osint –open source intelligence€¦ · osint –origins •the term 'osint' originates...

Pattern Recognition and Applications Lab

Universitàdi Cagliari, Italia

Dipartimento di Ingegneria Elettrica

ed Elettronica

OSINT – Open Source Intelligence

Giorgio Fumera

Source: Davide Ariu – [email protected]

http://pralab.diee.unica.it

Intelligence

• Definition: the process and product of identifying, collecting, analyzing and refining information to make it useful to policymakers in making decisions — specifically, about potential threats to national security

• Intelligence gathering– clandestine operations, secret or covert means, known only at the highest levels of

government– information that is widely available

• Can be used for both legitimate and nefarious purposes

https://www.fbi.gov/about-us/intelligence 2


Intelligence Collection Disciplines (*INT)

Five intelligence collection disciplines:1. HUMan INTelligence (HUMINT): the process of gaining intelligence from humans or

individuals by analyzing behavioral responses through direct interaction2. SIGnal INTelligence (SIGINT): electronic transmissions that can be collected by ships,

planes, ground sites, or satellites – Communications Intelligence (COMINT): interception of communications between two parties

3. IMagery INTelligence (IMINT), or PHOTo INTtelligence (PHOTINT)4. Measurement And Signatures INTelligence (MASINT): advanced processing and use of

data gathered from overhead and airborne IMINT and SIGINT collection systems– TELemetry INTelligence (TELINT): data relayed by weapons during tests– ELectronic INTelligence (ELINT): electronic emissions picked up from modern weapons

and tracking systemsAn example: identifying chemical weapons

5. Open Source INTelligence (OSINT): the process of gathering intelligence from publicly available resources (including Internet)

3


OSINT - Definitions

• Open Source Information (OSINF): publicly available data –not necessarily free

• OSINF collection: monitoring, selecting, retrieving, tagging, cataloguing, visualising & disseminating data

• Open Source Intelligence (OSINT): proprietary intelligence recursively derived from OSINF, as a result of expert analysis

Slide credit: C.H. Best, JRC – European Commission

4


OSINT – Origins

• The term 'OSINT' originates from Security Services• The practice of using OSINT to build intelligence is not new

– Italy: OVRA (Organizzazione per la Vigilanza e la Repressione dell'Antifascismo) used OSINF since 1930

– Cold war: American and German secret services vs Russia• HUMINT, SIGINT and Classified information was largey preferred• Paradigm change:

– 9/11: OSINT could have been use to foresee attacks– fast growth of the Internet, appearance of Social Networks

• The 9/11 Commission Report:The need to restructure the intelligence community grows out of six problems that have become apparent before and after 9/11– Structural barriers to performing joint intelligence work– Lack of common standards and practice across the foreign-domestic divide– Divided management of national intelligence capabilities– Weak capacity to set priorities and to move resources– Too many jobs– Too complex and secret

5


OSINT – Who is Involved?

Tool Builder/Developer

MinisterGeneral

CommissionerCEO

Analyst

Classified Information

OSINF Collector/Researcher


6


Who uses OSINT?

• Security Services, Law Enforcement Agencies and Military Bodies

• Governmental Organisations– EU, NATO, AU Situation Centre– IAEA – Nuclear Safeguard– UN Department for Peacekeeping Operations– World Health Organisation– NGOs

• All the Large Companies

7


OSINT Sources of Information - 1• Media

– Newspapers, magazines, radio, television, etc.

• The Internet– News, Social Networks, Blogs, Video sharing sites, Thematic sites, etc.– Deep Web (not indexed by traditional search engines)

• Dynamic Web Pages • Sites behind Log-in• Sytes with a ROBOT.txt file properly configured

– Dark Nets/Web (TOR, I2P)

• Subscription Services– LexisNexis (http://www.lexisnexis.com) is a corporation providing computer-assisted legal

research as well as business research and risk management services. During the 1970s, LexisNexis pioneered the electronic accessibility of legal and journalistic documents

– Factiva (http://www.dowjones.com/products/product-factiva/) is the world’s leading source of premium news, data and insight, with access to thousands of premium news and information sources on more than 22 million public and private companies

– Jane's Information Group (www.janes.com) is a British publishing company specialising in military, aerospace and transportation topics

