The Osint Kill Chain - Sam Macdonald (partial)

please hold to the end [Music]

photos people things I had a few months ago and slides for get what I'm saying it's because my mind's got black and like I said any questions at the end come gra after they're not particularly sort question of slides it's not technical talk at all it's more of a what we do on our daily lives so said I'm I'm a security cons Partners you see job title is um I've got two younger brothers Cameron who is a MTI he workot de people so the comedy inside our family very start my mom is a florist she does a lot of funeral flowers very dark and growing up my dad was say security researcher so basically he would do

things like due diligence pay on people companies so growing up surrounding

[Applause] education and he would do a lot of what laging which parents now social engineering I guess legal he no longer works in that field because well the laws changed and then rested as you may see I made the shaking but like Liam for Caff and also have a TR and it ks in whenever it morning outside of that was fig Cent grown up which my body movement I enjoy music which [Music]

seems I'm

single I do like short blond and I'm not exactly en now there's probably two in the room right now one is like that's details you into [Music] you might them and then the other is

okay the problem with that is the ones that think I'm oversharing I'm going to show you all the sort of information I've already given you is freely available online so those that aren't too bother about what I share show you

you so start with find out information just G you really compacted this because anyone research or work we know that there's multiple tools out there what's good today won't be good this afternoon and some people say they found information websites become very good it's been sending a web request say do the user username it will back say yes we do and then you will browse and realize you just get redirected to so when you're usings you get lot just be careful that [Music] I'm start with Ting linting is always a great resource when you want to do on individual so you've got some basic information say my name or the company I work at it's quite easy to find an

individual so one of the main areas that a lot of people focus on is your experience you give a lot of information that you may think is dead but it's very vital so of course we can see here security Partners also found in two different companies you can EAS find this information out I just some areas of this you go and look fine just sh lazy individuals so you can [Music] see I'm also cyber team member which means I do lot government work [Music] compy and of course education which seems irrelevant when you get to my age that's provides like a lot of information and then of course there's the contact details um I've got email address there

webite so car with some of that information we just received see that I've got two different compies so there's a lot government websites you can find all sorts of information out this one being the case of's house you don't have to log in or have an account start compan find out a lot of information about this company as you can see I've got a correspondence address so a lot of individuals when're setting up their Li company we use their home address so of course this is where I live please do not s and if you do my parents also on find now on this instance they only show you year I was doing a job for someone to

find out more information there and happen to be American they had their dates and they like to work out their month so you can piece together someone's home address andth now some people forget if they then go to the service office address they change update details previous sings on the system will show their original address and you can trace back the history as well find a lot financial information so you can see that I did swap in the last couple of years but then it gives you an understanding someone's financial situation C how much money they make from their business and how much they're probably taking home in the salary social media is just a treasure

TR I'm only going to focus on Instagram here but of course there are

others we've got one here it's not always about the pictures just reading people's comments so on this one here I make a comment that this is my favorite wh it will put ha on your chest it's not for pain and now you can notice a lot of pictures myself you I'm not one of those guys sh off I have friend W so now you know where much destination to visit and of course I did see sh oh there he is I'll show you I'm when we were bad and never we're bad again but now you know what one of my favorite sports is and one my favorite teams we'll see you later with now this is one

most people don't think about is the spish tracking apps we provide a lot of information on these apps that really give a second thought of what we're sharing a lot of us are just want a bit Kudos we want the lights we want that we of track what we really Shar you can see I no longer live at a family home in in London I now

sorry now if you compare the the first and the last day you'll notice that I tend to run the same rout at the same

time what contr I call them conventional face so once again we're sharing a lot of information about ourselves our likes our dislikes what's important to us pictures whe we smoke or drink or religion I really like to acheve this year from I'm not that posy but you know and there individual I'm looking for and I have terrible J and clearly like the big and all these alternative dat if you're do L due diligence or trying to hun someone down these are an area that people Ted to get out unless you're the person mind back because about now I'm not going to go into the app because if you know you know please don't find me I will be scrubbing this

