OSINT INVESTIGATIONS THE DEFINITIVE GUIDE TO CLUBHOUSE TABLE OF CONTENTS INTRODUCTION
Clubhouse is a new type of social GAINING ACCESS...... 3 network based entirely on voice OPERATIONAL SECURITY (OPSEC) CONSIDERATION...... 3 rather than text, images, or videos. Clubhouse allows people to join ACCOUNT CREATION...... 4 clubs and have conversations with each other real-time. It’s mobile- DESKTOP INVESTIGATIONS...... 6 based, iOS only, and is gaining in popularity very quickly. With any MOBILE INVESTIGATIONS...... 9 new social networking platform, it’s important to understand how CONCLUSION...... 13 the platform works, how users behave when on it, and what type of content is available passively. In this guide, we’ll take a look at Clubhouse through the lens of Open Source Intelligence (OSINT) investigations including desktop and mobile tools, tactics, and techniques.
Let’s get started.
2 GAINING ACCESS
Clubhouse is still technically in beta and requires you to be invited by an existing user to join. Early on, these invites were difficult to come by; however, with its gaining popularity, the number of available invites has gone up significantly, and receiving an invite code is usually as easy as asking for one from anyone in your social network. That said, it’s an iOS-only platform, so if you don’t have an iPhone, iPad, or an M-chip Macbook, you’ll have difficulty getting online.
Once you find someone who has an available invite code, they’ll have to text it to your phone number in order for you to register. This means that your account is tied to your mobile number and there’s no other way around this. You can’t register with an email as we see with other platforms, and you can’t remove your phone number after registering either. This distinction will become very important later on.
OPERATIONAL SECURITY (OPSEC) CONSIDERATION
Registering with your mobile number has a variety of OPSEC considerations. Not only will users be able to see who referred you to Clubhouse on your profile, but Clubhouse maintains a record of all users on its platform, including their name and number. Even if you don’t ever register or log into Clubhouse, they’ll have your mobile number and name through the contact lists of other users in your network. Using an alias or sock puppet might not reduce your risk entirely. Clubhouse still collects your real name and phone number from other users who have your information in their contact list
ACCOUNT CREATION
3 ACCOUNT CREATION
Once you’ve received an invite code and have weighed the OPSEC risks, it’s time USERNAME FOLLOWING (INCLUDING to register an account and set things Unlike the name field, usernames can up. It’s very important to understand be changed as many times as you want. PEOPLE AND CLUBS) the full scope of what type of content is Clubhouse, by default, will try to set your Following Lists on Clubhouse are a bit available on Clubhouse if you intend to username to
4 ACCOUNT CREATION (CONTINUED)
SOCIAL MEDIA HANDLES NOMINATED BY MEMBER OF Clubhouse allows you to link two social Clubhouse takes note of the person that Clubhouse allows you to follow different media platforms to your profile: Twitter and nominated you (sent you the invite link) on types of clubs, but that doesn’t mean you Instagram. From an OSINT perspective, Clubhouse. It lists the date they joined and are a member. To see the list of clubs that this is incredibly valuable and gives you a link to the nominator’s Clubhouse profile. a user follows, check their following list an instant pivot point from a Clubhouse This reveals a few things: who is close (detailed above); however, if you want to profile. It allows you to establish a timeline enough in someone’s network to have their see what groups they’re actually a part of of user activity on Twitter or Instagram as personal phone number and who they and have been invited to by the admin, it relates to their activity on Clubhouse. It might interact with most on Clubhouse. It you’ll find it in the “Member of” section. also allows you to see if user’s Clubhouse is the first link to a verifiable social network This also includes clubs that a user has username matches their other social media of your subject. created. handles.
At the time of this writing, Clubhouse doesn’t just let anyone create a club. Clubhouse restricts club creation to only the most active community members with a limit of 2 per month. If a user has created several clubs that are visible on their profile, that is a good indication that they are very active on the app.