– BBC Monitoring (http://www.bbc.co.uk/monitoring) includes news, information and comment gathered from the mass media around the world for service subscribers

8


OSINT Sources of Information - 2

• Commercial Satellites– http://www.euspaceimaging.com/applications/fields/security-defense-intelligence– https://www.digitalglobe.com/markets/defense-and-intelligence

• Public Data– government reports, budgets, demographics, hearings, legislative debates, press

conferences, speeches, marine and aeronautical safety warnings, environmental impact statements and contract awards

• Professional and Academic– conferences, professional associations, academic papers, and subject matter experts

• Open Data– https://open-data.europa.eu/en/data– http://www.dati.gov.it– http://www.datiopen.it– Geospatial Data Providers – for an exhaustive list see:

https://en.wikipedia.org/wiki/List_of_GIS_data_sources

9


*INT Target: individuals

• Potentially interesting information– Physical locations– OSN profiles for checking on relationships, contacts, content sharing, preferred web

sites, etc. – E-mail addresses, users’ handles and aliases available on the Internet including

infrastructure owned by the individual such as domain names and servers– Associations and historical perspective of the work performed including background

details, criminal records, owned licenses, registrations, etc. This data is categorized into public data provided by official databases and private data provided by professional organizations

– Released intelligence such as content on blogs, journal papers, news articles, and conference proceedings

– Mobile information including phone numbers, device type, applications in use, etc

Source: Targeted Cyber Attacks Multi-staged - Attacks Driven by Exploits and Malware, Elsevier, 2014 10


*INT Targets: Corporates and Organisations

• Potentially interesting information– Determining the nature of business and work performed by target corporates and

organizations to understand the market vertically– Fingerprinting infrastructure including IP address ranges, network peripheral devices for

security and protection, deployed technologies and servers, web applications, informational web sites, etc.

– Extracting information from exposed devices on the network such as CCTV cameras, routers, and servers belonging to specific organizations

– Mapping hierarchical information about the target organizations to understand the complete layout of employees at different layers including ranks, e-mail addresses nature of work, service lines, products, public releases, meeting, etc.

– Collecting information about the different associations including business clients and business partners

– Extracting information out of released documents about business, marketing, financial, and technology aspects

– Gathering information about the financial stand of the organization from financial reports, trade reports, market caps, value history, etc.

Source: Targeted Cyber Attacks Multi-staged - Attacks Driven by Exploits and Malware, Elsevier, 2014 11


Domains registered by criminals for• counterfeiting goods• data exfiltration• exploit attacks• illegal pharma• infrastructure (ecrime name resolution)• malware C&C• malware distribution, ransomware• phishing, business email compromise• scams (419, reshipping, stranded

traveler…)

12

*INT Target Modes – Investigating cyber-attacks


OSINT Processes

Collect Transform Analyse Visualise& Report Collaborate


• Multilingual Information Retrieval

• Search• Crawl• News feeds

• Machine Translation

• Geo-tagging• Translation• Entity Extraction

• Entity Resolution

• Link Analysis• Relationships• Geolinking• Trends

• Statistics

“Connecting the dots”

• Networks• Relations• Time graphs

• Maps

“Generating actionable intelligence”

• Intel Wiki• IM• Case DB

• Publish

TECHNICAL ISSUES• Data Mapping• Data Deduping• Data Cleansing• Data Conversion• Data Linking• Data Normalisation

13


Information Collection – Issues (1)

Textual Information• How can I search it?

– Search Engines• General: Google, Yahoo, Bing, Baidu (Chinese, Japanese), Sogou (Chinese), Soso.com

(Chinese)• Thematic:

– Computers and Devices - Shodan– Maps – Bing, Google, Nokia, Yahoo! Maps– People - Spokeo– Source Code – Koders, Krugle, Google Code Search

– Libraries (e.g., Lexis Nexis, IEEE Xplore, ACM Digital Library)

• How can I extract it?– API – information access constraints; subject to change; platform specific– Scraping (ad-hoc source code for each platform; noise has to be removed; open

solutions exist à need to merge results)

14


Information Collection – Issues (2)

Non-textual Information (extraction difficult to automate)• Images

– People (who)? Places? Texts? Objects?

• Videos– People (who)? Places? Text? Objects? (same as for images)– Video contains audio?

