Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Micah Hoffman breaks down OSINT, the dark web and beer apps
Guest:
Micah Hoffman
Published:
Updated:
Duration:
56 min
Episode summary
In this episode, Micah Hoffman talks about his career in Open Source Intelligence (OSINT) and the value it has for investigations, cybersecurity and understanding how information is weaponized. He also gets into strategies for safeguarding personal privacy in the face of increasing digital surveillance. This episode will have you thinking twice about what you post on social media! Why you should listen:
Here from one of the leading Open Source Intelligence researchers working today.
Learn about the value of OSINT for offensive and defensive cybersecurity.
Get a better understanding of all the privacy risks from fitness trackers, apps, shopping online and social media.
Start by downloading your own data Micah recommends requesting your archive from Twitter, Facebook, Instagram, and Google Takeout to see what they collect. Seeing that Twitter stored every direct message he had sent changed his own behavior.
Aggregation is what makes data dangerous A single beer check-in looks harmless, but Micah's script built a profile of when, where, and with whom a colleague drank. His airport-watching tool has logged check-ins at more than 75 international airports since November 2019.
Privacy settings may not protect you In one exercise app, users could hide their name and city, yet anyone who guessed an activity number could still pull the full route, which can reveal where someone lives or works.
Removal is whack-a-mole, so add noise Opting out of people search sites is labor intensive and only a point-in-time fix. Alternatives include posting misleading details about yourself and shipping online orders under a different name.
OSINT has rules of engagement too Like penetration testing, OSINT work is bounded by laws, ethics, and customer agreement, for example whether stolen breach data may be used in an investigation.
Topics covered
Thought Leadership
Notable quotes
Who needs hacking when I can just log right in?
…OSINT and privacy are inversely correlated. So as your privacy goes up, necessarily, the things that we can find… about you on the Internet goes down.
…the reality is that everybody has their own personal risk level and risk tolerance.
Because just like a pen test, what you get is at a point in time.
Questions this episode answers
What is OSINT and how is it used in cybersecurity?
Micah describes open source intelligence as a reconnaissance skill: piecing together publicly available information before attacking, defending, or doing forensics. On one pentest, simply googling the site turned up a help PDF with working login credentials. Read this section
How does OSINT help find missing or trafficked children?
The National Child Protection Task Force is a group of volunteers who pool skills and resources on cold or stalled cases. They generate new leads and pass them to law enforcement, who continue the investigation. Read this section
How can I remove my personal information from the internet?
First find out what is out there, then adjust privacy settings or delete data on social media and request removal from people search sites. Because removal is whack-a-mole, Micah also suggests adding misinformation and repeating the process over time. Read this section
Did GDPR limit what OSINT investigators can find?
GDPR caused WHOIS data to be masked in May 2018, but Micah says enforcement has mostly targeted large multinationals. For people in Europe and elsewhere, investigators focus more on what people share intentionally on social media. Read this section
What can you find on the dark web that is not on the surface web?
Micah says forums sell stolen credit cards and breach credentials, and the dark web hosts trafficking and abuse material. He adds that it also protects oppressed people, and that the line between surface and dark web has blurred as marketplaces move to bulletproof hosting. Read this section
About the guest
Micah Hoffman is an open source intelligence (OSINT) specialist who, at the time of recording, taught at SANS, volunteered as an OSINT investigator with the National Child Protection Task Force, and ran his own OSINT consulting company, Spotlight InfoSec. He previously worked on penetration tests for a government contractor, where Jeremiah Roe reported to him. He has given talks on privacy leaks in fitness apps and built tools that analyze public check-in data from the Untappd beer app.
And I'm Bella DeShantz-Cook. Today, we're talking with Micah Hoffman, an open source intelligence expert who teaches at SANS and works as an OSINT investigator for the National Child Protection Task Force. You know, I've actually always been pretty freaked out by open source intelligence work. It all seems kind of invasive and maybe a little bit creepy to me. But honestly, this conversation with Micah might have changed my mind a little bit. I definitely now sort of see the value of OSINT in terms of cybersecurity.
I'm a huge fan of OSINT. To me, OSINT represents those beginning stages in any sort of attacker methodology where you gotta do the reconnaissance up front. You've gotta figure out the best way to get into any organization. So in my personal perspective, Micah is pretty amazing. He's got some great advice for everyone to go ahead and increase their privacy online.
The cybersecurity talent gap is growing. Is your organization feeling its effects? Instead of spending time on an exhausting search for your next candidate, get help today with on demand security tasks available at the click of a button. Synack campaigns match the tasks you need done with a capable, skilled researcher. Go to synack.com/campaigns. That's synack.com/campaigns.
Welcome to the show, Micah. Thank you so much for joining us today. I'd like to introduce you to my, exceptional cohost, Bella. How are you today, Bella?
I'm pretty good, Jeremiah. Thank you for asking. I'm I'm definitely looking forward to this conversation today. I know very little about what we're gonna talk about, so, I'll get to learn some too.
For those that don't know, Micah and I used to work together. We previously worked together over at another government contractor, and I used to work directly for Micah, funny enough, one of the better bosses that I've had, throughout the years. Always challenging individuals to do better, show impact, and make it worthwhile for leadership to understand from both an operational perspective as well as a business impact perspective. So, again, thanks so much for joining, Micah.
