[Music]
all right hi guys uh welcome to your
last Talk of the night my name is Lucas
I'm GNA be presenting some open source
intelligence uh I'm here with the uh
physical security Village uh we're just
in the other room over there
so what is ENT ent's basically any
information you can find online without
having to you know hack into an account
you know create a log of you looking at
it uh it's really zero touch and uh it
makes it really easy to get into because
you don't have have to have any
experience with coding or anything like
that you just have to know how to you
know if you ever looked up your you know
High School Crush you basically have
enough skills to do
it so uh here are some resources that
you can use to uh start inosent
investigation my favorite here is uh
LinkedIn so LinkedIn is my favorite data
source because a your company posts
about you and then B you post about you
and your company so especially with uh
you know the recent Tech layoffs a lot
of people like posting uh oh I worked
here for 30 years here's a picture of my
badge in my workspace well you know that
badge you know I can make a copy of it
and then social engineer my way into
your workspace um which you know you
probably would like because you just got
fired by them uh
um for younger people though it's
usually Tik Tok and Snapchat uh
Snapchat's really useful because it has
location services so um in like missing
persons investigations it's really
useful because you can see this person
posted this story at this place and then
uh for Tik Tok you know you got this
video of their surroundings oh there's a
car in the background there's this you
know what's outside the window and then
you can start making uh you know uh
Geographic investigation of like oh uh
let's try and you know get uh idea of
where they
are so uh I'm GNA go over a couple tools
uh there's so many tools out there for
ENT and you can also of course create
your own but these are three that I use
pretty frequently and then I'll cover
another one when I go over uh physical
sites so multigo uh is a it's a really
great one if you have a lot of money uh
there's a lot of different it's called
transforms uh you can pay for and then
you get access to databases to query
from uh you put in a username you put in
a domain address or you know even
someone's first name and then you can
find accounts linked to that of course
there's going to be false positives
there's going to be you know irrelevant
data but that's you know where your
analyst will come into play um it's
great for creating leads when you're
stuck and you have no idea where to go
because you know I don't even know where
some of these things come from but hey
they're there and they work
um who is this one's a bit more simple
uh it's just a a webbased version to uh
you know ping a server and it translates
a domain name to that server IP and you
can get DNS records and register
data and then uh last for uh this
section uh showan so it's really useful
after going from who is uh you can take
that server IP put it in there um and
then you can get um the server
approximate location you can find out
what technologies are running on that
server as well as uh it will list with
those Technologies what version if they
can find it um if there's any
vulnerabilities that are still open for
that so it basically gives you like your
recipe book of how to break into this uh
server um it's really useful for uh and
known for IP cameras and Industrial
facilities um you can you know mess with
SCA uh skada stuff uh from this website
you can just browse it they have like
categories and stuff like
that so I'm gonna do a demo uh this is
going to be a bit of a interesting thing
to do because I have to look over
here does someone want to guide me
perhaps all right am I on the second tab
here all right I believe this is what is
this is this who is awesome so I ran a
scan on a website called PSV .org or
fsc.org
um and what you can find here is I don't
know what tab I'm on actually uh I think
these are the DNS records if I remember
correctly so there's going to be an IP
listed down here uh you guys can see
that yeah so with that you can plug that
into showan okay is that showan right
there that might
work um and what you can find here is it
shows the open ports and the
you know um based on the IP address you
can find a generic location but what I'm
really interested in is those
technologies that are listed with uh
version numbers and stuff like that
because it gives cves and uh you know
those exploits that you can use to try
running against that server if you want
to bring this from ENT to no longer ENT
you know trying to break into
something all right let's switch back to
uh does anyone uh have any questions on
that okay
am I on the right
note Perfect all
right so next up uh this is just an
example of an ENT framework so this is
basically your instruction set on how to
not run down rabbit holes so very often
when you're doing investigation it's
really easy to just click like the next
button for like 5 hours and you realize
the Sun's Up and like what have I been
doing so this is really useful for you
know you spend maybe 30 minutes to an
hour on each one of these points and
then move on because let's face it
there's so much information out there
you're not going to be able to find
everything so you might as well find
these important points that
um will help your investigation more
than you know maybe finding that one you
know golden
egg so I'm going to trans uh transition
to locations so these uh techniques will
be more helpful if you're trying to uh
make a report on a physical location
that you
know sorry um that you're going to want
to you know create an investigation on
so here are some Search terms you can
use in Google it's Google Dorking um I'm
not going to go through this in huge
detail but you can put a location name
and then filter by file type or you know
keyword so you just put the you know
quotes around the word and you'll find
stuff based on that search uh for all
intents and purposes I'm going to show
is it this slide so here's um an example
of a search it's from uh I just searched
up PDF for
masterlock um and as you can see at the
red arrow there's something that seems
to be from the internal Network that
says restricted so I don't know if