DESKTOP INVESTIGATIONS
5 DESKTOP INVESTIGATIONS
Despite Clubhouse being a mobile-first, Using the site: operator, you can filter Adding the intitle: or intext: commands and in many ways a mobile-only, platform your Google search results to only show to the end of your site: query will allow there is information that can be gathered Clubhouse links using the joinclubhouse. you to be more specific in your search. If from a desktop view. While you can’t com domain. This will show you you’re looking for a specific topic, person, see specific profiles on Clubhouse, you mostly historical content from previous or company, etc. you can add keywords are able to search for and view group conversations and meetings; although, it for those concepts within the title of invitations. This will give you a slight does give you a few data points to work Clubhouse events or within the text of glimpse into Clubhouse data. Here’s how from including a few users, date/time, and them. It’s important to use the OR operator you do it. context. Using advanced techniques, which in between to maintain a broad enough we will discuss later, you’ll be able to begin search to find different types of content. site:joinclubhouse.com your investigation before registering for Clubhouse or opening the app.
site:joinclubhouse.com intitle:
6 DESKTOP INVESTIGATIONS (CONTINUED)
REVERSE IMAGE SEARCH Once you find an event page of interest, 1. Right-click the image of interest, and find the URL of the image within the HTML element. one way to pivot is to conduct a reverse image search on any user profiles you find. This may generate a lead on other social media platforms for a person who uses the same image across multiple social 2: Copy and paste the URL into a new tab. networks. There’s only one problem. If you try to right-click the image and reverse search it, you won’t see that option. You’ll have to isolate the image in the source code first. Here’s how.
1. Right-click the image of interest, and find the URL of the image within the HTML element.
2. Copy and paste the URL into a new tab.
3. Right-click and reverse search the image. Make sure to use all reverse image search tools available, including Google, Bing, Yandex, etc. to make the most of the image.
3: Right-click and reverse search the image.
7 DESKTOP INVESTIGATIONS (CONTINUED)
ADVANCED REVERSE IMAGE SEARCH After a quick review, we can confirm that the Instagram found matches Reverse image searches are often a shot in the dark. Because most search indexes use an image the same person in the Clubhouse match method rather than facial recognition, there has to be another image almost identical to the event. one you’re looking for in order to get a positive result. Because of this, we have to point the search engine in the right direction.
In addition to the profile image of the user in the Clubhouse event, it also gives you their name. In this case, we see “Tianwei Yue” listed. By adding that name to the reverse image search, you’ll give the search engine more instruction, leading to a positive match. Finally, a regular Google search without the image. Here’s a look at the results before (default) And here’s a look at them after As you can see, it’s broader
8 MOBILE INVESTIGATIONS
Because there are limitations to investigating Clubhouse on desktop, we PLANNING YOUR have to rely on mobile investigations to INVESTIGATION get the full value of the platform. However, unlike desktop, extracting valuable The key to any OSINT investigation is information from mobile is very difficult good planning. As the first phase of and requires significant manual work the intelligence cycle, planning helps without custom tools. With Clubhouse, set the scope of your investigation, those constraints are even more allowing you to avoid rabbit holes or an problematic due to the age of the platform unexpected expansion of your intelligence and the operating system requirements. requirements. Knowing what types of Let’s unpack this a bit more... information is available on Clubhouse can help set those boundaries. Earlier in this guide, we discussed what types of iOS REQUIREMENT information you can find on Clubhouse, Clubhouse is iOS only. This means you now it’s time to put that knowledge into need an iPhone, iPad, or an M1 chip practice... MacBook that runs iOS apps natively. Alternatively, there are iOS emulators out PEOPLE SEARCH there but they are facing a variety of legal challenges and, as a result, are difficult to Clubhouse has two different search acquire. Many emulators require you to options: people search and club search. be a developer or pay a subscription to People search is very basic, allowing you to access. only search for a single data point. There is no advanced search option. It seems Once you’ve secured a Clubhouse- that Clubhouse only indexes display name, friendly device or emulator to begin your Clubhouse username, and biography. This investigation, it’s time to start searching... means you won’t be able to search by Twitter username or Instagram username. However, since Clubhouse doesn’t allow users to change their display name more than once, insisting users show their real name, this is still a reliable data point. Additionally, many Clubhouse users will have the same username as they do on Twitter and Instagram, allowing for a partial search capability. People Search
9 MOBILE INVESTIGATIONS (CONTINUED) CLUB SEARCH PERSON TO CLUB Club search also allows you to search by One way you can pivot across Clubhouse is keyword; club description looks like it is by moving from a person of interest (POI) indexed by Clubhouse. This allows you to to a club of interest. As mentioned earlier, search by club name OR club description. you can find what types of clubs a person If you search by person within club search, is a member of or is following by checking you’ll likely get no results unless the club the Member of list or by checking the has the same name as the person you’re following list. searching for. If the ultimate goal is to find individuals who are interested in or discussing a specific topic but don’t mention that topic in their profile, it’s easier to find clubs that match the requirements of your investigation and pivot to members within that club for a more refined result.