Oh, it's certainly my pleasure. I know, Micah, since you've left since you've left, previously when when we worked together, you've dived really deep into a lot of the passions that you've had in the process, and one of those is, of course, open source intelligence gathering. And so from there, you've transitioned into starting your own company called Spotlight InfoSec. And in the Spotlight Spotlight InfoSec, that that mainly revolves around open source intelligence gathering or OSINT. And I was just kinda wondering if you could talk broadly about what OSINT is, how cybersecurity professionals and adversaries use it for both defensive and offensive purposes.
Sure. Open source intelligence or, as you said, OSINT is a a reconnaissance skill. It's all about that preparation work that needs to be done before you do anything in cyber, whether it's attacking or defending or figuring out what has happened on somebody's mobile device if you're doing digital forensics. I love it because it's it's truly an investigation. You are trying to piece together different pieces of publicly available information and figuring out what they all mean. I remember back when I was doing pentests for that government organization that you and I used... Or for that government contract that you and I worked with. And I remember one time I was doing a penetration test, and I was testing a web app. And part of our process was just Google the name of the website. And I I just googled it, and I pulled back a a PDF help document that said, hey.
If you wanna log in to this website, use a username like this and a password like that. And wouldn't you know it? I just typed those exact credentials in, and I got... I logged right into the website. And I was like, wow. This is so powerful. Who needs, like, hacking when I can just log right in? So it was pretty neat at that time, and I knew that that's where I wanted to be.
So you mentioned just literally Google searching for a customer that you're trying to to do a penetration test for finding some information and going from there. Are there any... Like, is there any... Do you find yourself having to kind of clarify exactly what OSINT is? Like, do people think of it literally just as just googling? Like, is there more to it than that?
Absolutely. But it really depends on on who I'm talking to. You know, when I talk to my family and friends about what I do, I I usually just simplify it and say, I'm... I find things about people online, about people, about IP addresses in computers, or about businesses. And that generally helps out. Of course, we do use search engines, and, of course, there's a good percentage of people on the Internet that think we just do fancy googling, but that's not all of the things that we do. So, yeah, there... A lot of it is explaining that that just because the resources are online and just because they're freely accessible doesn't necessarily mean that everybody is doing open source intelligence or doing OSINT or doing recon because there's there's so many different nuances to how... What sites you visit, how you collect the data, how you store it, and how you interpret and analyze the data that are all very important pieces of that overall OSINT puzzle.
On the other side of misunderstandings about OSINT, do you ever have to clarify clarify to folks that it's not malicious? I know, you know, I have a background in penetration testing. And from folks who didn't know penetration testing, I would constantly get these questions of, like, isn't what you're doing bad? And I know, like, I know that there are people who think OSINT is just... It's like it's spying and it's it's it's bad. How do you clarify that for folks who kind of don't really understand the purpose?
We do it very similarly to how you might do it for penetration testing. When you're doing pentesting, you know, there is a line that you will not cross without the rules of engagement with your customer, without your customer's permission. And so in OSINT, have the same thing, except it's a little bit different for us as a lot of the data that we have or that we collect is online and it's publicly accessible. In our area, we have not only laws governing what we can and not... Can and cannot collect about people or or companies. We also have ethics, which pays a plays a big part in what we do. So here's an example, you know, using breach data when some attacker breaks into somebody's website and steals that data and releases it online. That data is publicly accessible, but it's stolen data, and it's data that has sensitive information in it about other people, and some customers don't want us to use that stolen data in our work.
Some customers don't mind it because they know that attackers are monetizing or are... Or using that data for bad things. So I think we draw the line kind of ethics and rules of engagement, much like cyber.
So similar to, you know, like you said, I I am hearing a lot of similarities between OSINT work and penetration testing. And I think for me, working as a pentester, a big way that I was able to explain it is like there's this really positive end goal. Right? We we submit our vulnerabilities and then they're fixed or managed or something. What's the kind of end goal with OSINT?
It really depends on what you... Who your customer is and what they ask you to do. So in my OSINT consulting practice... And I know that's a very consulting answer. Right? But in my OSINT consulting practice, you know, I might be doing some work where somebody is looking to find out if their spouse or partner is cheating on them. So we usually start with some kind of question or goal, and then we gather the data and analyze it. But some of the the work that I and my colleagues have done, it can be anything from researching businesses, doing competitive intelligence or due diligence, trying to find missing people to aid law enforcement, to to researching IPs and domains to see who's attacking who and maybe get a little bit about attribution. But to go back to your original question, it all is very much guided by that overall mission question of what do you...
What does a successful engagement look like for you? But in the OSINT world, I'm more of an adviser than an action taker. You know, think about in OSINT and recon, we gather all the things, we analyze them, and then we recommend, we suggest. In the pentest world and in the cyber world in general, you you do a... You do some of that. Like with pentesting, you'll find the holes in applications and systems, and then you'll say, here's what I found, and here's what I suggest you do. So it is very similar to to cyber work.