that's supposed to be there but uh I
found it and I thought that would be an
interesting thing to add
here so another example uh I looked at
Lo address and I turned up a document uh
saying what uh they want to do when they
fire you so they permanently displace
you uh I don't know why this is also out
there but it's it's there too it could
be useful um and then a and then a third
whoa I am going backwards okay so this
one this example is really useful for
social engineering so it's a document
that uh describes a interaction between
I think it's Department of Natural
Resources in Milwaukee and masterlock
and it shows that they were on site here
are some contacts to reach out if you
have any further questions to Milwaukee
it shows the contacts for both sides so
I know who to contact inside of
masterlock to say hey I'm part of DNR I
wanted to follow you up on this thing
can I meet you on site and you know you
don't have to uh you know like meet up
with this person but that might gain
access to that site and then also you
could do the opposite and say hey I'm
from Master Lock I was told to contact
you when we set up a meeting and this
could be used for number of Nefarious
purposes so oh uh so here's uh some
applied ENT so I
did some investigations with uh for
human trafficking with a volunteer uh
open source intelligence group uh I
can't really get into details but this
is the inside of one of those places and
what you can find uh which is helpful to
have actional intelligence is uh let's
see so you see the three rooms there
it's really useful to try to put
together your own floor plan especially
if it's not available online so for
example uh if you can see the image in
the middle there's that monitor in the
back if you can make that out I think I
have that circled as well that shows
that that person has full view of those
cameras and wherever they are they can
see what's going on in that room even if
the door is closed and then in the third
photo you can see actually one of those
cameras in the
hallway so for the next slide you can
see the outdoor and I labeled what those
cameras can see uh and what that monitor
would probably show that person that's
inside and this is really useful for
let's say law enforcement who's going to
conduct a raid um it shows all possible
places that you should avoid uh or if
you need to move
quickly uh and then to continue on the
outside if you don't have any pictures
so I'm going to go back some slides this
one those photos I found on Google Maps
um someone made a review and said this
place is really good um so they po
posted these pictures and you know
they're really useful um not in the way
they probably
thought so to continue with this those
uh red circles there are showing
different HVAC units to show that there
are four different individual rooms that
they have to like let's say law
enforcement has to clear um
this is really useful as well to support
that floor
plan uh do you have any
questions I think I'm missing some
slides but that's all good
yeah my sure all right so I saw this
online um let's say I was doing ocean
yeah um and I just had to buy it you
know it it looked really funny I think
you guys probably appreciate it huh
yeah thank
you in the back uh do you ever use any
of the Michael baz Intel techniques
tools stuff or so I have his book uh so
the question was have I ever used
Michael baz's uh techniques and tools
yeah um so some of them are uh I don't
have that much experience with them but
I've heard great things and I've learned
uh tremend like more than probably all
my other books can
yeah I would highly recommend Michael
basil for uh getting started in OS um
how about like
data so breach data is uh it's a little
bit of a gray area because yes it's ENT
but I'm talking like open openly
available openly available um yeah
that's free game honestly if if you find
something that's actionable based on
those breach databases go for it as long
as you're not using that breach data to
access something you're not supposed to
yeah Google Street View is really useful
until the images get really blurry I
would recommend Bing which is kind of
funny um so Bing has this thing called I
think uh bird's eye and it is the
highest quality images I think I've ever
seen from like open you know satellite
imagery um you get uh like you can go uh
at a 45° angle 90° and it's really high
quality so actually if I go back um for
this image this is Bing so on Google it
just looked like a gray blob um it it's
not very useful and it just shows you
know the business name and really big
bold you couldn't really see anything uh
Bing is really great for that
additionally um I find that uh Yandex is
really good for like if you just look up
like you know uh let's say Fort KNX
right it'll come up with a lot of
keywords uh if you go from searching uh
images to just searching the web come up
with keywords that you can use to narrow
your search if you're looking for
something that looks like fortnox but
isn't fortnox um so you don't like if
you don't even know where to start for
an image
search Yandex
yeah
yeah so I have
sorry so property taxes that goes a bit
into like uh my AML friends so
anti-money laundering they love doing
that and a forensic accountants um that
stuff is not necessarily my forte but uh
I have dabbled a little bit Most states
will have their own databases for taxes
and other records um
they're really useful and you like some
of the investigations I've done with
people who are good at that uh you you
get scary detail I would highly
recommend uh you know if you have your
own business try looking it up in these
uh like gogov addresses and uh you could
find some pretty interesting things that
you might not think would be
open and for uh GIS software uh I do a
little bit with that so Google Earth Pro
I unfortunately don't have a license to
argis uh but I'm working on
that oh
absolutely
y so uh the uh response to that was you
could pull uh you could use GIS and then
uh use Edgar to uh build off of that
correct yeah yeah you know
yeah
absolutely
um is there anything else you want to
follow with that or no I'm Sor all good
all
good since I have some extra
time yeah yeah since I have some extra
time I think I'm going to try and
reclaim my lost slides so bear with me
while I try to change the display
settings all
