Advanced Online Investigations
Cynthia Hetherington, CFE, CII President Hetherington Group
1 of 35 © 2017 Association of Certified Fraud Examiners, Inc. Advanced Online Investigations Cynthia Hetherington, CFE, CII
Hetherington Group © 2017, all rights reserved. Cynthia is a… • ACFE faculty • OSMOSIS conference host • ASIS educator • Global OSINT presenter • Author & publisher • Analyst • Security practitioner • Investigator • Tech • Librarian Objective
• This exercise will help asset protectors focus their attention and sharpen their skills on utilizing social media and open-source searches effectively. Poll #1
• How do you feel about your social media and open-source monitoring programs in place? A. Confident B. Better than the rest of them! C. I silently worry that we are not doing enough. D. What monitoring program? Middle of the Road Is OK
• Being in the MIDDLE here means you’re aware that something needs to be done and you are thinking about this!
A. Confident B. Better than the rest of them! C. I silently worry that we are not doing enough. D. What monitoring program?
• Social media is ever changing, and you can’t afford to be confident. Nimble is the only way to stay on top! “Five-Finger Discount”
• Echosec popped 472 matches.
Poll #2
• What is your monitoring plan? A. We have in-house analysts/security pros monitoring our assets. B. We sub this work out. C. Public relations/communications does this and alerts us. D. We don’t need a monitoring program. Monitoring Awareness Is Now Necessary
• Answers A to C are excellent to OK. A. We have in-house analysts/security pros monitoring our assets. B. We sub this work out. C. Public relations/communications does this and alerts us. D. We don’t need monitoring program.
• Beyond keeping your assets safe, this is also a tool for first response to incidents, a track record for compliance, and a management tool for fraud and reputation. Alert Services: Free or Fee
FREE FEE • Google.com/alerts – Varied • Enterprise.Echosec.net – S.M. • free.Echosec.net – S.M. • Snaptrends – Social media • Socialmention – S.M. • Liferaft – Social media • Biznar – Varied • Cision Vocus – Social media • Searchtempest – Auction • Factiva – News • Claz.org – Auction • Nexis – News • ProQuest – News Google.com/Alerts * Auction and For-Sale Sites
• Amazon • Craigslist • eBay • oodle • Backpage • Dark Web onion sites Amazon eBay
• Go to “Advanced Search” from the homepage, in upper right-hand corner. • Choose “Find a Member” from the left-hand column.
Type in the first half of the person’s personal email address. For example: [email protected]
Type in “crazybird”
Check HR for the person’s resume for old email addresses. eBay
• Multiple results to explore! eBay User ID History
Check out the new and exciting names! Craigslist.com
• Ultimately, you will need to hunt and peck. • Craig Newmark is one of the last hold-outs.
• Search strategy through Google.com: • Searchtempest.com * • Site:craigslist.com
• OUTER LIMIT EXTRACTIONS TEXT OR CALL ONLY 909-450-7405 Donations King OG kush 45.00 A gram Crumble PLATINUM BLUE DREAM MASTER KUSH 40.00 A GRAM CRUMBLE PLATINUM MASTER KUSH 40.00 A GRAM CRUMBLE CHERRY PRIVATE STOCK 30.00 A GRAM CRUMBLE NO WHOLESALE MUST HAVE REC AND VALID ID TEXT OR CALL ONLY 909-450-7405 HIT ME UP 909-450-7405 TEXT OR CALL Google That Number!