In my in my current role, utilizing a lot of methodologies that Micah is talking about, there was a client that we were working with that requested we conduct an OSINT investigation on them prior to conducting penetration testing. And I was put in charge of doing that and, again, utilizing some of the various tools that that Micah has had a direct hand in and methodologies that he's speaking about. We developed this portfolio as to the attack surface for the organization as well as, you know, sort of other meta information such as things about personnel, things that we could track and and connect to other little bits of data that we're able to pull. And in whole, you form this much more clear picture as to what's happening with the organization, with executives, with individuals, with system admins, etcetera.
And you can create this big picture that attackers will generally utilize towards an attack. Long story short, when we pass this information over to, this potential client, they were so freaked out by the information that we shared with them that it took them three months to get through the data before they cleaned some stuff up in house, and then we were able to engage. So Yeah. It can be a powerful tool.
Oh, absolutely. And and I think one of the things that you just mentioned is is it extremely important that many times people don't realize what is online and being revealed about their organizations, themselves, their activities, and their families. And this is not only here in The United States, but it's internationally. Yes. In The United States, we share a lot more. The government shares a lot more, and companies share a lot more about us. But even internationally, there are a lot of ways that we can collect information about people, businesses, and computers.
So I know you mentioned one of the aspects of your OSINT work involves working with law enforcement. Are you working with them on a lot of criminal investigations? And can you tell us a little bit about what that's like as much as you can say, of course?
Actually, I don't directly work with law enforcement. I usually am am retained by a lawyer that's working on a certain case, a defense, or the plaintiff asking me to gather certain data and present it to them, and then they deal with law enforcement. However, I do work with the NCPTF, the National Child Protection Task Force. And with them, I do interface with law enforcement a little bit, getting images, getting other pieces of data to help them locate missing people or people that are being trafficked. And it's wonderful. They're a great group of people. The the people that I've worked with are top notch, and I've always been impressed with their dedication towards resolving the case, whether it's a missing person or a trafficked person. And I've always been impressed with how they are willing to share whatever they're allowed to share and accept the help.
Jeremiah, I bet you, and Bella, you too, have probably encountered those clients that you know are going to benefit from your services. You know that all of this is online and there's high risk. And when you tell them they're really hesitant, reluctant to accept your well meaning, even paid for advice because it goes against what they want. With the law enforcement that I've worked with, they are extremely helpful for the assistance.
Yeah. I'm glad that you brought that up because I actually wanted to hear a little bit more about that. I saw that you work with the, like you said, the NCPTF, National Child Protection Task Force. And I think that's one of the areas that I actually have heard a little bit more OSINT talk of how how beneficial OSINT work can be for this kind of endeavor. Would you tell us a little bit more about how OSINT is related to this task force and what you do?
So the National Child Protection Task Force or NCPTF and other organizations similar to it are groups that aim to assist law enforcement and other groups with finding missing people. There, as it was explained to me, when somebody goes missing and that person has been groomed by a sexual predator or child predator, one of the things that that person that's grooming them will tell them is, when you leave the house to come meet me so we can do whatever, I want you to leave a note saying this, like, I've run away instead of I'm I'm meeting this person because the language that is used in some of these these notes and letters to to parents and loved ones changes how law enforcement can or cannot interact with it.
With law... With the NCPTF, what we are is a task force of volunteers that get together, that pool our knowledge and our resources to work on some of these more challenging cases, cases that are not actively being worked on because either they're too old or there's no additional data points to pivot on. And we generate additional leads and provide that to law enforcement, and then they will go into whatever it is that they do to to continue working on the case. And there have been a lot of successes both in the NCPTF world as well as in, many of the other well meaning nonprofits that are that are helping out, these OSINT for good type of situations.
So with information being so freely available online and, accessible by almost anybody that has access to the Internet, is there any kinds of data that people should be more careful about, posting online than, say, other kinds of data? And given your particular background, I would imagine that you specifically tailor the types of data that you reveal so that others can obtain information based off the data you want them to see as opposed to the information you don't want them to see?
Yeah. That is an extremely deep question, Jeremiah. They they they... I mean, there there are so many different aspects to what you just said. First off, you have the concepts of what I want people to see versus what they're able to find out, so that intention. In some of our social media, we choose to make it public. You know, if I make my Instagram public instead of private, you know, I am allowing more people to to view my social media and and my interactions. But there's also that intention of what I post on those platforms and the intention of what username I posted under, what account I posted under. And so there's there's a lot of places where I may have access to privacy controls to control what I what I put out there on the public Internet, but also it's a matter of choosing do I want to or do I not want to.
So it's not just does the platform allow me to, but it's should I do this or should I not? And that's another level of of privacy that that I choose to implement. So, yeah, I don't have social media on certain things. I don't do a lot of things. I'll give you an example of that less in the OSINT world and just more in the privacy realm. I just got an Apple Watch, and I was like, oh, I'm gonna track my fitness. And so I was like, cool. You know? Apple, you know, they protect your stuff. It... You know, track... And and so I I I let it track my steps and let it track when I stood and when I didn't stand. I didn't do the sleep thing because that was just freaky. So I just went ahead and did that for about three or four days, and then I looked at all of the things. And in my Apple, in my iPhone, it shows, you know, the minute that I got up and stood, how many flights of stairs I went up, at what date, at what time, when I was walking, when I was running, when I was moving.
