online and social media investigations: go beyond the big sites€¦ · online and social media...

Online and Social Media Investigations: Go Beyond the Big Sites

Edward J. AjaebPresident, Nighthawk Strategies

• Founder & President, Nighthawk Strategies• Licensed Private Investigator• Social Media & Digital Investigations• Background Investigations & Due Diligence

• Security Intelligence Analyst

• Executive Protection

• U.S. Department of Justice

• Author

• National Trainer/Speaker

Introduction

Edward J. AjaebPresident, Nighthawk Strategies

Traditional vs. Online/Social Media Investigations

Introduction

“Real Life” Identities

• Name

• DOB

• SSN

• Address

• Occupation

Online Identities

• Usernames

• Email addresses

• Phone numbers

• Pictures

Introduction

• Typically the first – or most popular – stops in online/social media investigations

What are the “Big Sites?”

•Privacy changes• Platforms changing privacy practices

• June 2019: Facebook disables most Graph Search capabilities

• Consumers changing privacy behaviors and attitudes

•Diversify, Diversify, Diversify!

Why “Beyond the Big Sites?”

Some social media stats:

• Nearly 3.5 billion people globally are on social media

• Nearly 70% of U.S. adults have at least one social media account

• The average American has over 7 social media accounts

• The average American spends roughly 2 hours per day on social media and has over 80 apps installed on their smartphone

• Social and communications apps account for approximately half of all time spent on mobile apps

Why “Beyond the Big Sites?”

• I know where you shop, eat, and sleep

• I know who you live with

• I can obtain cell phone videos of major incidents as they unfold in real-time

• I know who is in your phone’s contacts

• I know who your Facebook friends are (without looking on Facebook)

• I can trace your phone number to your name and photo in seconds

• I can find dozens of other social media sites and apps you use

What If I Told You…

And I can find all of this…• Free• Publicly• Starting with very little information about you• Beyond the “Big Sites”

What If I Told You…

• Explore a variety of non-“Big Site” online and social media platforms used by billions of people globally

• Understanding hidden investigative/intelligence value of each

• Techniques for collecting open source intelligence

• Examples and case studies

Focus

• OPSEC & Best Practices• VPN

• Archival software

• Anonymization and alternate online personas (email, phone, etc.)

• Use these techniques, tools, and practices as your own risk• Defer to your company/agency policies, local regulations, and Terms

of Service

Reminders

• Pay and request money from friends

• Launched in 2009

• Acquired by PayPal in 2013

• Link with bank account or credit/debit card

• Processed $62 billion in payments in 2018

• $100 billion in transactions expected in 2019

Venmo

0 10 20 30 40

Active Digital Users (millions)

Transaction information (sender, recipient, date, purpose) is public by default

Venmo’s Value for Investigators

1

2

3

Publicly viewable friends lists curated from imported phone contacts and Facebook friends

Searchable database of 40 million users

Information about a payment’s sender, recipient, date, and purpose are public by default.

Venmo’s Value for Investigators

1

Sender Recipient

Profile Photo

“Public”Privacy Setting

Payment Purpose/NoteDate

Venmo’s Value for Investigators

Sender Recipient

Profile Photo

“Public”Privacy Setting

Payment Purpose/Note

Date

Venmo’s Value for Investigators

• Venmo asks users to import their phone contacts and Facebook friends.

• Contacts who also use Venmo are then added to the user’s “Venmo friends” list, which is public and cannot be hidden.

Venmo’s Value for Investigators

2

• All of Venmo’s 40 million users areeasily searchable by name and/or username

• Many users have uploaded their photo to their Venmo profile

• Many users have kept default (public) privacy settings, allowing you to see entire transaction history

Venmo’s Value for Investigators

3

Following the money…

…right to their doorstep

Venmo’s Value for Investigators

What

When

WhereWhy

Who

Transaction information (sender, recipient, date, purpose) is public by default

Venmo’s Value for Investigators

1

2

3

Publicly viewable friends lists curated from imported phone contacts and Facebook friends

Searchable database of 40 million users

• Chat and video calling

• Launched in 2003

• Acquired by Microsoft in 2011• Integration with other Microsoft products

• Estimated number of users worldwide: 1.5 billion

Skype

• Searchable database of 1.5 billion users• Search by:

• Name• Email address• Phone number• Username

Skype’s Value for Investigators

Integration with Microsoft

Skype’s Value for Investigators

Name

Phone Number

Email Address

Username

Skype

Searching by name• Enter first and last

name• Partial names and

wildcard (*) accepted• Try nicknames and

name variations (Nick, Nicholas, Nicky, etc.)

