advanced online investigations - fraud conference online investigations cynthia hetherington, cfe,...
TRANSCRIPT
1 of 35 © 2017 Association of Certified Fraud Examiners, Inc.
Advanced Online Investigations
Cynthia Hetherington, CFE, CII
President
Hetherington Group
Hetherington Group © 2017, all rights reserved.
Advanced Online
InvestigationsCynthia Hetherington, CFE, CII
• ACFE faculty
• OSMOSIS conference host
• ASIS educator
• Global OSINT presenter
• Author & publisher
• Analyst
• Security practitioner
• Investigator
• Tech
• Librarian
Cynthia is a…
Objective
• This exercise will help asset protectors focus their attention and sharpen their skills on utilizing social media and open-source searches effectively.
Poll #1
• How do you feel about your social media and open-source monitoring programs in place?
A. Confident
B. Better than the rest of them!
C. I silently worry that we are not doing enough.
D. What monitoring program?
Middle of the Road Is OK
• Being in the MIDDLE here means you’re aware that something needs to be done and you are thinking about this!
A. Confident
B. Better than the rest of them!
C. I silently worry that we are not doing enough.
D. What monitoring program?
• Social media is ever changing, and you can’t afford to be confident. Nimble is the only way to stay on top!
“Five-Finger Discount”
• Echosec popped 472 matches.
Poll #2
• What is your monitoring plan?A. We have in-house analysts/security pros monitoring our assets.
B. We sub this work out.
C. Public relations/communications does this and alerts us.
D. We don’t need a monitoring program.
Monitoring Awareness Is Now Necessary
• Answers A to C are excellent to OK.A. We have in-house analysts/security pros monitoring our assets.
B. We sub this work out.
C. Public relations/communications does this and alerts us.
D. We don’t need monitoring program.
• Beyond keeping your assets safe, this is also a tool for first response to incidents, a track record for compliance, and a management tool for fraud and reputation.
Alert Services: Free or Fee
FREE
• Google.com/alerts – Varied
• free.Echosec.net – S.M.
• Socialmention – S.M.
• Biznar – Varied
• Searchtempest – Auction
• Claz.org – Auction
FEE
• Enterprise.Echosec.net – S.M.
• Snaptrends – Social media
• Liferaft – Social media
• Cision Vocus – Social media
• Factiva – News
• Nexis – News
• ProQuest – News
Google.com/Alerts *
Auction and For-Sale Sites
• Amazon
• Craigslist
• eBay
• oodle
• Backpage
• Dark Web onion sites
Amazon
eBay
• Go to “Advanced Search” from the homepage, in upper right-hand corner.
• Choose “Find a Member” from the left-hand column.
Type in the first half of the
person’s personal email address.
For example:
Type in “crazybird”
Check HR for the person’s
resume for old email addresses.
eBay
• Multiple results to explore!
eBay User ID History
Check out the new and exciting names!
Craigslist.com
• Ultimately, you will need to hunt and peck.
• Craig Newmark is one of the last hold-outs.
• Search strategy through Google.com:• Searchtempest.com *
• Site:craigslist.com <expression>
SearchTempest *
Precious Nuggets for Sale
Hit Me Up!
• OUTER LIMIT EXTRACTIONS
TEXT OR CALL ONLY 909-450-7405
Donations
King OG kush 45.00 A gram Crumble
PLATINUM BLUE DREAM MASTER KUSH 40.00 A GRAM CRUMBLE
PLATINUM MASTER KUSH 40.00 A GRAM CRUMBLE
CHERRY PRIVATE STOCK 30.00 A GRAM CRUMBLE
NO WHOLESALE
MUST HAVE REC AND VALID ID
TEXT OR CALL ONLY 909-450-7405
HIT ME UP 909-450-7405 TEXT OR CALL
Google That Number!
• 909-450-7405 = “909 450 7405”
• No dashes, parenthesis, backslashes, etc.
• Just spaces
• Scrutinize the results
Key Items
Address Search on maps.google.com
Address Search on maps.google.com
Address Age Progression
2007
2008
2012
2011
Back to SearchTempest
• You can add or minimize eBay and Amazon.
• Expand your search area by a local area or the world.
• Set up alerts for things you really want to know about in your area.• Third-row seats
• Drugs and contraband
• Human trafficking
• Terrorism, drug trade, or other nasty things
SearchTempest
Get the RSS Feed as an Alert
• You save your search as an OPML.
• File on your desktop. Open Google Reader
or Microsoft Outlook and
• Import that OPML File.
