Open-source intelligence – it’s incredible what you can find from public sources

Traditional uses of open-source intelligence lie in national security, investigating crime and cybercrime, and researching threat intelligence or investigating malware campaigns and advanced persistent threat (APT) groups. However, OSINT is also useful for regular companies, cybersecurity consultants doing penetration testing, or red teaming and privacy-aware people.  Everyone who browses and shops online and uses social media can have a surprisingly large digital footprint.

In cybersecurity, specialists mine data from open sources, combine pieces of information, and create a map or a profile of the target. The target might be an organization and its network infrastructure and services they use, a person, or a group of employees that play a vital role in the organization. The information gathered with OSINT is useful in several ways:

 You can identify the attack surface: This is especially important if you are offering online services. What kind of version information is available? Are you exposing only the necessary services and information? What about your office network: are there any printers, WLAN controller management interfaces, or other unexpected hosts accessible from the internet? Can you identify potential persons who to target with social engineering attacks? This information-gathering phase is a typical stage in penetration testing and red teaming as well. However, it’s essential to understand that while passive and semi-passive data collection from open sources is considered legal, active information gathering methods, such as port or vulnerability scanning, are considered illegal if you don’t have permission. 

You can identify security gaps: Have you hardened the operating systems and applications that are exposed? Are there known vulnerabilities or weaknesses? What kind of ways there are to contact you or your organization, and are they all well-protected? 

You can fight information leaks: Accidents happen: somebody might accidentally publish material that wasn't supposed to be released yet. Maybe another online service suffered a data breach, and the email addresses and passwords are now in Pastebin – including your employees' passwords that might work for your web services as well. If you notice problems early, you have more time to react.

Outside security, open-source intelligence techniques, and tools can be useful for investigating market opportunities and checking what your competitors are doing.

Information sources and tools

There are numerous publicly available sources, both online and offline, that you can use for gathering information. Have you ever thought about how much data your social media profiles reveal when you take into account all your connections, as well? There's also more than meets the eye. File metadata often reveals interesting information about the author of the document and the tools and the operating system used for creating the file. Image metadata may contain the location where the picture was taken and thus your whereabouts.

The mind map below shows some common information sources, their uses, and what tools you can use for getting and analyzing the data. The mindmap has been from the point of view that an organization is a target. If the goal would be to gather information from an individual, say for social engineering or phishing attacks in penetration testing, many of the same information sources and tools apply.

One of the biggest challenges in OSINT is to handle the loads of information with which you will very typically end up. Tools come handy pretty quickly so you can automate data collection, organize the data, and find links between individual pieces of information. Tools like Maltego visualize the info so you can examine it more easily.

It's also good to understand that all information sources may not be reliable, so you may need to filter out some of it. You also need to pay attention to securely storing the data and respecting privacy, since the data may point out significant weaknesses in an organization and contain personal data.

The dark side of OSINT

All information that is out there is also available for cybercriminals. When you look at the mind map showing possible information sources and tools, you can begin to imagine all the potential malicious uses of that data. Identity frauds, social engineering, CEO frauds, targeted attacks with customized malware, … open-source intelligence can be a gold mine if somebody is interested in breaking into your company's IT systems. That's why it's better to understand your exposure. You cannot wholly remove data that has been published on the internet once, but you can make it more difficult to find. And what's more important, you can ensure that you don't have vulnerable services running and otherwise minimize your attack surface.

Want to learn more about OSINT?

If you want to learn more about open-source intelligence, take a look at the following material:

• Top 10 Popular Open Source Intelligence (OSINT) Tools
  • Good descriptions of widely used and useful OSINT tools.
• OSINT Techniques
  • An extensive collection of information related to OSINT, such as articles, valuable resources, and tools.
• What is OSINT? How can I make use of it?
  • A quick explanation of OSINT and some practical examples.
• An Introduction To Open Source Intelligence (OSINT) Gathering
  • A thorough explanation of OSINT types and purposes from different viewpoints.
• Exploring Google Hacking Techniques
  • A broad collection of Google Dorks operators and examples so you can find exciting stuff just by using the Google search engine.

Want to keep track of what's happening in cybersecurity? Sign up for Nixu Newsletter.