Skype

Searching by phone number• Enter 10-digit phone

number• If no results, try adding

country code (“1” or “+1” for U.S. numbers)

Skype

Searching by email address• Enter email address

into search box• Partial email addresses

and wildcard (*) donot work

Skype

Searching by username• Enter username (or

assumed username)into search box

• Partial usernamesand wildcard (*) donot work

• Searchable database of 1.5 billion users

• Converting email addresses and phone numbers into real names

• Discover additional usernames and online aliases/personas of an individual

• Use as leads for deeper investigation

Skype’s Value for Investigators

• People often use the same username across multiple online and social media sites

• Throughout your investigation, keep a running list of all usernames, emails, and online personas you find on your target

• Use these Username Search Tools to find other online accounts and profiles registered with the same username

Username Search Tools

Username Search Tools

Username Search Tools

• InstantUsername.com

• CheckUsernames.com

• Namechk.com

• NameCheckup.com

• NameVine.com

• KnowEm.com

• NameCheckr.com

• UserSearch.org

• Google/Bing

Username Search Tools

• Use multiple sites!• Not all sites search the same platforms

• “Username not available” means that there is an active account with that username on that platform• Click to view profile/account

• Launched in 2011

• Multimedia messaging social media app

• Share pictures and videos with friends

• Content disappears after a set time

• Users can create video “stories” that can be viewed by friends

• 200 million daily active users

• Snap Map

Snapchat

Snap Map

• Short video stories from users around the world

• Publicly uploaded by individual users

• Active within minutes of capture (near realtime)

• Expire after 1-3 days

• Can see where and when

• Cannot see who

map.snapchat.com

• Near real-time security monitoring and awareness• Protests• Natural disasters• Accidents• Active shooter incidents

• Investigations/surveillance

• Scene canvassing

Snap Map’s Value for Investigators

Snap Map is “OSINT in Action”

Photo: Associated Press

• Not just a kids app

• Essential tool for investigations, security monitoring and safety awareness• Public areas• Commercial buildings• Schools• Criminal investigations

Snapchat/Snap Map

• Digging Deeper: Going Beyond the “Big Sites”• Understand what it's used for

• Think about what else it could be used for

• How can it be valuable to investigators?

• Integration & Interconnectivity• Cross-sharing of data between apps

• Friends, contacts, online identity info

Wrap Up

• I know where you shop, eat, and sleep

• I know who you live with

• I can obtain cell phone videos of major incidents as they unfold in real-time

• I know who is in your phone’s contacts

• I know who your Facebook friends are (without looking on Facebook)

• I can trace your phone number to your name and photo in seconds

• I can find dozens of other social media sites and apps you use

Remember When I Told You…

Recap

• Who, What, When, Where, Why

• Pattern of life (live, eat, shop, hangout, etc.)

• Phone contacts and Facebook friends

• Usernames and photos

• Searchable database of billions of users

• Usernames

• Email Addresses

• Phone Numbers

• Find your target’s real identity and photo

• Discover dozens of other digital services used by your target:

• Social media platforms

• Mobile apps

• Online communities

• Obtain cell phone videos of major incidents as they unfold

• Near real-time security monitoring and awareness

Username Search Tools

The world of OSINT investigations is always changing

Free OSINT Guides for continued learning (coming this fall):• Browser Add-Ons Every Investigator Should Have

• Properly Documenting Online Investigations

• Catching a Catfish: Exposing Online Dating Scams

… and more

Follow @NighthawkStrat on Twitter or subscribe to our blog at NighthawkStrategies.com/Blog

Stay Up-to-Date

facebook.com/NighthawkStrategies

linkedin.com/in/EdwardAjaeb

@NighthawkStrat

info@nighthawkstrategies.com

NighthawkStrategies.com