online and social media investigations: go beyond the big sites€¦ · online and social media...
TRANSCRIPT
Online and Social Media Investigations: Go Beyond the Big Sites
Edward J. AjaebPresident, Nighthawk Strategies
• Founder & President, Nighthawk Strategies• Licensed Private Investigator• Social Media & Digital Investigations• Background Investigations & Due Diligence
• Security Intelligence Analyst
• Executive Protection
• U.S. Department of Justice
• Author
• National Trainer/Speaker
Introduction
Edward J. AjaebPresident, Nighthawk Strategies
Traditional vs. Online/Social Media Investigations
Introduction
“Real Life” Identities
• Name
• DOB
• SSN
• Address
• Occupation
Online Identities
• Usernames
• Email addresses
• Phone numbers
• Pictures
Introduction
• Typically the first – or most popular – stops in online/social media investigations
What are the “Big Sites?”
•Privacy changes• Platforms changing privacy practices
• June 2019: Facebook disables most Graph Search capabilities
• Consumers changing privacy behaviors and attitudes
•Diversify, Diversify, Diversify!
Why “Beyond the Big Sites?”
Some social media stats:
• Nearly 3.5 billion people globally are on social media
• Nearly 70% of U.S. adults have at least one social media account
• The average American has over 7 social media accounts
• The average American spends roughly 2 hours per day on social media and has over 80 apps installed on their smartphone
• Social and communications apps account for approximately half of all time spent on mobile apps
Why “Beyond the Big Sites?”
• I know where you shop, eat, and sleep
• I know who you live with
• I can obtain cell phone videos of major incidents as they unfold in real-time
• I know who is in your phone’s contacts
• I know who your Facebook friends are (without looking on Facebook)
• I can trace your phone number to your name and photo in seconds
• I can find dozens of other social media sites and apps you use
What If I Told You…
And I can find all of this…• Free• Publicly• Starting with very little information about you• Beyond the “Big Sites”
What If I Told You…
• Explore a variety of non-“Big Site” online and social media platforms used by billions of people globally
• Understanding hidden investigative/intelligence value of each
• Techniques for collecting open source intelligence
• Examples and case studies
Focus
• OPSEC & Best Practices• VPN
• Archival software
• Anonymization and alternate online personas (email, phone, etc.)
• Use these techniques, tools, and practices as your own risk• Defer to your company/agency policies, local regulations, and Terms
of Service
Reminders
• Pay and request money from friends
• Launched in 2009
• Acquired by PayPal in 2013
• Link with bank account or credit/debit card
• Processed $62 billion in payments in 2018
• $100 billion in transactions expected in 2019
Venmo
0 10 20 30 40
Active Digital Users (millions)
Transaction information (sender, recipient, date, purpose) is public by default
Venmo’s Value for Investigators
1
2
3
Publicly viewable friends lists curated from imported phone contacts and Facebook friends
Searchable database of 40 million users
Information about a payment’s sender, recipient, date, and purpose are public by default.
Venmo’s Value for Investigators
1
Sender Recipient
Profile Photo
“Public”Privacy Setting
Payment Purpose/NoteDate
Venmo’s Value for Investigators
Sender Recipient
Profile Photo
“Public”Privacy Setting
Payment Purpose/Note
Date
Venmo’s Value for Investigators
• Venmo asks users to import their phone contacts and Facebook friends.
• Contacts who also use Venmo are then added to the user’s “Venmo friends” list, which is public and cannot be hidden.
Venmo’s Value for Investigators
2
• All of Venmo’s 40 million users areeasily searchable by name and/or username
• Many users have uploaded their photo to their Venmo profile
• Many users have kept default (public) privacy settings, allowing you to see entire transaction history
Venmo’s Value for Investigators
3
Following the money…
…right to their doorstep
Venmo’s Value for Investigators
What
When
WhereWhy
Who
Transaction information (sender, recipient, date, purpose) is public by default
Venmo’s Value for Investigators
1
2
3
Publicly viewable friends lists curated from imported phone contacts and Facebook friends
Searchable database of 40 million users
• Chat and video calling
• Launched in 2003
• Acquired by Microsoft in 2011• Integration with other Microsoft products
• Estimated number of users worldwide: 1.5 billion
Skype
• Searchable database of 1.5 billion users• Search by:
• Name• Email address• Phone number• Username
Skype’s Value for Investigators
Integration with Microsoft
Skype’s Value for Investigators
Name
Phone Number
Email Address
Username
Skype
Searching by name• Enter first and last
name• Partial names and
wildcard (*) accepted• Try nicknames and
name variations (Nick, Nicholas, Nicky, etc.)
