Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Look at me now
THANK YOU
My Credentials?
Old
Loudmouth Security Punk who talks $hit Tells lies (professionally) Is called all sorts of bad words.. That I will likely say throughout this talk Cant code well
Ive done PenTesting and security work for the last 14+yrs
Has a bunch of certs Helped create PTES
-me
Individual Surveillance
Social Profile
Gettin all up in it
Show Me
Onsite
Corporate Surveillance
Partners
Competitors Adversaries Trustees Financials Sensitive Info Leakage Electronic Threat surface
Corporate communications
Key relationships and individuals of influence Corporate events Manipulation points or general shadiness =)
Mucking around
Ask yer
Littlesis
Linked IN anyone?
Personnel Intelligence
Simon Says
Names Aliases Emails IM Screen names Social Landscape Interaction Clients Web Apps used Type of hardware Physical Locations Carriers
Who
What
How
Raw Intel leakage Tone Timing Key Terms
Why
Collusion Relationship strengths Relationship Age Com. Patterns
Who am I?
Who Am I?
What am I doing??
Who Am I?
If you are going to drink the ocean, you may as well have a straw
Manipulations points Clubs / Hobbies
Interests/ Habits
Leverage areas Points of similarity
Haunts
Personal Relationships Business Relationships
Photos
Family Heritage Socioeconomic class
Affinities
Travel schedules & Physical movement patterns
And TONS of people are trying to use them to figure out how a person is connected to a company or another human
Touchgraph
Other fun relationship maps generated from current content LinkedIn Maps
There are TONs more, but remember you can Roll your own
Underlying Maps (Geo and some data)
Map Data with API access
ESRI UMAPPER ArcGIS Bing Maps Openscales Yandex (with facial recognition) MapQuest OpenStreetMap
Twitter
Flickr Banjo Tripit 4square (everything u can get for free or find free api keys on github) Mo da bettah
Maltego Casefile
Immunity Stalker
Snoopy
Snoopy (because Eye of Saron and Big Brother were taken) since its distributed sniffing and tracking network for wireless attack.
Individual Surveillance
We Know who we want, so lets take down the easy ones first
Phishing
External compromise Onsite Attack
How do you get all this $h1T near the person you REALLY want?
Compromise the badge system
Compromise the camera systems Find out where their boxxen is and OWN IT
Once ya get all that you think you want. Stay in you can never have too much root =)
I WANNA SEE
LOOK at anything that is running a website *allports* people rarely change defaults.
http://www.exoticliability.com/profiles/blog/show?id=3125850%3ABlogPost%3A155 90&commentId=3125850%3AComment%3A18834
http://keepass.info/ plugins.html
Get up in it
http://www.lucidscience.com/
Ewwweee. bugs
GPS TRACKING
Geo Fencing. Sometimes its better to be alerted when they leave the area for you to follow.
On Star
If you know where they are why not get a view from EVERY angle?
Wireless SD Cards
BarCode Attacks
Bluetooth Hijacking, Rogue pairing, Interception, sniffing, Cloning GPS Hacking and Forgery +OnStar
Wireless headset Eavesdropping HID, RFID, Proxcard Badge system Hacking Cordless Keyboard / Mouse sniffing
Go watch the ccc talk on the Thingpwner Speaker: Ang Cui, Michael Costello EventID: 5400 Event: 29th Chaos Communication Congress (29c3) by the Chaos Computer Club [CCC]
http://www.youtube.com/watch?v=f3zUOZcewtA
Get the KIES to the kingdom @cron_ talk at HackMiami http://mcaf.ee/pt5sy Yum