Because there are only 2 different types of searches you can do on Clubhouse, most of your investigation will rely on pivoting across data points you find during your investigation. The bulk of this guide will cover different ways you can pivot to build out a full investigation across Clubhouse and beyond. PIVOTING We will refer to pivoting in this context. as moving from one data point to another to discover information that isn’t searchable. There are so many options for pivoting across and beyond Clubhouse, we’ll only cover a few.
Club Search Person to Club
10 MOBILE INVESTIGATIONS (CONTINUED) PERSON TO USERNAME PERSON TO INSTAGRAM If you know the first and last name of a Just like with Twitter, navigating to a person you are searching for, but you connected Instagram profile is easy. don’t have a username for any social Likewise, noting the differences between media platform, Clubhouse can be a Twitter, Instagram, and Clubhouse great place to start. By searching for a usernames can help you build out a person’s name, you’ll find a Clubhouse footprint of usernames you can reverse username. If it’s unique, meaning it’s not across all platforms online. The more just @john or @sam, you can easily reverse unique a username, the more valuable search this username to build out a basic it is. In the example above, @__sbb__ is digital record. If the person of interest much more unique than @john, so reverse on Clubhouse doesn’t have a connected searching on @__sbb__ should likely be Twitter or Instagram, reversing the your first consideration. Clubhouse username might be the only opportunity to find additional social media platforms. PERSON TO NOMINATION Clubhouse, in many cases, will show you the person who nominated your person PERSON TO TWITTER of interest on Clubhouse. This means If the Clubhouse profile of interest has that person texted your POI the referral linked a Twitter profile, you can easily code that allowed them to register for navigate to it through the app. It’s Clubhouse. This nominator is likely in this important to note any differences between person’s personal network, enough to have the Clubhouse username and the Twitter that person’s cell phone number. When username. Because many users got building out a social network, this is the onto Clubhouse early, many are able to first link in your investigation. secure more desirable usernames. In the example above, John Exley, who secured @johnexley on Twitter, was able to get @ john on Clubhouse. Because @john is very generic, the Clubhouse username is likely not useful.
Make sure to check the linked Twitter DISCLAIMER: For simplicity, we’ll be account for any additional information you using a generic search for “john”. can use in your case. The profiles shown in this guide are for demonstration purposes only. Person to Nomination
11 MOBILE INVESTIGATIONS (CONTINUED) PERSON TO NOMINATION PERSON TO NOMINATION TO CLUB TO USERNAME If your POI is new to Clubhouse, they might If you run into a case where your POI not have joined any clubs or created any and their nominator don’t have Twitter or of their own. If your investigation warrants Instagram linked and a reverse username monitoring activity over time, a good place search on your POI resulted in false to start is to pivot from the POI to the positives, make sure to also do a reverse person that nominated them and check the username search on the nominator. If that clubs they follow or are a part of. There’s fails, go to the nominator’s nominator. a good chance that the nominator will Continue until you find a positive hit and invite them to check out the same clubs work backward toward your POI. if the POI has any real interest in using Clubhouse. Add those clubs to your list and take a look at what type of members CLUB TO PERSON they have If you’re in a situation where you’re monitoring a topic with the expectation PERSON TO NOMINATION of finding a POI through a community, pivoting from a club to a person is likely in TO TWITTER OR INSTAGRAM your workflow. Not all clubs on Clubhouse show a list of members; however, the If your POI doesn’t have a connected ones that do show up to 200 through Twitter or Instagram profile, that’s not a the app. The member list can be easily dead end. Try pivoting from your POI to sifted through. It shows the display name, their nominator and see if they connected username, and a preview of the biography. their Twitter or Instagram. If so, you can This means you don’t have to open each search within the follower and following individual profile to do an initial analysis. list of the nominator’s Twitter or Instagram to find your POI’s profile. Just because someone hasn’t connected a profile doesn’t mean it doesn’t exist.
Person to Nomination to Club
12 CONCLUSION
Clubhouse is a difficult platform to access and navigate but it can be an incredible resource for any OSINT investigation. There are many ways Clubhouse can be used in an investigative workflow. Investigators can find people, what clubs they are in, who nominated them to Clubhouse, and if they have connected Twitter or Instagram profiles. You can even join clubs yourself and sit in on active discussions about any topic. The mobile-first or mobile-only social media platform is a growing trend that requires attention. We hope this guide will help you bridge the gap between a desktop-first workflow and a mobile environment and give you the tools and mindset necessary to stay ahead of the curve.
13