right
duplicates
um actually I'm gonna undo that because
I don't want you guys to see my
drive uh let's see
revers all right okay
cool so for context My sl oh I forgot
they're not even slides okay so let me
share my screen I found this really
interesting business card uh by the name
of Eric and uh I found some interesting
information oh you might be in the crowd
interesting um and I found some
interesting information on his company
based off of just the address listed on
the business card so let me share my
screen
again
duplicate keep
changes all right can you guys see this
now all right so Mr Eric here works at
National Bank of Canada Toronto so what
you can do is I have the address
highlighted there in blue and I pop that
into Google search and I put file type
PDF now when you put file type PDF a lot
of places like to list um like if you're
going to try renting a building uh you
can find you know floor plan layout
stuff like that and we'll see that
pretty soon um so moving on to the first
one so this is just a leasing contract
that bentall green oak posted and it has
a lot of information about this building
including the layout of certain floors
so this is floor 12 um however this is a
high-rise and most highrises don't
really vary in shape going up that would
be kind of weird so you can see a
general layout of every floor here uh
the the stairs if I can like hover
around there uh your mechanical rooms
and then also uh elevators so you can
see you know potential uh areas of
access that you might want to exploit uh
for different
floors um and then further on you can
see the specific section so you see in
the top left it's gray there that's the
section of the floor and you get more uh
specific dimensions and uh
see there's another staircase and
elevator here moving on here's another
layout uh this is a smaller layout a
subsection of the building however you
can see the tenants here that's
interesting because what if you were
interested in you know Finding
information on one of those tenants that
is all open to you um and then of course
you can go to the um like go through uh
forensic counting and stuff like that uh
through doov websites looking up that
and have this as well
well and then finally uh here's like the
building schematic for the underground
parking lot now there's probably a lot
of useful things to do with this uh I'm
not qualified to answer those but you
can see again elevator shafts
uh uh services and like just mechanical
rooms so those like what if you wanted
to shut off the power to the whole
building well you could maybe do it
there you could check it out um and this
is just a great place to start and uh
start your investigation and start uh
your case so all of that I found in like
about three Google searches maybe uh so
that just shows you how much power you
could have with open source
intelligence all right yeah
question
correct ENT for good well uh um I hope
you didn't think that I was doing ENT
for human trafficking on the bad side um
yeah I'm doing it for good um uh in what
context do you mean like like
privacy oh absolutely yeah yeah so
there's uh some great groups I work with
uh there's one atii uh anti-human
trafficking teligence initiative they
work a lot with uh the dark web and uh
uh they have a cool tool called Hades
and it strips all the images from like
um you know cam websites if you're
familiar with the acronym uh and it
shows the identifiers and metadata of
those images so you can create profiles
of let's say you know someone who's
really active with like SE sex crimes
and stuff like that you can create a
profile and then you know work on that
and really dig into it and submit that
to law enforcement and you know
hopefully make a case additionally
there's places like Trace Labs I love
Trace labs they uh they're crowdsourced
OS initiative where every I would say
few months or so they uh put out a a CTF
where you get profiles of missing people
and these missing people uh are usually
from departments like police departments
that don't have the resources to fund
investigations themselves and you
supplement them with so much information
based off a couple searches like you
know on Instagram or Facebook but you
can find so much information from a
fresh set of eyes rather than you know
the two investigators for a whole County
um I would highly recommend starting
there they're a great entrylevel um ENT
place where you can do good for
sure yep are you based in Milwaukee so I
walked in a little late I didn't all
good the question was if I'm based in
Milwaukee uh no I'm from New York uh I
go to merth college how uh how can one
like get into some of these
organizations yeah yeah the question was
how to you know gain entry to these uh
organizations to start helping um
honestly all of them are asking for help
so for some of them you know more
sensitive information you might have to
fill out an application and like they
might have to screen you and stuff like
that but Trace Labs you can literally
just I think pay five bucks to enter
their ctfs or you could join their
Discord they have ongoing operation
which means they're not running a CTF
but hey here are some missing people
that you could try and find do you have
any
other company you work with uh I would
say uh Trace labs atii and uh oh there's
another
one skull games all right I don't
personally know skull games but this guy
seems like a cool dude and he said skull
games so I'm going to go with that as
well and you said a ATI yeah it's run by
Larry Cameron if you look him up on
LinkedIn
y that one's that one's a good one
yeah any other
questions
sure most interesting thing I found on
Showdown um
probably you know I don't actually know
I would probably have to say there is a
aircraft maintenance tunnel uh and you
could see like you know the trucks that
bring the food they go fast they fly and
you can like there's a exposed IP web
camera and you could just watch them go
back and forth I don't know it's not
something really like you know crazy or
anything but I I don't know thought it
was
weird you ever get any of the elastic
open elastic databases showed in um I
don't have any familiarity with those
but I'm sure you can find them
there so am I G to start telling knock
knock jokes or is it time for me to head
down all right thank you
[Applause]
guys