EN google hacking making competitive intelligence work for you

Google Hacking Making Competitive Intelligence Work for You Copyright 2008 Security Constructs, LLC All rights Reserved Tom Bowers President Philadelphia InfraGard Managing Director, Security Constructs, LLC Competitive Intelligence What is it? How is it done? Is it legal? How we prevent it? Copyright 2008 Security Constructs, LLC All rights Reserved Asking Questions Basics – Who – What – When – Why – Where – How Copyright 2008 Security Constructs, LLC All rights Reserved “Godiva Chocolatier Inc” – What business is it in? – How big is it? – Where are they located? – Is it publicly traded? – What are the annual sales and growth? – Pending legal issues? – Who are the decision makers? Refining the Search Use “intitle” versus “inurl” (looking for dirt) Scour news sites and newsgroups Check financial filings Check security analyst reports Use Google Groups and Blogs Copyright 2008 Security Constructs, LLC All rights Reserved Google Tools Google Answers (retired) answers.google.com Google Scholar scholar.google.com Google Earth earth.google.com Google Patent Search www.google.com/patents Google Blog Search blogsearch.google.com Google Alerts www.google.com/alerts Google Maps maps.google.com Copyright 2008 Security Constructs, LLC All rights Reserved Google Options Copyright 2008 Security Constructs, LLC All rights Reserved Google Maps Copyright 2008 Security Constructs, LLC All rights Reserved Google Maps – Satellite Copyright 2008 Security Constructs, LLC All rights Reserved Google Maps – Satellite Copyright 2008 Security Constructs, LLC All rights Reserved Google Earth – 3D Satellite Levels: Free Plus - $20 Pro - $400 Copyright 2008 Security Constructs, LLC All rights Reserved Google Alerts Constant Information Leakage Monitoring (counter-intelligence) Note that some search terms are “explicit” and others are not Copyright 2008 Security Constructs, LLC All rights Reserved Additional Google Related Tools •Open Directory Project dmoz.org •ResearchBuzz www.researchbuzz.org •TouchGraph GoogleBrowser www.touchgraph.com/TGGoogleBrowser.html Copyright 2008 Security Constructs, LLC All rights Reserved Open Directory Project Copyright 2008 Security Constructs, LLC All rights Reserved ResearchBuzz Copyright 2008 Security Constructs, LLC All rights Reserved TouchGraph Copyright 2008 Security Constructs, LLC All rights Reserved Document Grinding Username password email Filetype:xls Notice that this is a spreadsheet With the search terms highlighted Copyright 2008 Security Constructs, LLC All rights Reserved Metadata analysis Using Metadata Assistant Author Creation dates… Hidden Hyperlinks Additional points of data leakage Copyright 2008 Security Constructs, LLC All rights Reserved Counter Competitive Intelligence Conduct CI on yourself – your competitors are Build a competitive profile Who are the movers and shakers Lines of business…… What type of information is leaking and from where? Can a business process be modified? Active disinformation? (running equipment at odd times…) Will a new policy help? (business or security) Can I leverage existing security technologies? Are there new technologies? Copyright 2008 Security Constructs, LLC All rights Reserved Case Study Los Alamos and Oak Ridge Spear Phishing attack Visitor database only 12 different attackers, emails to 1000's of employees Which scientist visited, how often and what is their expertise Allows us to build a competitive profile of the type of research being done at these facilities and by extension what type of research these facilities are capable of What about your business? Whaling Attack – phishing your executives Specific companies Specific groups within a company Who are the movers and shakers Email addressing schema (look and feel) Who these people normally talk to Detailed contact information Similar to Executive Recruiters today Copyright 2008 Security Constructs, LLC All rights Reserved What Can I Learn? Copyright 2008 Security Constructs, LLC All rights Reserved Interpretation Copyright 2008 Security Constructs, LLC All rights Reserved Flexible Protection Architecture Policies Procedures Contracts Vendor selection Auditing Active Protections Passive Protections Copyright 2008 Security Constructs, LLC All rights Reserved Johnny.ihackstuff.com Google Hacking for Penetration Testers Johnny Long Building Research Tools with Google for Dummies Harold Davis Copyright 2008 Security Constructs, LLC All rights Reserved Conclusions •If its on Google its probably public information •Google has many tools built in •Many tools are built on Google APIs •Always start with "the question.” Then refine, research, refine •Don't forget the documents themselves •Build a profile, use it to improve your security Copyright 2008 Security Constructs, LLC All rights Reserved Questions? Tom.Bowers@securityconstructs.com Copyright 2008 Security Constructs, LLC All rights Reserved ... Reserved Counter Competitive Intelligence Conduct CI on yourself – your competitors are Build a competitive profile Who are the movers and shakers Lines of business…… What type of information is... Copyright 2008 Security Constructs, LLC All rights Reserved Google Alerts Constant Information Leakage Monitoring (counter -intelligence) Note that some search terms are “explicit” and others are not Copyright.. .Competitive Intelligence What is it? How is it done? Is it legal? How we prevent it? Copyright 2008 Security