Computer Investigations and Use of Social Media

5 Key Policy Considerations

Scope. Determine what areas the policy needs to cover. Once the scope is determined, consider the areas below that apply to the areas you have chosen to cover in your policy.

Official Use. Social media tools can be used for many purposes and are valuable for many day to day operational activities in law enforcement agencies. It is integral that authorization for and administration of any department sanctioned sites are clearly articulated.

Personal Use. Content posted by law enforcement, even off-duty and under strict privacy settings, has the potential to be disseminated broadly and fall into the hands of defense attorneys, criminals, and members of the community. Any improper postings can ultimately affect an individual’s credibility, employment status, and their agency as a whole.

Legal Issues. Issues such as First Amendment rights, records retention and public records laws, and other federal and state statutes must be considered while crafting a policy. Many legal issues surrounding social media have not yet been settled within the court system, so having clear guidelines in place becomes even more imperative.

Related Policies. Many issues surrounding social media use may be resolved by citing other policies that are already in place within your agency, including Internet Use, Personal Mobile Devices, Electronic Messaging, Code of Conduct, and Media Relations.

9 Must-Have OSINT Tools

Open source intelligence (OSINT) refers to intelligence that has been derived from publicly available sources. In this photostory, we cover the most popular and important OSINT tools for a security researcher. Basically, OSINT tools are used in the reconnaissance phase to gather as much information about the target as possible. These open source intelligence tools utilize artificial intelligence features to mine data from the Web about all possible matches to the desired target.

With OSINT tools, the reconnaissance process gets streamlined, enabling a more efficient narrowing-down to the target. Using open source intelligence tools drastically reduces the number of permutations and combinations to be dealt with, in respect of information gathered. This leads to an effective combination of classical social engineering attacks on the target, which in turn can be used to harvest more information. OSINT can also be used for effective target discovery and subsequent phishing attacks.

1. Maltego

Maltego is an extremely powerful OSINT framework, covering infrastructural reconnaissance and personal reconnaissance. The infrastructural component of Maltego enables the gathering of sensitive data about the target organization, email addresses of employees, confidential files which are handled carelessly, internal phone numbers, DNS records, IP address information, geo location of the network, MX servers, and so on. The gathering of such data – known in Maltego as transformations -- needs to be creatively and thoughtfully engineered in order to get the best results. Maltego’s personal reconnaissance on the other hand helps in the harvesting of person-specific information, such as social networking activity, email addresses, websites associated with the person, telephone numbers, and so on. This happens with the use of search engines on the Internet, which Maltego effectively communicates with to gather all this information.

2. Shodan

Shodan is an acronym for Sentient Hyper Optimized Data Access Network. Unlike traditional search engines that crawl the website to display results, Shodan attempts to grab data from the ports. Developed by John Matherly, Shodan is available as a free version as well as a professional, paid version. The free version provides up to 50 results, beyond which one needs to procure the paid version. Creative usage of the Shodan OSINT tool helps find the vulnerable services in a Web server, which is a very important aspect of the vulnerability assessment phase. Various filters such as country, port, operating system and host names are available with this tool.

3. Metagoofil

Metagoofil is a very powerful OSINT information gathering tool, developed by Edge Security. In essence, Metagoofil is used to extract metadata from the target. It supports various file types, including pdf, doc, xls and ppt. This open source intelligence tool can also be used to extract MAC addresses from these files, thus giving the attacker a fair idea of what kind of network hardware is being used at the target installation. In tandem with the instincts and intelligence of the attacker, Metagoofil can be used to guess type of operating system, network names, and so on. A brute force attack can then be performed, once enough information is garnered from the metadata of the files. With the metadata obtained through Metagoofil, it is possible to extract path information, which can be used to map the network. The results are displayed in HTML format.

4. GHDB

Google happens to be the most powerful OSINT tool for a user to perform attacks, and forms the basis for GHDB – the Google Hacking DataBase. Using Google, an SQL injection on a random website can be performed within 0.2 Google seconds. Specially crafted words given as input to Google are named as dorks, or googledorks. These GHDB dorks can be used to reveal vulnerable servers on the Internet, to gather sensitive data, vulnerable files that are uploaded, sub-domains, and so on. Effective usage of GHDB can make the hacking process considerably easier. Exploit DB maintains a collection of googledorks under a section named GHDB.

5. The FOCA

The FOCA is a network infrastructure mapping tool that can be used for OSINT. It can analyze metadata from various files, including doc, pdf and ppt files. FOCA can also enumerate users, folders, emails, software used, operating system, and other useful information. Customization options are also available in this OSINT tool. For more juicy information and details about insecure methods, there is a crawl option provided. The metadata can be extracted from a single file or from multiple files. The FOCA is thus a great tool in the reconnaissance phase, to extract information from the metadata.

6. EXIF data viewers

Smartphones and digital cameras use a standard to specify formats for images and sounds that are recorded using them. This standard is called the exchangeable image file format (EXIF). Various EXIF data viewers are available. They provide details such as type of camera, focal length, type of lens, and so on. Most importantly, EXIF data viewers provide the geo location information that is stored for each image. In fact, by default, all smartphones have the GPS setting switched on. So, this can potentially leak the location where the image was taken. The accuracy is such that the latitude and longitude will be provided by the EXIF data viewer when extracting the EXIF data, thus leaking very private information.