Skype
Searching by phone number• Enter 10-digit phone
number• If no results, try adding
country code (“1” or “+1” for U.S. numbers)
Skype
Searching by email address• Enter email address
into search box• Partial email addresses
and wildcard (*) donot work
Skype
Searching by username• Enter username (or
assumed username)into search box
• Partial usernamesand wildcard (*) donot work
• Searchable database of 1.5 billion users
• Converting email addresses and phone numbers into real names
• Discover additional usernames and online aliases/personas of an individual
• Use as leads for deeper investigation
Skype’s Value for Investigators
• People often use the same username across multiple online and social media sites
• Throughout your investigation, keep a running list of all usernames, emails, and online personas you find on your target
• Use these Username Search Tools to find other online accounts and profiles registered with the same username
Username Search Tools
Username Search Tools
Username Search Tools
• InstantUsername.com
• CheckUsernames.com
• Namechk.com
• NameCheckup.com
• NameVine.com
• KnowEm.com
• NameCheckr.com
• UserSearch.org
• Google/Bing
Username Search Tools
• Use multiple sites!• Not all sites search the same platforms
• “Username not available” means that there is an active account with that username on that platform• Click to view profile/account
• Launched in 2011
• Multimedia messaging social media app
• Share pictures and videos with friends
• Content disappears after a set time
• Users can create video “stories” that can be viewed by friends
• 200 million daily active users
• Snap Map
Snapchat
Snap Map
• Short video stories from users around the world
• Publicly uploaded by individual users
• Active within minutes of capture (near realtime)
• Expire after 1-3 days
• Can see where and when
• Cannot see who
map.snapchat.com
• Near real-time security monitoring and awareness• Protests• Natural disasters• Accidents• Active shooter incidents
• Investigations/surveillance
• Scene canvassing
Snap Map’s Value for Investigators
Snap Map is “OSINT in Action”
Photo: Associated Press
• Not just a kids app
• Essential tool for investigations, security monitoring and safety awareness• Public areas• Commercial buildings• Schools• Criminal investigations
Snapchat/Snap Map
• Digging Deeper: Going Beyond the “Big Sites”• Understand what it's used for
• Think about what else it could be used for
• How can it be valuable to investigators?
• Integration & Interconnectivity• Cross-sharing of data between apps
• Friends, contacts, online identity info
Wrap Up
• I know where you shop, eat, and sleep
• I know who you live with
• I can obtain cell phone videos of major incidents as they unfold in real-time
• I know who is in your phone’s contacts
• I know who your Facebook friends are (without looking on Facebook)
• I can trace your phone number to your name and photo in seconds
• I can find dozens of other social media sites and apps you use
Remember When I Told You…
Recap
• Who, What, When, Where, Why
• Pattern of life (live, eat, shop, hangout, etc.)
• Phone contacts and Facebook friends
• Usernames and photos
• Searchable database of billions of users
• Usernames
• Email Addresses
• Phone Numbers
• Find your target’s real identity and photo
• Discover dozens of other digital services used by your target:
• Social media platforms
• Mobile apps
• Online communities
• Obtain cell phone videos of major incidents as they unfold
• Near real-time security monitoring and awareness
Username Search Tools
The world of OSINT investigations is always changing
Free OSINT Guides for continued learning (coming this fall):• Browser Add-Ons Every Investigator Should Have
• Properly Documenting Online Investigations
• Catching a Catfish: Exposing Online Dating Scams
… and more
Follow @NighthawkStrat on Twitter or subscribe to our blog at NighthawkStrategies.com/Blog
Stay Up-to-Date
facebook.com/NighthawkStrategies
linkedin.com/in/EdwardAjaeb
@NighthawkStrat
NighthawkStrategies.com