I'd like to hover on that for a moment if we can because I know specifically that you've done a particular talk a few times around various kinds of fitness applications without naming names. I know that it's a particularly interesting talk, and I was wondering if you could maybe speak a bit more as to what you're able to identify with that.
Sure. The the thing I like about OSINT is that the more you know about web technologies, the more you know about how the Internet is connected and websites are put together, that that core underlying knowledge that is not directly cyber, not directly OSINT. The more you can grab off of websites and the deeper you can go. So there was one time when I went for a bicycle ride with one of my my friends, and she sent me a link to an exercise apps results page for the activity that we went on. And when I looked at the page, I was amazed that this data about where we went and how fast we went and who we went and who she went with, wasn't protected at all. And so the talk running away from security that I did back in 2015, was one of those talks where it...
I dived into the world of exercise applications, and I'm kind of circling back to what we what we just talked about, that even though I might choose to restrict who act... Has access to my data on certain platforms, the platforms themselves may not have the privacy controls in place to limit people to not retrieve my data. And I'll give you an example without naming names. On this exercise application platform, you could turn on all of the privacy things to not reveal your last name, to not reveal you... The city you're from, and and implement all those things and feel good about it. But if somebody just guessed the number of your ride, your walk, your your run, they could still pull up all that data.
And then based upon the geographic location of where you started and ended your run, your walk, your bicycle ride, probably figure out where you worked or lived. And and I think that's another one of the the skills... Two of the skills that I love in OSINT is that, one, there's kind of detective work. This thing leads to that thing leads to that thing. So finding, hey, that this exercise app is not protecting data is one thing, but understanding how to collect it en masse, analyze it en masse, and then figure out what to do is some of the other interesting things that I love doing within OSINT.
So with those applications and or social media platforms that that might be overly verbose in sharing the information that you don't want to have shared, are there are there any any specific apps or, again, social media platforms that you just will not use for that very purpose?
So the the answer is Micah Hoffman personally, absolutely. There's no way I'm putting certain mobile apps on my phone, for certain platforms. But Micah Hoffman, professionally, I absolutely do put those apps on my phone because OSINT and privacy are are inversely correlated. So as your privacy goes up, necessarily, the things that we can find about... Out about you on the Internet goes down. And, as your privacy goes down, we can find more. Those apps that we put on our phones, those social media platforms that may take a little bit more of our data or may not protect it, those are... Present opportunities for people to find out risky things about us or just other things that I don't want. So, yes, personally, I'm not using certain platforms, and I won't even put those apps on my phone.
So just as an example, there are companies that are very prevalent in the news today, and I I think we can freely say, you know, there are concerns around such platforms such as Facebook or or Google even, right, around privacy concerns and information that they share and allow to be accessed by other users. With that particularly in mind, are there any things that you would recommend towards privacy concerns that individuals have with regard to the apps that they're currently using?
That also is a huge, huge issue, because it it really depends on who you are and what you're doing. The first thing that I always suggest to people is you have to understand what's out there. And this goes back to what we were talking about in the beginning of the podcast that that if you don't know what data is out there that's either being shared by these social media apps or Google or just shared by your church or temple or mosque, then you can't take steps to remove, remediate, or otherwise manage that data. So what I like telling people to do is go to whatever social media platform you're using and download your data. You know, Twitter, Instagram, Facebook, even Google has these takeout things, download your archive. Download all that stuff.
And it doesn't matter if you're going to go and remove your account or whatever, but just see what they collect on you. I'll tell you this. When I downloaded my Twitter data and I saw that Twitter was collecting every single direct message that I... And collected and stored, every single direct message I'd ever sent, every single... Like, when I had what friend or colleague join Twitter, and how I I followed them or they followed me. And same thing for Facebook. They'll give you the facial recognition ID code for your face that they use to detect your image in other people's photos. Just seeing that vast amount of data that these companies collect about us absolutely changed my behavior, and that's that's one of my first things that I suggest to people.
But aside from that, I mean, after you understand what they have, then you need to decide what your personal risk model is. You know? What are you comfortable with people knowing on the Internet? And each one of us has a different level of that. When my kids were growing up, I I talked to them about this, and they actually helped me with some of my OSINT, not casework, but some of the things that I was doing for my classes. And I would show them things. I'm like, hey. Look. We can see inside this person's house and all of the toys that they have, and look. Here's a bill on their desk because one of their kids is doing some kind of social media streaming, and we can pause the video. So I think education is an important part to reducing your online online information as well.
I have sort of like an interesting thought slash follow-up on that, which maybe you'll have some perspective on. I feel like, you know, my my understanding of social media currently, it seems like there's a lot of emphasis or like it seems like a lot of people are embracing this idea of like being transparent online and sharing with your friends and followers exactly what's going on and, you know, these open conversations about what's going on in your life, which... Cool. But they they do come at a cost, at least at least I think that's what all of us in this call probably believe. How do you... Like, how can we better think about that balance of having maybe honest conversations online sometimes in some spaces, but also still recognizing the cost in privacy that is associated with that?