after this but once again these are sites where really person information this isn't information that we're sharing on H these are our personal lights in the bedroom sometimes outside there are multiple of these this is one I Am a Unicorn I'm not on these apps they're just not the ti those on these you end up quite into the we don't think about what what if someone doesn't like us or ifes we have now willingly shared private internet pictures with ourselves the secondes this and say goes go on stays

on time B so now we're going to talk about the threat and arrow just some of this information that disclosed here now individuals like us I I don't know background story they're probably not going to affect us but if someone's targeting us where it's someone pulling out with with nation state acts up you're just generally a very bad person so the most simple one which would probably affect everyone this room is so when you were resetting our passwords on our accounts we get ask B information information that if I spend enough time on social media and other I can get access to so when I'm going to reset your password you hav't got or recovery

password very easy so what secondary school did I question what's your favorite drink what's your favorite sport what's your favorite holiday destination Shame of the answer also make your first SC face you know

that what was the name of your best friend well 37 I think it comes an age you no longer have friend just CLE what the name of your favorite pair once again these are things that people share on social media accounts second whether it's a current or old people will post the

last what once again I don't know why we use this in any sort of security question because it's so easy to down just qu on the had my account taken over I some AR my security question a lot of those questions my parents were there like who was your best friend at Primary School which turned into a big debate between my parents and who it was it was B and C that it last to you guys but at 2:00 in the morning I received a notification on an email address I had saying my the in the morning you're sleepy you deprived you're like I'll deal with that in the morning what so happen my parents

back in the day I installed WhatsApp my mom's phone email address and was sign with my iPad so they went ahead in middle and password access WhatsApp ID so we shared all this information we've got address date of birth information that we use identity now a lot of these slides I do have statistics but unfortunately to find statistics statistics that are Gran are very difficult so you can ask me after about references remember you have to do a lot digging around um so on one side that IDE did get on 44% have their bank account access to money 28% had their credit card Bank out stolen and used 23% had their name used opening credit card account which had happened

to myth believe me it is a pain in the back to get S to REM that I think they initial 3 months to respond to you 19% had anity account that's probably wor 5% had their stolen I had to go through that several times some up and get 4% had a new loan name probably would work for me my princi so our nation state Target this is what should say interestingly you may remember on my I'm I'm a c so I work a lot of government jobs which means if I'm working partners and I've got accreditation there more than likely I'm resources irat other areas so there's this article from in just in August where a Chinese spy was

hunting down people with security cences on link and in using all sorts of different methods to either get access to their computer or blackmail or you know time to time their money goes a long way some romance SC now this is quite an interesting one because it's it's no longer just the creation of AI it's so easy to scam an individual before you look at picture that person definitely doesn't like in 2022 there was nearly 8,000 romance average 11 nearly a fif datting scans report by people the age of 2 to 29 which you would think being a

generation and the rest followed by those in their 40s and 50s which is quite strange because I would thought someone in the age you know between 30 and 40 would be the ones that would be a bit more susceptible to these sorts of but this this about like things I've been sharing my dat profiles so quite easy just to dating profile short seem going to get my interest particular website I've mentioned then engage and so you think well I us this St like how someone in another Nation going to be able to home in in my location that's be very hard trth is get change zoomed up into the area you can use GPM and so there to

that but it's something to consider when you sharing so information sex kind

of sex occurs when intimate images videos captures during an online sexual exchange

black I don't [Music] have they there're fre accessible you can e just go on those websit find an individual if they're using the same username same way weuse passwords then find in an email account or Conta social media or you it's quite stressful to be contacted at your place of employment and be sent pictures of your manag despite how inclusive and friendly companies are I doubt they very much appreciate

revealed it received 11002 which compares to just under half in 2020 strangely enough 9

10 and over course of 2022 the numb

same so side St is one of those that is hard to get statistics on in this case was only able to get one year out the previous 20 to 30 years where it's actually been recorded now unfortunately C talking when it comes to statistics it's quite hard to Define um I think the national statistics of a prim class anyone any unwarranted contact we all know what [Music] cyber that so the thing is with the Cyber store here well you got Myra or other fitness apps you always know where I am got my Instagram you share story I'm too old to have Snapchat but you kind of get an idea how easy it would be to

C I'm sure anyone that's been on the date my

lastar