The document discusses using online activity as digital fingerprints to improve spear phishing techniques, with a focus on using social network data and natural language processing. It introduces 'μphisher,' an open-source tool developed to collect and analyze social media data to profile potential targets for phishing. The document outlines the methodology, challenges, and future improvements for the tool and its application in cybersecurity.

1. Using Online Activity as Digital
Fingerprints to Create a Better
Spear Phisher
Joaquim Espinhara and Ulisses Albuquerque
JEspinhara@trustwave.com UAlbuquerque@trustwave.com

2. • Introduction
• Motivation
• Background
• HowStuffWorks
• µphisher
• Demo
• Future Work
• Conclusion
Agenda

3. • Joaquim Espinhara
– Security Consultant at Trustwave Spiderlabs
• Ulisses Albuquerque
– Coder for offense & defense… as long as it’s fun!
– Lab Manager at Trustwave Spiderlabs
About us

4. INTRODUCTION

5. OUR MOTIVATION

6. • Why?
• Tools available
Our Motivation

7. BACKGROUND

8. • Social Networks
• Social Engineering
• Data Pre-Processing
• Natural Language Processing - NLP
Background

9. • Social Networks
Background
Facebook
Twitter
LinkedIn
Others

10. • Social Networks
– Communication channel for keeping in touch with
someone (Facebook, Twitter)
– Media sharing (Instagram)
– Specialized networks (Foursquare, GetGlue, TripIt)
Background

11. • Social Engineering
– Phishing
Background
http://www.d00med.net/uploads/0d832c77559a2070a766f899e7eg783.png

12. • Data Pre-Processing
– What is it?
– How do we use it?
Background

13. • Data Pre-Processing Flow
Background
Raw data set
"Had lunch with
@urma and
@jespinhara today
#tgif #lunch"
Data cleaning
"Had lunch with
@urma and
@jespinhara
today"
Data integration
"Had lunch with
@urma and
@jespinhara
today"
Data
normalization
"Had lunch with
@urma and
@jespinhara today
(2013-06-05)"

14. • Natural Language Processing – NLP
– What is it?
– How do we use it?
– Text analysis
Background

15. HOWSTUFFWORKS

16. Identifying
the subject to
profile
Collecting
social
network data
Analyzing and
building the
profile
Our Approach

17. • The Unknown Subject (Unsub)
Our Approach
Joaquim
Espinhara
@jespinhara
(Twitter)
joaquim.espinhara
(Facebook)
uid=12345
(LinkedIn)

18. • Data Collection
– Social Network IDs
– Official APIs
– Web Scraping
– OAuth
Our Approach

19. • Data Collection - Twitter
Our Approach
Application ID
(µphisher)
User ID
(@jespinhara)
Twitter
@urma
@effffn
@SpiderLabs

20. µPHISHER

21. • Reference implementation
• Goals
– Validate potential unsub content
– Assisted textual content input
µphisher

22. • Web Application
• Twitter only (for now)
• Open Source (GPLv3)
µphisher

23. µphisher
Ruby on
Rails
MongoDB
+ Mongoid
DelayedJob
OAuth
treat
(Stanford
NLP Core)
µphisher

24. µphisher
Authentication
Unsub
Registration
Data Source
Registration
Data
Collection
Work Set
Definition
Work Set
Analysis
Unsub Profile

25. DEMO
(FINGERS CROSSED)

26. LIMITATIONS

27. • Support for additional data sources
• Machine learning
• More metrics and feedback for assisted input
• Filtering presets
• Adequate handling of quoted content
Future Work

28. CONCLUSION

29. THANK YOU!
@urma@jespinhara