The Accidental Abyss

58
The Accidental Abyss Kelly FitzGerald Manager, Product Security Cutting Edge 2012-13, Mountain View 1 1

description

The Accidental Abyss. Kelly FitzGerald Manager, Product Security. 1. 1. Begin At The Beginning. Kelly FitzGerald @Symantec Since 2003 Worked on: Consumer, Enterprise and Product Security Spend a lot of time at hacker conferences and hacker drinkups Manage internal pen test personal - PowerPoint PPT Presentation

Transcript of The Accidental Abyss

Page 1: The Accidental Abyss

The Accidental Abyss

Kelly FitzGeraldManager, Product Security

Cutting Edge 2012-13, Mountain View 111

Page 2: The Accidental Abyss

Begin At The BeginningKelly FitzGerald@Symantec Since 2003Worked on: Consumer, Enterprise and Product Security

• Spend a lot of time at hacker conferences and hacker drinkups

• Manage internal pen test personal

• Facilitator for the Cryptography Review Board

• Serious Nerd

Cutting Edge 2012-13 2

Page 3: The Accidental Abyss

How The Idea For The Talk Was Born

Cutting Edge 2012-13 3

Page 4: The Accidental Abyss

Smart, Selfless, Lady

Cutting Edge 2012-13 4

Page 5: The Accidental Abyss

Cutting Edge 2012-13 5

LIAR

Page 6: The Accidental Abyss

Too Cool For School

Cutting Edge 2012-13 6

Page 7: The Accidental Abyss

Cutting Edge 2012-13 7

Still Lying

Page 8: The Accidental Abyss

Cutting Edge 2012-13 8

Page 9: The Accidental Abyss

“Bob Smith”: Cheap Guy

Cutting Edge 2012-13 9

Page 10: The Accidental Abyss

Why Is This Guy Cheap

Cutting Edge 2012-13 10

Page 11: The Accidental Abyss

A Smart Man Keeps a Secret Budget

Cutting Edge 2012-13 11

Page 12: The Accidental Abyss

All Your Base Belong to Me

Cutting Edge 2012-13 12

Social Security #’sBank Account Numbers

Employee ID

Page 13: The Accidental Abyss

Better Learning Through Television

Cutting Edge 2012-13 13

<BLEEP> College Preparatory SchoolGraduated Last Class as of 2011

Page 14: The Accidental Abyss

We’ve got his Social Security Number..• What can we do illegally?

• What information do we learn legally?– AAA-GG-SSSS

• Area you are in when you filed it• All 3 Social Security Numbers are allotted to California.

– When do you get it?• Born Before 1986, you got it around 14• Born Between 1986-1990 you get it by 5• Post 1990 you get it at birth

Cutting Edge 2012-13 14

Page 15: The Accidental Abyss

Oh Hey, Isn’t Your Social 549-Uhhhhh.. Silly Me!545-XX-XXXX - California 546-XX-XXXX - California 602-XX-XXXX - California 603-XX-XXXX - California 604-XX-XXXX - California 605-XX-XXXX - California 606-XX-XXXX - California 607-XX-XXXX - California 608-XX-XXXX - California 609-XX-XXXX - California 610-XX-XXXX - California 611-XX-XXXX - California 612-XX-XXXX - California 613-XX-XXXX - California 614-XX-XXXX - California 615-XX-XXXX - California 616-XX-XXXX - California 617-XX-XXXX - California 618-XX-XXXX - California 619-XX-XXXX - California 620-XX-XXXX - California 621-XX-XXXX - California 622-XX-XXXX - California 623-XX-XXXX - California 624-XX-XXXX - California 625-XX-XXXX - California 626-XX-XXXX - California

Cutting Edge 2012-13 15

547-XX-XXXX - California 548-XX-XXXX - California 549-XX-XXXX - California 550-XX-XXXX - California 551-XX-XXXX - California 552-XX-XXXX - California 553-XX-XXXX - California 554-XX-XXXX - California 555-XX-XXXX - California 556-XX-XXXX - California 557-XX-XXXX - California 558-XX-XXXX - California 559-XX-XXXX - California 560-XX-XXXX - California 561-XX-XXXX - California 562-XX-XXXX - California 563-XX-XXXX - California 564-XX-XXXX - California 565-XX-XXXX - California 566-XX-XXXX - California 567-XX-XXXX - California 568-XX-XXXX - California 569-XX-XXXX - California 570-XX-XXXX - California 571-XX-XXXX - California 572-XX-XXXX - California 573-XX-XXXX - California

Page 16: The Accidental Abyss

What Do We Know• At 14 “Bob” was living in CA(since it appears he is born before

1986)• Both of his children were living in CA when they got their cards• They still live in Oakland, California(as per the show)• He ran the <bleep> School

• He’s frugal

Cutting Edge 2012-13 16

Page 17: The Accidental Abyss

Spokeo, Spokeo

Cutting Edge 2012-13 17

Page 18: The Accidental Abyss

What Do Credit Cards and Car Salesman Think?

Cutting Edge 2012-13 18

Page 19: The Accidental Abyss

Reconaissance • Get the email, Get the gold.– Single Signon helps my recond– If you can get their main non-work email you can probably puzzle out all

of their other accounts(facebook, amazon)– Spokeo revealed “Bob’s” as [email protected]

• On the internet he is Bob7 everywhere

Cutting Edge 2012-13 19

Page 20: The Accidental Abyss

Cutting Edge 2012-13 20

Pandora: What kind of stuff is he into?

