Tactical Information Gathering

Christian Martorella Source Conference Barcelona 2009

Tactical Information Gathering Christian Martorella Source Conference Barcelona 2009

Who am i ? Christian Martorella Security Services S21sec CISSP, CISA, CISM, OPST, OPSA, C|EH OWASP WebSlayer Project Leader Edge-Security.com

Information Gathering “Is the collection of information before the attack. The idea is to collect as much information as possible about the target which may be valuable later.”

Tactical “Designed or implemented to gain a temporary limited advantage” Wikipedia

I.G Why use it? It’s what the real attackers are doing Attackers doesn’t have a restricted scope Knowing what information about you or your company is available online Spear Phishing: 15.000 infected users, as results of 66 campaings.

I.G what for? Infrastructure: Information for discovering new targets, to get a description of the hosts (NS,MX, AS,etc), shared resources, applications, software, etc. People and organizations : For performing brute force attacks on available services, Spear phishing, social engineering, investigations, background checks, information leaks

Typical Pentesting Methodology Post- Cover Write I.G Scan Enumerate Exploit Exploit Tracks report

What everyone focus on: Enumera Post- Cover Write I.G Scan Exploit te Exploit Tracks report

Real world Methodology I.G Discover what makes the company money Do whatever it Steal it takes... Discover what is valuable to the attacker

Types of I.G

Types of I.G Passive Active Semi Passive

Where / how can we obtain this kind of info?

Obtaining info - Old School way DNS Zone Transfer (active) DNS Reverse Lookup Search engines (active) PGP Key Servers DNS BruteForce (active++) Whois Mail headers (active) smtp Bruteforcing (active++)

Obtaining info - Old School way Active Passive DNS Zone Transfer (active) DNS Reverse Lookup Search engines (active) PGP Key Servers DNS BruteForce (active++) Whois Mail headers (active) smtp Bruteforcing (active++)

New sources for I.G

Obtaining - New sources Web 2.0 - Social Networks and Search engines (passive) Metadata (passive) Private data (passive paid) Intelius, Lexis Nexis

Obtaining people info - New sources Professional and Business Social networks

Obtaining people info - New sources

Obtaining people info - New sources Current Job Pasts Jobs Education Job description Etc...

Obtaining employees names from a company

Linkedin I.G example

Linkedin I.G example I L FA

Obtaining people info - New sources

Obtaining Emails from a company

Google Finance & Reuters

People information:

People search

People search Name Username Email Phone Business

Nick name / username veriﬁcation

Private data - pay per view

Microblogs Small posts up to 140 characters

Bookmarks

Bookmarks A IL F

Reverse Image search Pic from “Novartis” search on TwwepSearch

WikiScanner When you edit the wikipedia: You can edit leaving your username You can edit anonymous using your IP address

WikiScanner Company IP ranges Anonymous Wikipedia edits, from interesting organizations Provide an ip for a wikipedia username http://wikiscanner.virgil.gr/

WikiScanner - IP ranges

WikiScanner - Wikipedia edits

Poor Man Check User Provide an ip for a wikipedia username

New sources - Metadata Metadata: is data about data.

New sources - Metadata Metadata: is data about data. Is used to facilitate the understanding, use and management of data.

Obtaining more data - Metadata Provides basic information such as the author of a work, the date of creation, links to any related works, etc.

Metadata - Dublin Core (schema) Content & about the Intellectual Property Electronic or Physical Resource manifestation Title Author or Creator Date Subject Publisher Type Description Contributor Format Language Rights Identiﬁer Relation Coverage

Metadata example

Metadata - Images EXIF Exchangeable Image File Format • GPS coordinates • Time • Camera type • Serial number • Sometimes unaltered original photo can be found in thumbnail Online exif viewer.

Metadata - example

Metadata - example logo-Kubuntu.png logo-Ubuntu.png software - www.inkscape.org software - Adobe ImageReady size - 1501x379 size - 1501x391 mimetype - image/png mimetype - image/png

Metadata - example logo-Kubuntu.png logo-Ubuntu.png software - www.inkscape.org software - Adobe ImageReady size - 1501x379 size - 1501x391 mimetype - image/png mimetype - image/png :/

Metadata - EXIF- Harry Pwner Deathly EXIF?