• Transcription• Translation• Who are the speakers?

• Audio Traces– Transcription– Translation

• Other files– e.g., executables files; proprietary formats

15


Language Issues (1)Information Collection

16

• Culture• Art• Religion-Thought• University

Howzeh

• Hi-Tech• Health-Environment• Society• Economy• Markets

• Sport• Politic• International• Provinces• Photo• Video

• Magazine• Short news



17

https://en.mehrnews.com/

Slide Credit: C.H. Best, JRC – European Commission

• News• Culture• Literature• Religion• University• Social• Economic• Political• International• Sport• Nuclear• Photo

http://www.mehrnews.com/



18

Slide Credit: C.H. Best, JRC – European Commission


Social Network Analysis – IssuesInformation Collection

• Privacy Restrictions– third party application developers create applications that ask for unneeded permissions

to gain additional information• Platform Restrictions

– based on social relationships, user-based privacy settings, rate limiting, activity monitoring, and IP address based restrictions

• Data Availability– users did not provide information– the target information exists, but is "hidden" by privacy and platform restrictions

• Data Longevity– relationship dynamics change frequently, profiles are updated constantly– each data access is a snapshot of the social graph at collection time

• Legal Issues– disallowing screen scrapers and other data mining tools through ToS agreements, but

legal enforceability remains unclear• Ethical Issues

– Crawling social networks for personal information is an ethically sensitive area

19

Source: B. R. Holland, Enabling Open Source Intelligence (OSINT) in private social networks


World Map of Social Networks (1)Information Collection

20


World Map of Social Networks (2)Information Collection

21


Linguistic RequirementsInformation Transformation

Foreign language skills and knowledge proficiency: – Transcription: both listening and writing proficiency in the source language are essential– Interpretation: both listening in the source language and speaking proficiency in the

target language are essential– Translation: bilingual competence is a prerequisite for translation.

Linguists must be able to• read and comprehend the source language• write comprehensively in the target language• choose the equivalent expression in the target language that fully conveys and best

matches the meaning intended in the source language

22

Source: Open-Source Intelligence, Federation of American Scientists, 2012


Entity ResolutionInformation Transformation

• The problem of identifying and linking/grouping different manifestationsof the same real world object

• Examples of manifestations and objects:– Different ways of addressing (names, email addresses, FaceBook accounts) the same

person in text– Web pages with differing descriptions of the same business– Different photos of the same object

23

Source: L. Getoor, A. Machanavajjhala - Entity Resolution Tutorial


Entity Resolution – ExampleInformation Transformation

24

Enzo Ferrari e i suoi piloti«Un padrone delle ferriere». Era questo il modo singolare, ma per certi versi affettuoso, con cui Clay Regazzoni amava definire Enzo Ferrari. E che il Drake fosse un vero padrone, e fatto che nessuno dei piloti che hanno fatto tappa a Maranello puo mettere in discussione. Era lui, Ferrari, che stabiliva simpatie e antipatie, ordini e concessioni, stipendi e provvigioni. Su una cosa soltanto non concedeva margini neppure a se stesso: il valore di chi correva per lui. A patto, pero, che il nome del pilota non avesse il sopravvento, nella popolarita, sul nome delle macchine.Arrivando a tempi piu recenti, il pilota che piu affascinò Enzo Ferrari fu Niki Lauda. Fortemente parsimonioso e terribilmente abile nella trattativa economica, in cui eccelleva peraltro anche il Drake, Niki racconta che Ferrari ad un certo punto gli affibbio un curioso soprannome: «Mi chiamava ebreo, probabilmente perche mi riteneva anche un buon commerciante della mia professionalità. A fine luglio 1977, quando l'ex campione del mondo aveva gia firmato per la Brabham Alfa Romeo, Ferrari rivelo un'ammissione di Lauda. «Fino a quando lei sara vivo io guidero per lei», questo disse Niki al Drake, nel frattempo da dieci anni ingegnere honoris causa. Ma alla fine di agosto, Lauda si recò a Maranello e disse a Ferrari che non avrebbe guidato piu le sue macchine. «Se Lauda fosse restato con noi avrebbe almeno eguagliato il record di Fangio di cinque titoli mondiali vinti», confesso Ferrari tempo dopo. Non perdonò mai Lauda e non lo rivolle in Ferrari quando l'austriaco si offerse. Il perdono arrivò anni dopo, poco prima della morte del Drake.L'ultimo pilota, nella classifica degli amori tecnici di Enzo Ferrari, fu Gilles Villeneuve. Il Grande Vecchio era un umorale, quando Lauda lo lasciò fece una scommessa con se stesso: prender un signor nessuno e portarlo al titolo mondiale.