Well, the way that I found is most useful is to aggregate data and then show that entire profile or show what that shows. For instance, I had a colleague, and I'm not sure if you've seen this this talk I gave or this tool I released. I had a colleague that was sharing his drinking behavior online through some social media app that is... I think I can name the app. It... It's called Untappd. And it's a simple app. You put it on your phone. You join with a social account. And then whenever you drink a beer or you buy a beer, you take a picture of it. You say, oh, this beer tasted of oats and honey, and I drank it in this location at this date and time with these people, and you can rate the beer. And I...
When this this colleague of mine said, hey. You know, he... I just earned a beer for drinking the most porters in Singapore. I replied to him, why are you telling me my... Your drinking behavior? Aren't you, like, aren't you scared that somebody's gonna do something with it? Because it was just one thing. It was just a single badge that the site had given him. And he said, well, you know, what's the worst that somebody can do? Alright. Game on. So let's figure out the worst. You're right. I mean, Jeremiah, you're you're smiling here. But that's exactly it. I'm thinking, well, what is the worst that somebody can do? So I created a Python script to harvest all of their drinking activity. So then we could analyze this tool that I I created. It can analyze the days of the week, the hours of the day, the the the days of the month when somebody drinks, where they drink, shows a nice little heat map of the locations they've checked in, who their friends are.
And when I showed that to my colleague and said, well, here's the worst. I have a profile of when you're drinking, where you're drinking, who you're drinking with, where you visit, when you visit it, that made my colleague change his profile from public to private.
It seems like that's the information people are missing that, like, okay, maybe sharing a picture of a beer seems really innocuous and maybe it is. But the way that that data can be aggregated and the way that you can find patterns, I think that's the that's the part that really frightens me.
Yeah. I mean, in in the profiles that you all create, but when you're doing your recon, one of the things you do is you don't just, you know, find one social media profile, you find them all. Then you look at what media is being shared, and and and you go deeper, and it's that aggregation of all those things that really is the compelling thing that can change behavior.
To take that a step further with the heat map that that Micah had created for his friend, you know, utilizing typical human behavior from a psychological perspective. And I think Micah will appreciate that for reasons unsaid. There's a particular thing that you can develop. Typically, people are going to focus around either their place of work or their home. And when they start visiting these locations and you collect all this different data, you can utilize different sorts of algorithms to showcase the likely location based off of distance traveled, amount of times visited, information that can pinpoint where they potentially live. Separately, if this information is shared with an employer, right, you may form a separate kind of opinion from an employer's perspective they they may be concerned with such as, is this person at risk for, if they work in the government, for disclosing information because they've got a drinking problem, or are they...
You know, there's so many different kinds of things that that could be taken, and that could also be abused from somebody who may or may not have malicious intent towards this individual.
The tool only looks at when they're logging the beer. So if I drink a beer now, then in five hours or two days later, say, oh, I did this. I'm only getting when the beer's logged. But, you know, if you look at when people are logging beers, you might be able to see that, hey. You know, you work from 9AM till 5PM, but all your beers are drank between two and four. What is happening there? And you're right. I mean, that that could be something that's very embarrassing. But let me take it a step even further, Jeremiah, when I... I know we're getting all into this. There... There's actually two steps here, and this is all within this one... In this open app. When people share information, think about their human behavior. People that really love this application, they will travel around the world, and they will log in or check-in to places and say, oh, I drank a beer here.
I do demos where I take a single person and then look at their last 25 beers that they've logged, and you can see this person went to this airport, had a beer, then they went to this Hilton in... In this Hilton hotel or Hampton Inn, and then they walked to the local pub two blocks away from the Hampton Inn. Then they got on a plane because we... They went to the airport. They went to another city, stayed in another place, had a drink at the bar, and you could see this repeated behavior. We can track people around the world. And then just to make it even super scary, I had a student one time when I showed this to them in my class. I said, look. We can do this to track people. And he said, well, I work at a a secret location, and across the street is a restaurant or a bar or something.
Could you watch who drinks at that bar to find patterns? And I said, oh, yes. And I made another tool. And what it does is it just watches places, and then every day it records who logged beers there. And since November 2019, oh, we're coming up on two two years. I have been I have been recording every day who logs beers at over 75 international airports. So we can track people as they're traveling around the world. We can track when the pandemic hit and a decrease in airline activity as evidenced by less people drinking in airports and more. So, yeah, OSINT is fun.
That's the thing. Like, I distinctly remember being a little bit younger and having an Instagram account, being so excited to get to share all my cool stuff that I do with all my friends. I'm very inactive on Instagram now. And I remember going on vacation once and my dad being like, don't post any photos while you're gone. I was like, oh, dad, please. Like, I need to show off to my friends. I have to, you know, they have to see all my cool vacation photos. And he was like, take all the photos, post them when you get home because if you post them while you're gone, people will know that you're not home. And that was like the first time, I think, in my life where I was like, woah. People can really, like, make connections based on the information that you're putting online. And that's one data point. But as as we have so many more areas that we're putting information and maybe, like, maybe other people know about don't post vacation photos on Instagram, but maybe they don't think about their beer.
