The proliferation and availability of public information has increased with the evolution of its dissemination. With the constant creation of digital document archives and the migration towards a paperless society, vast databases of information are continuously being generated. Collectively, these publicly available databases contain enough specific information to pose certain vulnerabilities. The actionable intelligence ascertained from these data sources is known as Open Source Intelligence (OSINT).
Numerous search techniques and applications exist to harvest data for OSINT purposes. Advanced operator use, social network searches, geospatial data aggregation, network traffic graphs, image specific searches, metadata extractors, and government databases, provide a wealth of useful data. Furthermore, applications such as FOCA, Maltego, and SearchDiggity, in addition to custom site API integration, yield powerful search queries with organized results.
Fluency in OSINT methodologies is essential for effective online reconnaissance, although a true mastery requires further mathematical investigation. The use of statistical correlation can often reveal hidden data relationships. Linkage attacks, inferential analysis, and deductive disclosure can exploit improperly sanitized data sets. These techniques can ultimately lead to data re-identification and de-anonymization, thus exposing personal information for exploitation. We will demonstrate our mathematical algorithm for data identification by attacking publically available anonymized datasets and revealing hidden personal information.
An IT industry veteran, with 20+ years of experience, Dr. Noah Schiffman is a former black-hat hacker turned security consultant. He spent almost a decade as a career computer hacker, performing penetration testing, social engineering, corporate espionage, digital surveillance, and other ethically questionable projects. Subsequently, he worked as a security consultant, teaching network defense, giving talks, and writing about information security. His past clients have consisted of Fortune 500 companies and various government agencies. For the past several years, his R&D efforts in the commercial and defense sectors have covered areas of data analysis and pattern recognition for security applications.
SkyDog (@skydogcon) With 20+ years of experience in network security and computer science, Skydog possesses a unique skillset of technological diversity and depth. His accomplishments range from the design and support of enterprise level system architectures, to developing custom security products and solutions. As an industry leader in the hacker community, his expertise in vulnerability assessment and exploitation, provide him with valuable insight for developing security strategies. He is responsible for establishing and running several Information Security conferences, including Outerz0ne and SkyDogCon. Working for Vanderbilt University, he spends his time researching security, performing data recovery services, and managing 100+ terabytes of storage.