25

Enzo Ferrari e i suoi piloti«Un padrone delle ferriere». Era questo il modo singolare, ma per certi versi affettuoso, con cui Clay Regazzoni amava definire Enzo Ferrari. E che il Drake fosse un vero padrone, e fatto che nessuno dei piloti che hanno fatto tappa a Maranello puo mettere in discussione. Era lui, Ferrari, che stabiliva simpatie e antipatie, ordini e concessioni, stipendi e provvigioni. Su una cosa soltanto non concedeva margini neppure a se stesso: il valore di chi correva per lui. A patto, pero, che il nome del pilota non avesse il sopravvento, nella popolarita, sul nome delle macchine.Arrivando a tempi piu recenti, il pilota che piu affascinò Enzo Ferrari fu Niki Lauda. Fortemente parsimonioso e terribilmente abile nella trattativa economica, in cui eccelleva peraltro anche il Drake, Niki racconta che Ferrariad un certo punto gli affibbio un curioso soprannome: «Mi chiamava ebreo, probabilmente perche mi riteneva anche un buon commerciante della mia professionalità. A fine luglio 1977, quando l'ex campione del mondo aveva gia firmato per la Brabham Alfa Romeo, Ferraririvelo un'ammissione di Lauda. «Fino a quando lei sara vivo io guidero per lei», questo disse Niki al Drake, nel frattempo da dieci anni ingegnere honoris causa. Ma alla fine di agosto, Lauda si recò a Maranello e disse a Ferrari che non avrebbe guidato piu le sue macchine. «Se Lauda fosse restato con noi avrebbe almeno eguagliato il record di Fangio di cinque titoli mondiali vinti», confessò Ferrari tempo dopo. Non perdonò mai Lauda e non lo rivolle in Ferrari quando l'austriaco si offerse. Il perdono arrivò anni dopo, poco prima della morte del Drake.L'ultimo pilota, nella classifica degli amori tecnici di Enzo Ferrari, fu Gilles Villeneuve. Il Grande Vecchio era un umorale, quando Lauda lo lasciò fece una scommessa con se stesso: prender un signor nessuno e portarlo al titolo mondiale.



26

Enzo Ferrari e i suoi piloti«Un padrone delle ferriere». Era questo il modo singolare, ma per certi versi affettuoso, con cui Clay Regazzoni amava definire Enzo Ferrari. E che il Drake fosse un vero padrone, e fatto che nessuno dei piloti che hanno fatto tappa a Maranello puo mettere in discussione. Era lui, Ferrari, che stabiliva simpatie e antipatie, ordini e concessioni, stipendi e provvigioni. Su una cosa soltanto non concedeva margini neppure a se stesso: il valore di chi correva per lui. A patto, pero, che il nome del pilota non avesse il sopravvento, nella popolarita, sul nome delle macchine.Arrivando a tempi piu recenti, il pilota che piu affascinò Enzo Ferrari fu Niki Lauda. Fortemente parsimonioso e terribilmente abile nella trattativa economica, in cui eccelleva peraltro anche il Drake, Niki racconta che Ferrari ad un certo punto gli affibbio un curioso soprannome: «Mi chiamava ebreo, probabilmente perche mi riteneva anche un buon commerciante della mia professionalità. A fine luglio 1977, quando l'ex campione del mondo aveva gia firmato per la Brabham Alfa Romeo, Ferrari rivelo un'ammissione di Lauda. «Fino a quando lei sara vivo io guidero per lei», questo disse Niki al Drake, nel frattempo da dieci anni ingegnere honoris causa. Ma alla fine di agosto, Lauda si recò a Maranello e disse a Ferrari che non avrebbe guidato piu le sue macchine. «Se Lauda fosse restato con noi avrebbe almeno eguagliato il record di Fangio di cinque titoli mondiali vinti», confesso Ferrari tempo dopo. Non perdonò mai Lauda e non lo rivolle in Ferrari quando l'austriaco si offerse. Il perdono arrivò anni dopo, poco prima della morte del Drake.L'ultimo pilota, nella classifica degli amori tecnici di Enzo Ferrari, fu Gilles Villeneuve. Il Grande Vecchio era un umorale, quando Lauda lo lasciò fece una scommessa con se stesso: prender un signor nessuno e portarlo al titolo mondiale.



