyone
can access but also included are
imported ones that are restricted such as, with
fees or to members of a library. And
as I have said this both,
Resources are used for the investigation part
of post sent and the countermeasures part to protect yourselves.
I hope I give you a good understanding of
the introduction part of Open Source, intelligence. As
you can see, there are a lot of things to
consider here, especially when you get in the tools and
techniques phase of your investigations that
could easily become a potential rabbit hole
because you can get easily lost in the vast data.
You can acquire.
Now, we are going to start with the first Hands-On approach, or
better to say, a lab with the section environment
preparation, where we will install and
prepare our operating system to do investigations in
the correct way. See you in the next video.