Cat Schwartz - Tech TV

Cat Schwartz - Tech TV I L FA

Washington Post Botmaster location exposed by the Washington Post

Washington Post Botmaster location exposed by the Washington Post SLUG: mag/hacker DATE: 12/19/2005 PHOTOGRAPHER: Sarah L. Voisin/TWP id#: LOCATION: Roland, OK CAPTION: PICTURED: Canon Canon EOS 20D Adobe Photoshop CS2 Macintosh 2006:02:16 15:44:49 Sarah L. Voisin

Washington Post Botmaster location exposed by the Washington Post SLUG: mag/hacker DATE: 12/19/2005 PHOTOGRAPHER: Sarah L. Voisin/TWP id#: LOCATION: Roland, OK CAPTION: PICTURED: Canon Canon EOS 20D Adobe Photoshop CS2 Macintosh 2006:02:16 15:44:49 Sarah L. Voisin There are only 1.500 males in Roland Oklahoma

Metadata Ok, I understand metadata... so what?

Metagooﬁl Metagooﬁl is an information gathering tool designed for extracting metadata of public documents (pdf,doc,xls,ppt,etc) availables in the target/victim websites.

Metagooﬁl

Metagooﬁl Workers User names Server names names Software Paths versions + Date Mac Address

Metagooﬁl Workers User names Server names names Computer Software Paths names versions + Date Mac Address

Metagooﬁl

Metagooﬁl site:nasa.gov ﬁletype:ppt

Metagooﬁl Downloaded ﬁles

Metagoofil Downloaded files ppt 1 pptx 2 parsers / Results.html doc 3 filtering Libextractor docx 3 Hachoir Regexp pdf n Own libs

Metagooﬁl - results

Metadata - The Revisionist Tool developed by Michal Zalewski, this tool will extract comments and “Track changes” from Word documents. http://download.microsoft.com/download/3/4/9/349c2166-4d53-43f6-b1fd-970090e23216/PARTNER/MSFreeShop.doc

Metagooﬁl & Linkedin results Now we have a lot of information, what can i do? • User proﬁling

Using results

Using results User proﬁling • User list creation John Doe john.doe jdoe j.doe johndoe johnd john.d jd doe john

Using results User proﬁling • User list creation John Doe john.doe jdoe j.doe johndoe johnd ATTACK! john.d jd doe john

Using results

Using results Password proﬁling Dictionary creation: words from the different user sites magic serra angel necropotence Shivan dragon elf brainstorm ... ...

Using results Password proﬁling Dictionary creation: words from the different user sites magic serra angel necropotence Shivan dragon Brute force elf ATTACK brainstorm ... ...

One password to rule them all

Maltego the ultimate I.G Tool

Other examples

Phone in sick and treat himself to a day in bed. Kyle Doyle's Facebook proﬁle makes it quite obvious he was not off work for a 'valid medical reason'

Phone in sick and treat himself to a day in bed. I L FA Kyle Doyle's Facebook proﬁle makes it quite obvious he was not off work for a 'valid medical reason'

Was shown the door after posting that her job was 'boring' on her Facebook page

I L FA Was shown the door after posting that her job was 'boring' on her Facebook page

More than meet the eyes

Daily life I.G Looking for a Housekeeper on Craiglist, 3 interesting resumes came up:

Daily life I.G Looking for a Housekeeper on Craiglist, 3 interesting resumes came up: Myspace page, applicant drinking beer from a funnel

Daily life I.G Looking for a Housekeeper on Craiglist, 3 interesting resumes came up: Myspace page, applicant drinking beer from a funnel Local police, applicant arrested 2 years before for shoplifting

Daily life I.G Looking for a Housekeeper on Craiglist, 3 interesting resumes came up: Myspace page, applicant drinking beer from a funnel Local police, applicant arrested 2 years before for shoplifting Personal blog, saying that she is applying for menial jobs, and will quit as soon she sells some paintings

Final thoughts Be careful what you post/send, all stay online Think twice what you post Check the privacy conﬁguration of your tools/sites Too much information, difﬁcult to classify This is growing, more information is being indexed, more search engines

References www.edge-security.com blog.s21sec.com www.s21sec.com carnal0wnage.blogspot.com www.gnunet.org/libextractor lcamtuf.coredump.cx/strikeout/ www.paterva.com http://sethgodin.typepad.com/seths_blog/2009/02/personal-branding-in-the-age- of-google.html laramies.blogspot.com http://www.eweek.com/c/a/Security/Washington-Post-Caught-in-Metadata-Gaffe/ Chris Gates Carnal0wnage Brucon 2009 Presentation http://www.neuroproductions.be/twitter_friends_network_browser/

Thank you for coming cmartorella@s21sec.com http://laramies.blogspot.com cmartorella@edge-security.com http://twitter.com/laramies