27

Before After

Slide Credit: L. Getoor, A. Machanavajjhala - Entity Resolution Tutorial


Traditional Challenges in Entity ResolutionInformation Transformation

Name/Attribute Ambiguity

28

Michael Jordan

Tom Cruise



Entity Resolution – Other ChallengesInformation Transformation

• Errors due to data entry

• Changing Attributes

• Abbreviations/Data Truncation

29

V. Rossi

Valentino Rossi Vasco Rossi Valeria Rossi


Entity Resolution – Abstract Problem StatementInformation Transformation

30



Entity Resolution – DeduplicationInformation Transformation

31

• Cluster the record mentions that correspond to the same entity



Entity Resolution – DeduplicationInformation Transformation

32

• Cluster the record mentions that correspond to the same entity• Compute a cluster representative



Entity Resolution – LinkageInformation Transformation

33

• Link Records that match across databases



Entity ResolutionInformation Transformation

34



Open Source Information Reliability (1) Analysis

• The types of sources used to evaluate information are– Primary sources: a document or physical object that was written or created during the

time under study– Original documents (excerpts or translations) such as diaries, constitutions, research

journals, speeches, manuscripts, letters, oral interviews, news film footage, autobiographies, and official records.

– Creative works such as poetry,drama,novels,music,and art. – Relics or artifacts such as pottery, furniture, clothing, artifacts, and buildings. – Personal narratives and memoirs. – Person of direct knowledge.

– Secondary Sources• Journals that interpret findings• Textbooks• Magazine Articles• Commentaries• Histories• Criticism• Encyclopedias

35

Source: Open-Source Intelligence, Federation of American Scientist, 2012


Open Source Information Reliability (2)Analysis

36



Open Source Information Content CredibilityAnalysis

37



Link AnalysisAnalysis

• Basic problem for intelligence analysts: putting information together in an organized way to make it easier extracting meaning, into a graphicformat

• Link analysis can be applied to relationships among identified entities: 1. Assemble all raw data 2. Determine focus of the chart 3. Construct an association matrix4. Code the associations in the matrix5. Determine the number of links for each entity6. Draw a preliminary chart (not covered in these slides)7. Clarify and re-plot the chart (not covered in these slides)

38

Source: Criminal Intelligence – United Nations Office of Drugs and Crime


Link Analysis – ExampleAnalysis

39




1. Assemble all raw data– Assemble all relevant files, field reports, informant reports, records, etc.

2. Determine the focus of the chart – Identify the entities that will be the focus of your chart (names of people and/or

organizations, auto license numbers, addresses, etc.)

3. Construct an association matrix– an essential, interim step to identify associations between entities

40




4. Code the associations in the matrix

41




5. Determine the number of links for each entity

42



Preparation & Tools

43


Questions to ask before an investigation

• Should you hide your activities from bad actors?– Criminals may block IPs of known investigators– They may also monitor activity

• Do you want to leave crumbs associated with investigations that are traceable back to you?– Log records, metadata at third party intelligence sources

• Do you want resources you use to leave crumbs on your devices– Cookies, plug-ins, or worse…

44

http://pralab.diee.unica.it 45

http://www.securityskeptic.com/2016/01/how-to-turn-a-nexx-wt3020-router-into-a-tor-router.html

1. Buy a $20 micro router or Raspberry Pi2. Install OpenWRT and OnionWRT3. Investigate over TOR from behind router4. Put all your devices behind your router

WiFi Encryption

OnionWRT: Tor router


•https://www.torproject.org/projects/projects.html.en

– Amnesic Incognito Live System (TAILS) Linux distribution

– Tor browser

• Disposable, anonymous inboxes– https://mailinator.com/

• Browser tricks– Incognito/private mode can still be tracked

– User agent changes (can do with cURL as well)

46

Software to anonymize traffic


Recon-Ng

• https://bitbucket.org/LaNMaSteR53/recon-ng/downloads/

• A full-featured Web Reconnaissance framework written in Python– geolocating an IP address– finding the domains associated with a given email address– ...

