Hunting Cyber Criminals

CHAPTER 15Researching People, Images, and Locations

We finally come to my personal favorite part of an investigation: looking into people. I don't know what it is, but there is something incredibly satisfying about finally learning who your targets are, behind all the layers of aliases and alter egos. Once you are able to find that magical strand of evidence to unravel, it's like a new world opens for you. Time begins to slow down and suddenly everything becomes clear. It's like you are in bullet‐time from The Matrix. It's incredible.

EXPERT TIP: JOHN STRAND

Anytime you're trying to target individuals in an organization, you have to have a process for identifying the most probable targets to interact with that will click on a link or trust something you send them.

What I train all of my testers and everybody that goes through my SANS course is to always look for bright, shiny objects. So, imagine that you have an organization that has 4,000 individuals; the individuals that are the most interesting to me are the individuals that are the most heavily engaged in social media.

They're the individuals that have a very heavy presence on Twitter, they're the people that constantly take pictures of their food and they post it online. They're the people that have opinions and insist on those opinions being present someplace out on the web. When you're building up a pretext to socially engineer an individual, it is really interesting because you can use all of this information to ...