Page 21: The Accidental Abyss

Cutting Edge 2012-13 21

Page 22: The Accidental Abyss

“Bob Smith”• Major PII leak through a TV Show• I just used boring info– Name, Job, Location

• I constructed a detailed dossier of:– What music he likes– Where he lives– His Facebook page– His preferences in general

Cutting Edge 2012-13 22

Page 23: The Accidental Abyss

Masterclass

Cutting Edge 2012-13 23

Page 24: The Accidental Abyss

Where to Use These Skills?

Cutting Edge 2012-13 24

Page 25: The Accidental Abyss

Goal 1: Get Primary Social Email/HandleWhat you usually know about your target• Name• Rough Idea of Age• Rough Idea of Location

Cutting Edge 2012-13 25

Page 26: The Accidental Abyss

Go Facebook Yourself

Cutting Edge 2012-13 26

Page 27: The Accidental Abyss

You’re Timeline Summary

Cutting Edge 2012-13 27

Page 28: The Accidental Abyss

Bing.com/social

Cutting Edge 2012-13 28

Page 29: The Accidental Abyss

Cutting Edge 2012-13 29

Page 30: The Accidental Abyss

OpenStatusSearch.com

Cutting Edge 2012-13 30

Page 31: The Accidental Abyss

Wolfram Alpha Self-Analytics: WolframAlpha.com

Cutting Edge 2012-13 31

Page 32: The Accidental Abyss

Information is Power• FB chooses which posts to show you in your feed based on a

variety of factors.– Someone commenting regularly will stay in your feed– Someone gazing at your page regularly and expanding your posts also

seems to get them to have increased play in your feed.

– Anybody notice anything else?

Cutting Edge 2012-13 32

Page 33: The Accidental Abyss

Tips for Looking at Strangers• Hunt for non-friends to your hearts content. They likely will

never know.• Profile pictures are generally unlocked. • Pictures frequently unlocked.• Friends lists are also frequently unlocked– Family– Spouse– Friends

• Look at the backgrounds in photos. Surroundings, books, reflections in glass, computer monitors.

Cutting Edge 2012-13 33

Page 34: The Accidental Abyss

Date Smarter

Cutting Edge 2012-13 34

Page 35: The Accidental Abyss

Oh Jeff! Change Up The Headshots

Cutting Edge 2012-13 35

Page 36: The Accidental Abyss

A Man With Some Fame!

Cutting Edge 2012-13 36

Page 37: The Accidental Abyss

TinEye and Google Googles

Cutting Edge 2012-13 37

Page 38: The Accidental Abyss

Google Googles

Cutting Edge 2012-13 38

Page 39: The Accidental Abyss

Ohhh Watch Out!! TrueDater.com

Cutting Edge 2012-13 39

Page 40: The Accidental Abyss

DefinatelyNotKelly

Cutting Edge 2012-13 40

Page 41: The Accidental Abyss

Cutting Edge 2012-13 41

Page 42: The Accidental Abyss

LinkedIn: Interesting, But Not Very Anonymous• Most people don’t pay LinkedIn memberships($20-$75/month)– If you are logged out you can only look at 1-2 profiles before LinkedIn cuts

you off.– As an anonymous unpaid member, you aren’t so anonymous.

• You aren’t able to see who looked at your profile• You Show up as “Someone…”

Cutting Edge 2012-13 42

Page 43: The Accidental Abyss

Targeted Gifts and Great Conversations

Cutting Edge 2012-13 43

Page 44: The Accidental Abyss

To Thy Own Frenemy Be True

Cutting Edge 2012-13 44

Page 45: The Accidental Abyss

Not So Friendly Skies

Cutting Edge 2012-13 45

Page 46: The Accidental Abyss

Flying is Private, Right?

Cutting Edge 2012-13 46

Page 47: The Accidental Abyss

United Upgrade List

Cutting Edge 2012-13 47

Page 48: The Accidental Abyss

I Can See You: Planefinder

Cutting Edge 2012-13 48

Page 49: The Accidental Abyss

The Dark Side: Not illegal, but it might not feel right.

Cutting Edge 2012-13 49

Page 50: The Accidental Abyss

Zillow; Trulia; Spokeo; Blockshopper

Cutting Edge 2012-13 50

Page 51: The Accidental Abyss

Mugshots: Book Em’ Dano

Cutting Edge 2012-13 51

Page 52: The Accidental Abyss

Finding Criminals Can Be Tough

Cutting Edge 2012-13 52

Page 53: The Accidental Abyss

San Bernardino Criminal Search

Cutting Edge 2012-13 53

Page 54: The Accidental Abyss

Megan’s Law: Offender Lite App

Cutting Edge 2012-13 54

Page 55: The Accidental Abyss

SearchDiggity: Free Tool From Stach and Liu

Cutting Edge 2012-13 55

Page 56: The Accidental Abyss

Should All This Information Be Accessible

Cutting Edge 2012-13 56

• Should what you do at 16 still be with you at 40?• The generation that is about to graduate grew up with the internet since

4 or 5.• Would you want to justify your purchases and posts from 20 years ago?

Page 57: The Accidental Abyss

What Can I do?• Do sensitive things on other accounts• Don’t use Oauth for touchy situations• Remove yourself from Spokeo• Periodically Google yourself• Track old accounts and delete ones

Cutting Edge 2012-13 57

Page 58: The Accidental Abyss

Questions???

Cutting Edge 2012-13 58