• A completely modular framework with independent modules, database interaction, built in convenience functions

47


Recon-Ng - Modules– Discovery

• discovery/info_disclosure/interesting_files– Exploitation

• exploitation/injection/command_injector• exploitation/injection/xpath_bruter

– Import• import/csv_file• import/list

– Recon (60 modules)• recon/companies-multi/whois_miner• recon/domains-credentials/pwnedlist/leak_lookup• recon/hosts-hosts/ipinfodb• recon/profiles-profiles/twitter

– Reporting• reporting/csv• reporting/html• reporting/json• reporting/list

48


Case Study

49


Google “Nintendo Co. Ltd. Board”http://quotes.wsj.com/JP/7974/company-people

50


Data.com - Connect

51


Data.com – Nintendo Co. Ltd. Info

52


Data.com - Nintendo Co. Ltd. Locations

53



54



55


Data.com - Nintendo Co. Ltd. Internet Domains

56


Data.com - Nintendo Co. Ltd. Personnel Contact Info

57


About Data.com Points Earning

58


About Data.com Points Earning

59


Data.com - Nintendo Co. Ltd. Personnel

60


Data.com - Nintendo Co. Ltd. Personnel

61


Radaris.com - Kathryn Rigney 14/05/16 18:36Report for Kathryn Rigney

Page 1 of 2https://radaris.com/report/i-1683311

SERVICES RADAR APPS

agency and does not offer consumer reports. None of the information offered by Radaris is to be considered for purposes of determining any entity orperson's eligibility for credit, insurance, employment, housing, or for any other purposes covered under the FCRA.

Phones First reported Last reported

(253) 813-5796 06/01/1989 04/05/2016

(253) 277-0426 01/16/2011 02/15/2011

(206) 854-6297 – –

(760) 749-8776 – –

(714) 749-8776 – –

(253) 854-6297 – –

Emails

[email protected], [email protected], [email protected], [email protected]

Addresses First reported Last reported

226 R St, Auburn, WA 98002 > 06/30/2012 04/04/2016

802 45Th St # 11-20, Auburn, WA 98002 > 01/16/2011 02/15/2011

802 45Th St Apt 11-203, Auburn, WA 98002 > 04/01/1999 08/01/2010

802 45Th St, Auburn, WA 98002 > 09/12/2008 09/12/2008


805 45Th St Stne 104, Auburn, WA 98002 > 12/01/1993 11/15/2007

802 45Th 106 St Apt 8, Auburn, WA 98002 > 04/26/2006 04/19/2007

1245 Po Box, Daphne, AL 36526 04/03/2006 04/15/2006

802 45Th St # 106, Auburn, WA 98002 > 04/01/1999 03/28/2005


802 45Th St Stne 13, Auburn, WA 98002 > 01/01/2001 01/01/2001

4820 150Th Ave # 957, Redmond, WA 98052 > 11/01/1996 11/13/2000

3353 Las Vegas Dr, Oceanside, CA 92054 > 03/10/1989 05/29/1999

106 802Nd St 8, Auburn, WA 98002 > 03/01/1999 03/31/1999

106802 45Th St 8, Auburn, WA 98002 > 03/19/1999 03/19/1999

Kathryn RigneyAuburn, WA

Advanced People Search ReportReport date: May 14, 2016

1 person found.

Born: Nov 11, 1957 - 58 years old

1 Kathryn L Rigney

Public Records SearchBackground check, contact information, mentions monitoring and more..

62


Spokeo.com - Kathryn Rigneyhttp://www.spokeo.com/Kathryn-Rigney/Washington/Auburn/p18244555111

63


recon-NGrecon/contacts-profiles/fullcontact

64


recon-NGrecon/profiles-profiles/profiler

65


Recon-Ng: Show Contacts

66


Recon-Ng: Show Profiles

67


recon-NGrecon/profiles-profiles/twitter

68

osint –open source intelligence€¦ · osint –origins •the term 'osint' originates...

Documents