Oh, absolutely. And, I mean, there used to be a a website out. It was a proof of concept website called Please Rob Me, and that's exactly what it did, Bella. It was it was out there to say, look. This person just checked in here or did this. They're probably not at home. And the site quickly went offline because of creepy factor, of course. But but the point is is exact... Exactly what you... What you're talking about. Now I know people in the cybersecurity world who are normally very cybersecurity aware and and focused on, you know, good cyber hygiene that post incredibly detailed personal things online. And if you just look at their Instagram, Twitter, Reddit profiles across a month or a year, you can see a lot about what they do, where they do it.
And it doesn't make me sad anymore. It used to make me sad, and I used to feel like, you know, captain privacy. I have to save them and tell them this is wrong. But the reality is is that everybody has their own personal risk level and risk tolerance. And, Bella, you changed your behaviors probably once you became a pentester and understood how people use these things. Right? Oh, yeah. Yeah.
Oh, yes. Very much so. So speak... We've talked a lot about, like, all the different ways that we can, you know, inadvertently or even fully aware, put all this information online. And we've talked about the kind of negative consequences. Say that you have, you know, maybe someone listening right now or someone like me right now. Maybe you've identified some area where you've put more information than you're comfortable with online. What steps can you take to to kind of scrub that data or or maybe improve your habits going forward?
So the first thing is figuring out what's out there. And for a fee, I will do that for... No. I I should... I didn't know. Just throw that in. No. I mean, first thing is figuring out what's out there. And one of the best ways to do that is just look around the application, all of the social media. Usually, it's social media. Over here in The United States, we also have these people search websites, people finding websites, because companies can buy and sell our personal data. So depending upon where the data is, you take different actions. So if it's on social media, you can take steps to protect your data on some platforms. You can take steps to remove and delete that data. If it's on something like a people search website, you can, on many of those sites, remove your data or ask them to not publicly show that data. They'll still keep it. They just won't show it to people.
But that's more of a game of whack a mole. That is because you ask it to be removed from one website, and then another one pops up, and they're like, you didn't ask me to remove it from findpeople.com. You asked from peoplefind.com. So that's generally not great. And then the other way that you can do it is instead of trying to remove data, put misinformation out there about yourself. So I have colleagues that have very unique names, And instead of trying to remove all the places where their name exists, they just create extra social media accounts and then post other things. Like, they like turtles and whatever, fried green tomatoes instead of the real things. Yeah. So so that's another way of of changing things. But you have to do that you have to do that over and over and over again.
Because just like a pen test, what you get is at a point in time. Right? So if you remove everything today, Bella, tomorrow, the next day, your... The race that you ran in will publish your name and your your age and your gender and your time, and there's more and more more stuff out there.
I've never heard that tip about adding information. So I have a relatively unique last name, and I always am frustrated by my friends where, like, you cannot find them on the Internet because they have the most generic names. I love my name, but also in that one aspect, I'm jealous of of more generic names. And I've never heard that tip of just adding fake information, and that actually sounds a little bit fun.
Absolutely. And, I mean, in The United States here, it goes a little bit deeper than just making social media accounts for other versions of you with other ideas and other likes and things. Here in The United States, you can't... You have to think about how these data aggregators, like the people finding sites, are collecting that data that then they share in the people finding sites. And one of the ways is, you know, based upon your real retail use. So if you're buying buying things from online retailers or using your loyalty card to get discounts somewhere, all that that advertising and marketing and demographic data gets aggregated and then released online. So instead of you getting packages from Amazon to your name, Bella, at your address, maybe start getting them to John Doe or Jamie Smith or something like that at your address so you're the only one getting it.
Are there... Wait. So I'm so sorry. I keep having so many follow ups. I'm just so interested in all of this. Are there any other... You mentioned online retailers and and, like, reward systems and things like that as kind of... I see those as areas where you're giving information about yourself without actively, like, intentionally doing so. Are there any other weird areas that folks might not think about? Sorry to put you on the spot.
No. I I mean, that is that is a deeper question. The answer is yes, of course. Everything and anything you do on your smartphone is not collected, but there's telemetry telling Google or Apple where you are, what you're doing. You're using the iTags, using the iWatches, you're doing whatever. All of that's being collected as well as... Well, I don't mean to sound, you know, conspiracy theory, but but... Yeah. I mean, there's huge data out there about tracking people, where you go, how long you stand in front of certain displays, where your devices are headed, and what you do online and tying that online purchasing, online social media presence together with you live at this location, together with other people that live at that location, that's big business, at least over here in The United States because of our more lax privacy laws.
So what I try to do is be intentional about where I buy things from, what I buy, what I do. And some of the things that that we can do to protect ourselves is, like, not using credit cards, which is kind of a scary thing because now everything is tied to a credit card. But there's a really neat site out there, and I make no money off of this, but privacy.com over here in The United States will allow you to tie that... An account to your bank account, and then it will issue you virtual credit cards. Now I know that some credit card companies have these virtual credit card numbers, but this goes beyond that because privacy.com, while they know who you are paying, they generate unique numbers. So now your data can't necessarily be aggregated because you're using the same credit card number on every single site.