• 909-450-7405 = “909 450 7405” • No dashes, parenthesis, backslashes, etc. • Just spaces • Scrutinize the results Bingo! Key Items Address Search on maps.google.com Address Search on maps.google.com Address Age Progression
2011
2007
2008 2012 Back to SearchTempest
• You can add or minimize eBay and Amazon. • Expand your search area by a local area or the world. • Set up alerts for things you really want to know about in your area. • Third-row seats • Drugs and contraband • Human trafficking • Terrorism, drug trade, or other nasty things SearchTempest Get the RSS Feed as an Alert
• You save your search as an OPML. • File on your desktop. Open Google Reader or Microsoft Outlook and • Import that OPML File. Claz.org for All Others Backpage.com Dark Web
• Start with Tor, or another anonymizing search engine. • Search with torhiddenwiki.com or onion.city. • Not a place to dabble. • Don’t download or open files without having a virtual machine (separate cold computer) to view them. • Have a strong stomach. Onion.city : Puppies Search Poll #3
• Can you friend individuals in closed accounts to see what they are up to? A. Yes B. No C. I don’t know Friending and Linking
• You’ve done your homework. A. Yes, who is going to catch us? B. No, aren’t we breaking some law? C. Best answer: When in doubt, don’t! Hunting USER Profiles
• Finding profiles is straightforward if you follow these steps. • Do you know their nickname already? • Check email addresses. • Start with Google. • Search by “first last name,” and you will locate popular social media accounts. • Use the following list of social media platforms, and add the username to the end. • Pinterest.com/animal. Looking for Matches Here: /username
43 Things DailyStrength Fotolog Ibibo Meettheboss PokemanGo Streetlife We Heart It About.me DeviantArt Foursquare Identi.ca Meetup (website) Poolwo Students Circle Network WeeWorld Academia.edu Diaspora* Friendica Indaba Music MillatFacebook Qapacity StudiVZ Wellwer Advogato Disaboom Friends Reunited Influenster MocoSpace Quechup StumbleUpon Wepolls.com AsianAvenue Dol2day Friendster Instagram MouthShut.com Qzone Tagged Wer-kennt-wen Athlinks DontStayIn Fuelmyblog Itsmy Mubi Raptr Talkbiznow Wooxie Audimated.com Doximity Gaia Online Jaiku My Opera Ravelry Taltopia WriteAPrisoner.com Bebo Draugiem.lv GamerDNA Jiepang MyHeritage Renren Taringa! XING Biip.no Dreamwidth Gapyear.com Kaixin001 MyLife ReverbNation.com TeachStreet Xanga BlackPlanet Elftown Gather.com Kiwibox Myspace Ryze TermWiki Xt3 Bolt.com Elixio Gays.com Lafango Nasza-klasa.pl ScienceStage The Sphere Yammer Busuu Ello Geni.com LaiBhaari Netlog Sgrouples TravBuddy.com Yelp, Inc. Buzznet English, baby! Gentlemint Last.fm Nexopia ShareTheMusic Travellerspoint Yookos CafeMom Eons.com GetGlue Late Night Shots Ning Shelfari Trombi.com Younow Care2 Epernicus GirlsAskGuys LibraryThing OUTeverywhere Sina Weibo Tsu Zoo.gr CaringBridge Experience Project Gogoyoko Lifeknot Odnoklassniki Skoob Tuenti Zooppa Classmates.com Exploroo Goodreads LinkExpats Open Diary Skyrock Tumblr aNobii Cloob Facebook Goodwizz Linkagoal Orkut Smartican Twitter aSmallWorld ClusterFlunk Faceparty Google+ LinkedIn Partyflock SocialVibe Tylted delicious CouchSurfing Fetlife GovLoop Listography PatientsLikeMe Sonico.com Uplike douban CozyCot FilmAffinity Grono.net LiveJournal Periscope SoundCloud VK eToro Cross.tv Filmow HR.com Livemocha Pingsta Spaces Vampirefreaks.com hi5 Crunchyroll FledgeWing Habbo MEETin Pinterest Spot.IM Viadeo italki.com Cucumbertown Flickr Hospitality Club MOG Plaxo Spring.me Virb mixi Cyworld Flixster Hotlist Makeoutclub Playfire Stage 32 Vox tribe.net DXY.cn Focus.com Hub Culture Meerkat Playlist.com Stickam WAYN weRead DailyBooth Fotki IRC-Galleria Plurk Wattpad Sum Up
• There are only penalties for avoiding social media and open-source investigations. • Stay abreast of changes in the social media world. • Work with your policy makers to address what is permissible for your investigators. • Many vendors offer excellent products, but constantly question their abilities. • Even more free resources and techniques that are equally efficient for asset protectors. Questions?
#whoknew! Cynthia Hetherington www.hetheringtongroup.com Thank you [email protected] Cynthiahetherington HetheringtonGroup @HetheringtonGrp
Email [email protected] for the latest deck slides & handouts
Hetherington Group © 2017, all rights reserved. Advanced Online Investigations
Cynthia Hetherington, CFE, CII President Hetherington Group
42 of 35 © 2017 Association of Certified Fraud Examiners, Inc.