SurveillanceNew app uses scattered public information to put together a digital footprint of individuals, organizations
SurveillanceNew app uses scattered public information to put together a digital footprint of individuals, organizations
homelandsecuritynewswire.com | Oct 18th 2012
In a demonstration on Wednesday at the Breakpoint 2012 Security Conference, being held in Melbourne, Australia, Roelof Temmingh, founder of the company Paterva, showed how his company’s application, called Maltego, can collect scattered online clues to provide a picture of individuals or organizations. Maltego draws on public data sources in order to put together a graphical digital footprint. At the start of his demonstration, Temmingh stressed that all of the information collected is from public sources.
“No controls were broken to get to the information that we got,” Temmingh told the audience. “This is the information that’s out there on the net. We just kind of put it together in a nice way.”
Computerworldreports that Maltego pulled up several scattered tweets in the system. From there Temmingh picked one at random and checked to see whether the person fit in the context of them living and working in a certain area, which appeared to be true.
Then Maltego searched through Facebook, MySpace, and other social networking sites. An identical photo linked the persons Facebook and MySpace page, and from there Maltego was able to gather more information. After just one day of searching, Maltego discovered the person’s e-mail address, date of birth, travel, employment, and educational history.
“This is about a day’s worth of digging around,” Temmingh said. “It’s not weeks and weeks.”
Computerworldnotes that with that much information, it would be easy for an attacker to target a person with a convincing e-mail and use social engineeringto ask the person to click on a link causing malicious software to be downloaded to their computer.
If used to analyze a large organization, it would be much easier for Maltego to create detailed graphics of how a company’s network is structured, the addresses of mail servers, IP address blocks, and what providers support their Internet connectivity. It shines a light on an organization’s “attack surface,” a term used describe the potential weaknesses in a network.
Temmingh then did a search on North Korea. The country, which heavily restricts Internet access, barely has an Internet presence, making the attack surface very small.
The graphic of the country’s networks in Maltego “fits on one page,” Temmingh told the audience. “There’s nothing there to attack.”
The lesson Temminguh was giving to the audience is to be very selective about the information you share on the Internet.
“You should choose what you expose really carefully. But you can’t put nothing up there,” Temmingh said.
As people and governments starting to see cybersecurity as serious issues, people need to do the same in order to keep their systems and information from being compromised and used against them. Hackers are using social engineering more and more everyday as a way to convince victims unknowingly to give them access, and the best way to protect oneself is to limit the amount of information that one gives out over the Internet.
Paterva is releasing an updated version of its application, dubbed Maltego Radium, which allows people to run automated queries in a sequence. Maltego can perform about 150 kinds of queries, and the automation improves the speed at which information can be obtained and makes the application easier to use.
Temmingh and four people developed Maltego, a made-up name with no special meaning, in a converted 105-year-old barn in South Africa.
Shared from Pocket
Comments
Post a Comment