But also your bank, when it gets... Or your... The the credit card retailer doesn't get that as well. So if you... If I use my Amex everywhere, American Express knows I shop here and I shop there and I bought this. Well, with privacy.com, they they reduce the amount of things that my credit cards and my bank knows. So that can help out as well. But that's only in certain countries because of financial things. So there are a whole bunch of neat things that we can do to try to reduce what's online or make it harder for people to find us.
So I know we've primarily been discussing, kind of over here in The States and and what's possible here due to our privacy laws and or lack thereof. What about, say, over in Europe? From an open source intelligence gathering perspective and or information honeypot, is there such a thing really over in Europe? And if not, why not?
So you mentioned, Jeremiah, the GDPR or you infer the the GDPR privacy rules. Those did make a big impact initially on what was being shared online. In the cybersecurity and pentest worlds, you probably remember back in May 2018 when those privacy rules went into effect, all of the WHOIS data got masked. And so we no longer could quickly and simply reliably find out who owned what domains because some of that data might have been from EU citizens. The reality over the last three years, though, is that we see that the GDPR is really only being enforced on large, large multinational corporations like Facebook and Google and all. And smaller ones are still sharing some information about EU citizens without their consent.
And you have to think about the places where people go to share that... Those details about themselves. So, you know, social media becomes a big player when we're dealing with some of the searching techniques that we use for people in the EU or in Asia and Pacific regions and Middle East as well. So we look more for maybe what people are intentionally sharing instead of what's being shared about them in those places.
Oh, that's interesting. I think that kind of flows nicely into this next question that I have, which is... And I guess to set this question up, I'm just gonna briefly touch on something that I think you alluded to a moment ago, is about the cell phones. And there was a recent study that was done, and I think there was... This was done with a with a journalist actually, where they went into DC and they turned their phone off, and then they traveled around to a number of locations. And they saw that they were still able to monitor and track where the phone had gone throughout that time frame even though the phone was turned off. This may be something that folks aren't quite aware of. When you think you've turned your phone off, it's not really off. And so
Yeah. You can't take out the battery now. And this all comes down to, you know, permissions and what the phone's, you know, monitoring on the back end and it being... Staying connected from a geolocation perspective and that information is still being shared. And so to your point about Europe, and and this also applies in The US as well. Now I'm gonna layer into to... You know, with regard to the deep web and the dark web, what types of OSINT research can individuals identify about other individuals in those locations? And what can you... You know, what kinds of info can you find there that you can't find elsewhere?
So there's a lot of things that you could find in the dark web that you can't necessarily find on the surface web. But I'll tell you this, the distinction between surface deep and dark web is really being blurred in the... It has really been blurred in the past x number of years because you probably have seen people's reviews on the surface web for their favorite dark web marketplace, or or this site has been taken down. Heck, you can even Google for some dark web marketplaces on the surface web. And because there's software out there like Tor2Web, which will take a request on the surface web, go into the dark web, pull that content up to the surface web, and serve it to people on the surface web. Google and Bing and Yandex have sometimes indexed dark web sites.
We also have dark web search engines both on the surface web and in the dark webs, whether it's I2P or TOR. So the question of of of what's down there that's not up here on the surface web, it... It's really some things, but not that much. And it really depends also on the dark network that you're on. For instance, things like Freenet, which is more of a distributed file sharing service. It is used to share a lot more exploitation videos of children, of women, of other people that are being abused and trafficked, because it's it's impossible to get those images and those videos off of that platform just by how it's set up. But a lot of places nowadays, and and you might have seen this in in your work, Jeremiah, that a lot of the dark web marketplaces that used to have to operate in these...
In the in the dark web with special software, now they're just moving up to the surface web into some bulletproof hosting places. So, you know, they pay somebody somebody in Iran some money or someone in Russia some money, and they can do whatever they want. They can sell whatever they want on the surface web without fear of prosecution.
This is so wild to me. I feel like I've, you know, I've I've worked in cybersecurity. I I think I know a decent amount about cybersecurity, the all of the the, I don't know, less savory side of anything tech related. I just know nothing about. I'm so, like, lawful good that I don't even know anything. And any time someone starts talking about the dark web, I'm just like, what on earth? How does this work?
So to put it into perspective, Micah, if if you could, now that you can kind of access these things on the surface web through these bulletproof hosting companies and and, requests that are made with the TOR protocol in mind or the onion routing protocol in mind, and those things are brought back up. Prior to these things kind of happening, what would you typically see on, you know, the dark web that you wouldn't necessarily see on the surface web? Just sort of as an example.
So it it depends on where you are on the dark web. And I will say this much like what you were just saying, Bella. In the cybersecurity world, there are so many different pieces. There are so many different specializations that even though you may be a badass pen tester, you may not know much at all about digital forensics or other things. For me, I'm not an expert in dark web and all of the badness that's out there, cause the OSINT world is very analogous. There's so much to do. But, I mean, there are forums on there that... Where people are selling credentials to credit cards or selling credit cards that have been scraped from different ATMs. There are credentials from breaches that are being sold. There's people that are being trafficked, images and videos of anything and everything that you could want, as well as some some nice things.
