-: Organizational intelligence, or lack thereof.
So when we talk about organizational intelligence,
you have to think about it this way:
your organization has an online profile,
just like I do and just like you do.
Whether you know it or not, there's information out
there on the internet about you and your organization.
This can be used by an attacker against you.
And so in a penetration test,
we have to act like the attacker,
and we have to think about what information is out there
that we can use, too.
So when we talk about this, we gotta start looking
for organizational data.
What type of data?
Well, how about locations?
The locations of your facilities and your buildings, right?
I can look at your physical security posture based
on a Google Earth image of your compound, right?
I can look at your building and go, oh!
There's a six foot tall barbed wire fence around it.
Probably gonna be hard to get in.
Or, oh, I can just drive right into the front door
because you're a pizza store, or a pizza restaurant,
and they're just gonna let me walk in because
they need customers to walk in.
I can learn things like business hours and patterns of life
based on the locations you have and where you are.
If you're a church, for instance, you probably
really busy on Sunday, right?
But you might not be busy on Monday.
And those are patterns of life I can start determining.
Work routines for the organization.
I can start figuring out, when does the organization work?
What are those peaks, what are those valleys?
I might find that churches, for instance, are really
busy on Wednesdays and Sunday nights.
That tends to be busy days for churches.
And if I look at a pizza place, they may be really busy
on Friday and Saturday night,
but not real busy on a Tuesday.
And I can figure out when is the best time to start
attacking those organizations.
Organizational charts.
You may Google out there and find
the organizational charts for your organization.
So now I know who the CEO is, the CTO is, the CFO is,
and all of the underlings down the pyramid
so I can start figuring out who I wanna attack.
The relationships between departments
and people are very, very helpful.
We talked about that when we talked about Maltego,
and how we can put those things together with that tool.
Documents. Documents are out there on your organization,
whether they're Word documents, PowerPoints, pictures,
PDFs, they all have metadata that we can collect from
and figure things out based on those data parameters,
whether that's the person's department,
the person's name, their email address.
And I could start making very convincing spear phishing
campaigns if I get a couple of documents
and a couple of the right pieces of metadata.
Financial data.
How much of your financial data is
out there for your organization?
This again, the more information I know as an attacker,
the better I can exploit you
and use this during social engineering.
And also, personal information about your employees.
It's not just your organization
that's at risk, it's your employees.
If I can get in on your employees,
I can then get in through them into your organization.
So, when we talk about document harvesting,
we're looking for things like metadata.
This is the author's name, the software versions
that are used, because if I know that you're using
Microsoft Word 2003, there's a lot of vulnerabilities
that I can then use in a targeted campaign.
EXIF data. This is graphical data that gives
geolocation coordinates for photos.
So maybe you all had a company picnic in the backyard
and took a bunch of photos on somebody's cellphone.
Well, those have geo coordinates embedded into those photos
and I can then track patterns of life.
It's important to scrub your metadata and scrub
your EXIF data from documents
that are being posted to the internet,
because all of this stuff can be used against you.
Emails, if I find emails out there on the internet,
that's gonna be really good for contact chaining
and to be able to create spear phishing emails
that are very effective and targeted.
This is all stuff that works really well for me,
and really bad for your organization.
Immersion. Immersion is a great tool.
It's made by MIT, it's immersion.media.mit.edu,
and this is the demo version.
You can go there and take a look at it.
They basically went and looked at a fictional character
called Howard Wolowitz, which is from the Big Bang Theory,
for those of you who don't know, and they collected
a bunch of his emails that were out there.
He had 20,000 emails, and from those 20,000 emails
they were able to find 159 different people
that he talked to and they graphically depicted it.
You can see here the big blue dot,
who he's talking to the most.
The little dots are people he talks to a lot less.
So it's who's his big friends, who's not,
and we can then get those emails, if we have them,
and start creating spear phishing campaigns
against him, doing that.
They collected six and a half years worth of data
from this guy, and they were able to
put this together based on that.
Again, you're not going to do a
six and a half year campaign,
but if I can collect for a month
and even get a couple of emails out of you,
that's gonna be pretty helpful.
Now, where can you get these documents?
Well, a lot of organizations are getting smarter
and are posting less sensitive information online.
But, the internet has nothing that is gone forever.
We can always find things on the internet,
because even if they've gone back and deleted things
off their websites, if they've been around for a while,
those documents are still there, some place.
Because you can use things like
The Internet Archive, which is archive.org.
You go to archive.org and type in Yahoo, for instance,
you can go back to like 1997 and see what Yahoo looked like,
and pull up documents then.
You can use the Time Travel Service
at timetravel.mementoweb.org, same kind of concept.
Google Cache View, just 'cause you took it off
doesn't mean Google did, right?
And then, Cachedview.com, which again, is just a cache
of the internet, and it collects as much data as it can.
This is a great place, that even when an organization thinks
they've taken something down,
you can still find it out there.
Now, where can I get more stuff,
because we always want more?
Well, social media is a great place to find details
about the organization's employees.
Start making friends with them, right?
Go on Facebook, create a fake account,
and start becoming friends with all these employees.
Many people will complain, will post
what they do at their company,
they'll talk about what the company they work for,
and they don't set up their privacy properly,
so you can get a lot of details about them.
And how many of your employees take photos at work
and post it on social media?
"Oh, I've got a case of the Mondays," snap.
Well, again, that's information I can get, looking at
that picture, seeing your security,
seeing how you're set up.
There's paid public record searches as well.
Things like Zaba Search, NETR Online, and others.
You can pay a nominal fee and look up information
about a person, including criminal background,
credit scores, and other type of information
through some of these searches, find their home address.
And again, if I can get in through your employee,
I can get in through you.
Now again, this is all gonna go back to scope of work
and what the organization agrees to.
Most of the time, the employees are gonna be off limits.
You're not gonna go after them personally.
But guess what? An attacker doesn't have to follow that.
So you still need to think about
that from a threat perspective.
What will the bad guy do to get into my network?
That's the idea here that we're talking about.
Now, we talked about the threat.
The big threat out there is social engineering.
It exploits the human element of security.
This can occur through phone, email,
social media, or even in person.
And I've been giving you a lot of examples
of social engineering here, right?
Talking about spear phishing, talking about going
after your employees, all that kind of stuff
falls under the social engineering realm.
The Social Engineering Toolkit is a piece of software
you can use to collect all this data
and create spear phishing campaigns.
Creepy is a geolocation tool.
It can connect to things like Twitter
and Google Plus and Flickr, take your pictures,
and start geo locating them on a map
and figure out patterns of life.
And Metasploit, it has phishing and other tools
built into it as well.
So just remember, spear phishing, excuse me,
social engineering is out there.
It is a big threat.
And really, when we talk about
all this information gathering,
a lot of that goes right back into social engineering,
because social engineering is very, very effective
at getting into an organization.
So you need to figure out what your organizational's
social footprint is and make sure you're managing
that properly, so that these documents that are being
put out there are clear of metadata.
So you're employees know to set their privacy correctly,
and you can make sure that you minimize your risk
and minimize your threat.