Claz.org for All Others
Backpage.com
Dark Web
• Start with Tor, or another anonymizing search engine.
• Search with torhiddenwiki.com or onion.city.
• Not a place to dabble.
• Don’t download or open files without having a virtual machine (separate cold computer) to view them.
• Have a strong stomach.
Onion.city : Puppies Search
Poll #3
• Can you friend individuals in closed accounts to see what they are up to?
A. Yes
B. No
C. I don’t know
Friending and Linking
• You’ve done your homework.A. Yes, who is going to catch us?
B. No, aren’t we breaking some law?
C. Best answer: When in doubt, don’t!
Hunting USER Profiles
• Finding profiles is straightforward if you follow these steps.
• Do you know their nickname already? • Check email addresses.
• Start with Google.• Search by “first last name,” and you will locate popular social media accounts.
• Use the following list of social media platforms, and add the username to the end.
• Pinterest.com/animal.
Looking for Matches Here: /username43 Things DailyStrength Fotolog Ibibo Meettheboss PokemanGo Streetlife We Heart It
About.me DeviantArt Foursquare Identi.ca Meetup (website) Poolwo Students Circle Network WeeWorldAcademia.edu Diaspora* Friendica Indaba Music MillatFacebook Qapacity StudiVZ Wellwer
Advogato Disaboom Friends Reunited Influenster MocoSpace Quechup StumbleUpon Wepolls.com
AsianAvenue Dol2day Friendster Instagram MouthShut.com Qzone Tagged Wer-kennt-wenAthlinks DontStayIn Fuelmyblog Itsmy Mubi Raptr Talkbiznow Wooxie
Audimated.com Doximity Gaia Online Jaiku My Opera Ravelry Taltopia WriteAPrisoner.comBebo Draugiem.lv GamerDNA Jiepang MyHeritage Renren Taringa! XINGBiip.no Dreamwidth Gapyear.com Kaixin001 MyLife ReverbNation.com TeachStreet XangaBlackPlanet Elftown Gather.com Kiwibox Myspace Ryze TermWiki Xt3Bolt.com Elixio Gays.com Lafango Nasza-klasa.pl ScienceStage The Sphere YammerBusuu Ello Geni.com LaiBhaari Netlog Sgrouples TravBuddy.com Yelp, Inc.Buzznet English, baby! Gentlemint Last.fm Nexopia ShareTheMusic Travellerspoint YookosCafeMom Eons.com GetGlue Late Night Shots Ning Shelfari Trombi.com YounowCare2 Epernicus GirlsAskGuys LibraryThing OUTeverywhere Sina Weibo Tsu Zoo.grCaringBridge Experience Project Gogoyoko Lifeknot Odnoklassniki Skoob Tuenti ZooppaClassmates.com Exploroo Goodreads LinkExpats Open Diary Skyrock Tumblr aNobii
Cloob Facebook Goodwizz Linkagoal Orkut Smartican Twitter aSmallWorldClusterFlunk Faceparty Google+ LinkedIn Partyflock SocialVibe Tylted deliciousCouchSurfing Fetlife GovLoop Listography PatientsLikeMe Sonico.com Uplike doubanCozyCot FilmAffinity Grono.net LiveJournal Periscope SoundCloud VK eToroCross.tv Filmow HR.com Livemocha Pingsta Spaces Vampirefreaks.com hi5Crunchyroll FledgeWing Habbo MEETin Pinterest Spot.IM Viadeo italki.comCucumbertown Flickr Hospitality Club MOG Plaxo Spring.me Virb mixiCyworld Flixster Hotlist Makeoutclub Playfire Stage 32 Vox tribe.netDXY.cn Focus.com Hub Culture Meerkat Playlist.com Stickam WAYN weReadDailyBooth Fotki IRC-Galleria Plurk Wattpad
Sum Up
• There are only penalties for avoiding social media and open-source investigations.
• Stay abreast of changes in the social media world.
• Work with your policy makers to address what is permissible for your investigators.
• Many vendors offer excellent products, but constantly question their abilities.
• Even more free resources and techniques that are equally efficient for asset protectors.
Questions?
#whoknew!
Hetherington Group © 2017, all rights reserved.
Thank youCynthiahetheringtonHetheringtonGroup@HetheringtonGrp
Cynthia Hetheringtonwww.hetheringtongroup.com
Email [email protected] the latest deck slides & handouts
42 of 35 © 2017 Association of Certified Fraud Examiners, Inc.
Advanced Online Investigations
Cynthia Hetherington, CFE, CII
President
Hetherington Group