Hidden Universes of Cybersecurity Awareness

FISSEA Conference 32018 Russ Haynal Instructor amp Speaker Internet Search OSINT Infrastructure Cybersecurity Awareness navigatorscom

Copyright copy Information Navigators

Russ Haynal Internet Instructor amp Speaker

httpnavigatorscom

specific_pagehtml

Give a person a Phish

you feed them for a day

Teach a person how to Phish

you feed them for a lifetime

Todayrsquos session shows how to quickly find the best

resources for any topic using several very clever

and efficient search techniques

All example searches ndash and links to some great

search results are posted online

httpnavigatorscomfisseahtml

Page 2

Russ Haynal Internet Instructor amp Speaker Disclaimer http navigatorscom

bull This session illustrates several clever search techniques and researchmethods bull Consult your organizationrsquos policies toverify if these methods are approvedfor your type of Internet connections

Page 3

Russ Haynal Internet Instructor amp Speaker

http navigatorscomSearch Engines( googlecom bingcom) search_tool_introhtml

bull Search enginersquos robotclicks through Internet

bull TEXT of web pages arecached and indexed

bull Supports detailed keyword searches

bull Learn the features amp optionsof each search engine

page Robot Indexer Search

Interface

Your PC

Indexed Cached

Web Search Engine copied Web Servers

TEXT Database Web pages

You must envision the target page ldquoUse your imaginationrdquo

Page 4

Russ Haynal Internet Instructor amp Speaker Advanced Search = Efficient Search http navigatorscom

search_toolshtml

basic search advanced search

Limit search to specificsites or domains

filetypepdf = detailed content from great web sites bull Bottom right of Google home page Settings bull Advanced Search bull Top right of Google search results Settingsbull Advanced Search

bull Also choose 100 results per page Settings bull Search Settings Page 5

Page 6

Russ Haynal Internet Instructor amp Speaker

http navigatorscomSearch Examples search_upstreamhtml

cybersecurity framework

ldquocybersecurity frameworkrdquo

ldquocybersecurity frameworkrdquo filetypepdf

ldquocybersecurity frameworkrdquo filetypeppt

ldquocybersecurity frameworkrdquo siteslidesharenet

ldquocybersecurity frameworkrdquo sitenistgov

ldquocybersecurity frameworkrdquo sitenistgov

filetypepdf

ldquocybersecurity frameworkrdquo siteedu filetypepdf

ldquocybersecurity frameworkrdquo

sitelinkedincomin

sitelinkedincomin cissp ts sci

sitelinkedincomin your_agency job-title

eg system administrator

51000000 - both words anywhere

203000 - words adjacent correct order

126000 - research papers presentations

36 - Powerpoint presentations

1600 - presentations

4750 ndash hits from just nistgov

1310 ndash pdfrsquos hosted at nistgov

19000 ndash pdfrsquos hosted at US universities

7430ndash linkedin profiles

20200 ndash certified security professionals

revealing they have Top Secret clearance

= spear phishing targets at YOUR agency

bull When using ldquositerdquo command do not include ldquohttpwwwrdquo

Russ Haynal Internet Instructor amp Speaker Cautions about Social Media http navigatorscom

bull Confirm policies for viewing joining or interacting on social media bull Understand each sitersquos different levels of interactions - viewing following group member connecting friend messaging

bull What information is shared to the other end user bull What information is shared with 3rd party advertisers data brokers bull ALL interactions are known to the owner of the social media site --gt learn who owns the site

bull Who has ldquojurisdictionrdquo over the site (VK --gt Russia QQ --gt China) bull Linkedin example bull Different membership levels have various capabilities bull free ($0month) premium premium personalpremium career sales navigator recruiter literecruiter ($900month)

bull ldquorecruiterrdquo has unlimited access to everyonersquos fullprofiles and leaves no ldquohitsrdquo on the people they view

Free account = YOU are the ldquoproductrdquo being sold Page 7

Russ Haynal Compare level of detail in theseInternet Instructor amp Speaker

http navigatorscomtwo Linkedin profiles Reveals security defenses and procedures and recipe for spear phishing

Reveals JPMorgan is a bank (this is posted by MANY JPMorgan employees)

Page 8

Russ Haynal Forums of people Internet Instructor amp Speaker

http navigatorscomwho know your topic search_universeshtml

bull Forum ndash discussion focused on a particular topic bull Many users can participate by posting messages bull Moderators may ldquopolicerdquo comments that are considered off-topic

bull Try searching for bull Your topic forum post replies = forum of users that discuss your topic

bull Use search terms that would be used by people in that industry acronyms slang jargon etc

bull ldquocybersecurity frameworkrdquo forum post replies = 11100

bull specific publication numbers ldquo800 53rdquo forum post replies bull name of a productvendor and forum post replies

bull etc Page 9

3

Russ Haynal Internet Instructor amp Speaker Surfing Upstream vs Downstream http navigatorscom

search_upstreamhtml

2

ldquoUpstreamrdquo ldquoJoersquos guide to MANY targetsrdquo Targetcom

1

Targetcom Target2net Targetcom

1 Most researchers follow the links ldquodownstreamrdquo from an interesting page

2 Shows pages that link towards the target (=upstream) This is an Indication of the pagersquos ldquopopularityrdquo = who knows about targetcom

3 Shows pages that link to both target sites hellip = ldquouser pagesrdquo for that topic

Page 10

Russ Haynal Internet Instructor amp Speaker

http navigatorscomBe Creative When Surfing Upstream

Example Washington DC Tourist Sites search_upstreamhtml

Museums Theatre links DC Tourism Educational

wwwspymuseumorg

wwwnasmsiedu (air amp space museum)

wwwfordstheatreorg

wwwkennedy-centerorg

bull Any combination of these target pages will lead you to ldquoDC Tourismrdquo pages but certain pairings may also lead you to subject-specific pages

Page 11

Russ Haynal Internet Instructor amp Speaker

http navigatorscomSurfing Upstream Details search_upstreamhtml

search format at google or bing search results

ldquowwwexamplecomrdquo contain text wwwexamplecom

ldquowwwexamplecompageAhtmlrdquo contain text of the specific page address

contain text of both example site addresses +ldquowwwexample1comrdquo This is a great way to discover ldquouser pagesrdquo

+ldquowwwexample2comrdquo (eg Joes guide to many example-sites)

bull You need to decide which scenario makes more sense Row 1 or Row 2 eg who links to the home page of the entire site vs

who links to a specific webpage within the site

bull A 3rd and 4th site can be added if they are popular enough bull Note do not include ldquohttprdquo bull Who links to 2 anti-phishing vendors2 animation products 2 security conferences etc

Page 12

Russ Haynal Internet Instructor amp Speaker Web Analytics http navigatorscom

search_toolshtml

alexacom similarwebcom urlmcom urlmcouk

Each of these tools offer a samplingof analytics for free bull Popularity of a web site bull Audience demographics bull Search terms used to find the site bull Visitor engagement levels bull Traffic history bull Related sites = more sites

Enter a domain name (not search terms)

Page 13

Russ Haynal Your Homework Mission Internet Instructor amp Speaker http navigatorscomShould You Decide To Accept Ithellip

bull Google settings ndashgt 100 hits bull Use clever search techniques bull Find ldquopeople without a liferdquo who have already done the research bull They post PDFs and PPTs participate in forums share on linkedin link to many resources

Contact Information Russ Haynal russ navigatorscom 703-729-1757 wwwlinkedincominrusshaynal Note If you send me an email and itrsquos not from gov or mil put ldquointernet trainingrdquo in the e-mails subject

Page 14