I mean, there... The dark web is not all bad. Yes. There's a lot of bad activity that happens in there, illegal and moral and unethical things. But the dark web is also a very powerful place for people that are being oppressed, people that maybe have alternative lifestyles in countries where they... Their views, if they were expressed on the surface web, they might be criminally prosecuted or even jailed or or anything like that. So so the dark web wallet can be used to find breaches, to find credit card numbers, to buy drugs. Some people actually using it for okay things too.
So so leading kind of into that with information that can be available and or purchased, sold, bought, there are particular companies that are out there that can help. They they claim that they can help help you to remove your data. And so what I'm just kind of curious, what what is your personal opinion of those? And is that leading to more of a privacy economy where only wealthier people have privacy online?
It is hard to remove your data from the Internet. The techniques that I talked about earlier with Bella about about finding out what's out there, then trying to remove it or adding additional pieces to maybe downplay some of those less savory things that might be about there. Those are some techniques that we use a lot. And to your point, yeah, I absolutely think that it is... At least over here in The United States, it is something that not richer people have access to more, but it takes a lot of time and effort to reduce and monitor what's being posted about you online, especially the more public that you are. Obviously, musicians and politicians and other people that have massive online presences, they have a lot of things that they might say and do that they regret, and there's ways that you can deal with that, but at all costs.
Now, I do not have experience with any of these privacy focused companies that say, hey. For x amount of dollars, we'll remove this. I do have some personal experience going through a remove yourself from the Internet kind of checklist. And I'll tell you this, that it is it is something that is extremely labor intensive. I tried to remove myself from a whole bunch of those people search engines that we talked about earlier. And by opting out or by saying, I want you to remove this data, I coincidentally started getting a whole bunch more phone calls that my car's extended warranty was expiring and and email addresses. So I don't know if they're like, yeah. We'll remove you, but thanks for confirming that this is good valid data now. So... And it would be... It's a full time job too. And what I realized is that once things are on the Internet or once things are even collected, not necessarily on the in...
Internet, you've lost control of it. So I really try to make sure that only the things that I want to share about myself are given to the credit card companies, are given to the different online social media places so that I can protect my identity before it goes to these other places.
Do you think that there is a version of the future where we would all have more control over our own data and how it's used online? Or or I guess also what would what would be required for that version of the future to exist?
I would like that a lot. I would love a world where I, Micah Hoffman, have the rights to my personal property, intellectual property, where I have rights to my biological property. But the reality is is that we give up our privacy every single time we use an app, every single time we choose to purchase something with... Without, you know, credit cards. Every time we appear in public, you lose your privacy. Because there are cameras out there recording what we're doing, and there are Bluetooth sensors that are tracking you as you walk through cities without your consent. And I do not see any type of future where that would be in our hands, Bella, unfortunately. What I do see is futures where more people are educated about some of the things that are more important.
They start getting smart about how to counter some of these things, and we reduce the amount of data that's online. But, you know, just like me turning off that step counter and the stand counter and when I'm sleeping and whatever, just like me turning that off, it really comes down to people's personal preferences. And does the benefit outweigh the cost? If I'm having heart problems, having my iWatch check my heart rate and then let me know, hey. It's irregular right now, is a valid service, and I might opt in for that. But it's a personal risk based decision.
Yeah, I think that you made a really great point there, Micah, and that personal privacy, data privacy is all dependent upon the level of innovation that you would like to take advantage of from a marketplace perspective.
Absolutely. You know, have services that are nothing but brokers for other services. And when they're when they're doing that, they are collecting data on us just like we talked about collecting drinking data on people. I just went on vacation out to a certain part of The United States, and, you know, my credit card company knew when I checked into the garage, when I bought something in that airport, when I went here. And while that data is a little bit more protected than just general social media data, it's being collected by a company that's outside of my control.
Final question. Aside from the tailored information that you already have on LinkedIn, what You know what is some of the information or what is one thing that we wouldn't know about you that that you feel comfortable with sharing that wouldn't be available on your LinkedIn?
See? I don't put that on my LinkedIn, Jeremiah. There you go. Trying to make make me reveal private things after spending an hour talking about how I don't reveal private things. Well played, sir.
Yeah. This... It's like our fun, lighthearted closeout question, which takes a completely different turn after you, like you said, after you spent an hour talking about not sharing private information. Yeah.
Awesome. Micah, thank you so much. Yeah. This was really, really great. I'm gonna go take a walk without my iPhone, without my without my smartwatch, just totally untethered.
According to a recent survey, 95% of security professionals believe that cyber talent gap has not improved in recent years. The number of open security jobs today is quickly approaching 4,000,000. Perhaps you're feeling the effects of the talent shortage in your security operations. What tasks are you struggling to get done? Whether it's performing due diligence on an m and a target, working through vulnerability checklists, or checking testing boxes off for compliance, Synack campaigns can connect you with a researcher capable of getting the job done. Don't spend any more time writing job descriptions and sifting through candidate resumes. Let us connect you with the right talent to augment your internal team. Get your backlog tasks taken care of and fulfill any specialty your team needs with Synack campaigns. Synack researchers are available twenty four seven, and campaigns can be launched at the click of a button in the Synack platform. Reach out today at synack.com/campaigns.