7. Social Engineer Toolkit

Social Engineer Toolkit is an open source tool to perform online social engineering attacks. The tool can be used for various attack scenarios including spear phishing and website attack vectors. Social Engineer Toolkit works in an integrated manner with Metasploit. It enables the execution of client-side attacks and seamless harvesting of credentials. With Social Engineer Toolkit, one can backdoor an executable and send it to the victim. It can automatically create fake login pages of a given website and spawn a server to listen to returning connections.

8. Cyberstalking tools for reconnaissance

There are several websites and OSINT tools available online that can be used to find public information about a particular person. The PeekYou and Lullar websites enable gathering of information about a person that is available on various social networking sites. The Wayback Machine is a website that can be used to find previous versions of webpages, enabling one to see websites in their earlier avatars. These reconnaissance tools come in handy for cyberstalking or executing social engineering attacks. EDGAR, the electronic data gathering, analysis and retrieval system, is another website providing access to company information that might otherwise be difficult to obtain. Then there is YouGetSignal, providing OSINT tools to check for phone numbers, IP addresses, whois data, geo location, tracing, and so on.

9. Passive Recon

Mozilla Firefox has a lot of security add-ons in the form of plugins. One such powerful OSINT plugin is Passive Recon. As the name suggests, this tool does not query the domain directly. In fact it looks up all the public databases for gathering as much information as possible about the target. Passive Recon passively provides whois information, MX records, DNS information, and other useful data. Significantly, due to the passive nature of Passive Recon, the owner of the domain you are querying is not alerted.

Sample Social Media Investigations Policy

Policy: CONDUCTING SOCIAL MEDIA INVESTIGATIONS

Date:

PURPOSE:

The purpose of this policy is to develop guidelines on using social media for conducting criminal investigations and gathering intelligence data. It is the intent of the [ name of entity] to ensure that the [personnel of the (name of entity) ] are aware of what the Investigator is doing and why, as well as protect citizens’ privacy, civil rights and liberties while conducting said investigations.

While social media has become more important during certain investigations, it is only one tool. The [name of entity] uses many tools and methods, all of which are lawful and have a valid purpose. While all uses of social media for law enforcement purposes must be lawful, this policy will detail when it is authorized and used. It must be noted that not every intelligence or investigative operation will require this entity to access social media sites.

This policy will also describe why and how the [name of entity] will capture social media information during an investigation.

LEVELS OF USE:

The [name of entity] Investigator may operate in various roles when seeking and gathering information from social media sites during an official investigation.

The first level, apparent/overt status; is when the Investigator is not concealing his identity and is viewing open source information (OSINT). For example, the investigator may view a subject’s open Facebook page, LinkedIn profile, or Twitter page to find out any relevant information. In instances where user profiles and pages have no privacy settings and are open to any viewer.

In the second level, discreet status; the Investigator’s law enforcement identity is not overt because the information-gathering efforts would be hampered if the law enforcement identity was discovered.

The final level, covert, is when the Investigator’s efforts require concealing his identity by using an undercover social media identity in an attempt to gather necessary information or intelligence.

SOCIAL MEDIA MONITORING TOOLS:

This Agency may employ various social media monitoring tools to aid the Investigator in conducting an official social media investigation to aid in the prosecution of individual(s).

OFFICIAL USE:

The use of any and all tools and resources used to conduct social media investigations will be for official use only and at no time whatsoever will be utilized for personal gain.

PROCEDURES, AUDITING & MONITORING:

When conducting investigations using social media, the Investigator will be required to document such activities by completing a report and attaching it to the case file, thus informing the [head of entity] or designee that an official social media investigation was conducted for the purpose of information or intelligence gathering to aid in the resolution of the case.

RELATED POLICIES:

List any and all that apply including dates implemented.

This policy is subject to modification and revision as deemed necessary by the Prosecuting Attorney.

_________________________
[name of official]
[title]

Social Media Terms Defined

Application Programming Interface (API) - An API is a documented interface that allows one software application to interact with another application. An example of this is the Twitter API.

Collective Intelligence - Collective intelligence is a shared intelligence that emerges from the collaboration and competition of many individuals and appears in consensus decision-making in social networks.

Crowdsourcing - Crowdsourcing, similar to outsourcing, refers to the act of soliciting ideas or content from a group of people, typically in an online setting.

Engagement Rate - Engagement rate is a popular social media metric used to describe the amount of interaction -- likes, shares, comments -- a piece of content receives.

Geotag - A geotag is the directional coordinates that can be attached to a piece of content online. For example, Instagram users often use geotagging to highlight the location in which their photo was taken.

Exif Data - EXIF is short for Exchangeable Image File, a format that is a standard for storing interchange information in digital photography image files using JPEG compression. Almost all new digital cameras use the EXIF annotation, storing information on the image such as shutter speed, exposure compensation, F number, what metering system was used, if a flash was used, ISO number, date and time the image was taken, white balance, auxiliary lenses that were used and resolution. Some images may even store GPS information so you can easily see where the images were taken!

Algorithm: process or set of rules used to perform a task; algorithms are used to generate online search results and other online procedures.