Instructor: Open Source Intelligence or OSINT. 2 2
What is OSINT? 3 3
OSINT is the ability to use publicly available information, 4 4
plus the tools used to aggregate 5 5
and search that information. 6 6
Now, there's a lot of different ways 7 7
to collect open source intelligence out there. 8 8
Now, many companies and individuals work 9 9
in organizations that have a ton of information 10 10
that's published on the internet about them. 11 11
For instance, my small little company has a lot 12 12
of information about us. 13 13
You can go online into the web or social media sites 14 14
and find lots of information about us. 15 15
This is all open source intelligence, 16 16
and if you were trying to target and attack us 17 17
you could use this to cyber stalk us and determine all sorts 18 18
of information about us using things like Google 19 19
and Bing and Duck, Duck, Go, and many other tools out there 20 20
all over the web to collect this data 21 21
and build a whole dossier on me or my company. 22 22
Now, attackers use OSINT all the time 23 23
because OSINT can allow an attacker to develop a number 24 24
of strategies for compromising a target. 25 25
For instance, if you are an attacker 26 26
you might find an employee that works for a company 27 27
on a dating website and strike up a conversation with them, 28 28
get them interested in you, and then start asking them 29 29
for details about their company's security procedures maybe. 30 30
This is a great way to start getting information 31 31
out of them using social engineering. 32 32
Or you might put them in a compromising situation 33 33
and then use that for blackmail or entrapment. 34 34
There's lots of different ways that OSINT can be used 35 35
out in the real world as an attacker going after people 36 36
in your company, so it's something to keep in mind. 37 37
Now, when we talk about OSINT, 38 38
what are some of the sources of OSINT? 39 39
Well, we have publicly available information. 40 40
This is information that any attacker can harvest out there 41 41
from public repositories or web searches. 42 42
For instance, if you wanted to find 43 43
my company's physical address, you could Google that 44 44
and figure out where we are in San Juan, Puerto Rico. 45 45
This data is publicly available. 46 46
Also, you can use social media. 47 47
Social media is great because you can go on Facebook 48 48
or LinkedIn and start friending and liking people 49 49
and making a connection, and then use that 50 50
for additional attacks such as social engineering. 51 51
You might also use HTML code. 52 52
If you search the HTML code of an organization's webpage, 53 53
you can find lots of information in there like IP addresses, 54 54
names of web servers, what operating system version 55 55
they're using, what file paths there are, 56 56
names of people who work there and developers 57 57
and admin and all sorts of other stuff. 58 58
Again, by looking through code, you can find a lot 59 59
of information about an organization, their capabilities, 60 60
their practices, and their security posture. 61 61
And finally, you can also look at metadata 62 62
because metadata is open source intelligence. 63 63
If you publish a Word document or an Excel spreadsheet 64 64
to your website, there's metadata inside of that, 65 65
and by going through that metadata, we can start collecting 66 66
a lot of information and start fingerprinting you 67 67
and understanding exactly what documents belong 68 68
to your company as we do a wider search across the internet. 69 69
Now, one quick tip about OSINT for the C-Y-S-A plus exam. 70 70
On the older version of the C-Y-S-A plus exam, 71 71
they actually asked you to do a lot more 72 72
with OSINT and be able to search for information 73 73
on your own company, but that doesn't exist anymore. 74 74
Instead, when they talk about OSINT, 75 75
they're referring specifically to open source threat data 76 76
and intelligence sources, and it's not going to be focused 77 77
on your ability to actually conduct OSINT. 78 78
Now in this course, we are going to do a little bit 79 79
of OSINT and we are going to play a little bit 80 80
in that reconnaissance world as we go through 81 81
and learn about Google hacking and search tools 82 82
and things like Shodan. 83 83
And this is all good information to know 84 84
and understand as a cybersecurity analyst in the real world 85 85
but you won't have to know it in depth for the exam.