OSIntOps News

2021-05-21 09:08:00 Week in OSINT #2021-19 - Sector35 - Browser Fingerprinting

When you talk to an OSINT expert about staying anonymous, they'll probably tell you about 'fingerprinting' sooner or later. This is where third parties assign a unique identifier to your browser or system, making it possible to track you, even if no cookies are set. The research by FingerprintJS goes beyond that and shows that even with the best OpSec there seem to be methods to fingerprint your systems. Simply by checking what applications are installed on a system. If you need to keep your VM's unique from now on, you'll might have to start thinking about installing a subset of applications, or removing them, to create a fingerprint that might be generic enough to beat this. To check the uniqueness of your browser, there's the website 'Am I Unique'. But they haven't incorporated this technique yet, so they mainly look at OS and browser, screen size, installed extensions, language settings and so on.

We found a vulnerability that allows for cross-browser tracking in Chrome, Firefox, Safari, and Tor. Read our article to learn more about the exploit, and try our live demo for yourself - https://t.co/SKkK2Exz9u#privacy #Chrome #Safari #tor #webdevelopment
— FingerprintJS (@FingerprintJs) May 13, 2021

Link: https://fingerprintjs.com/blog/external-protocol-flooding/

AmIUnique: https://amiunique.org Open / Comment

2021-05-20 19:18:00 Week in OSINT #2021-19 - Sector35 - Movie Time!

Sylvain Hajri has created a very, very lengthy thread on Twitter on movies about OSINT, investigations and hacking. Sylvain correctly claims that both OSINT and hacking is about the mindset, not only about skills. And it's true, both work with a visible part of a puzzle, and you're trying to find underlying pieces of information to complete a picture. Whether it's a technical infrastructure, or the verification of a specific event, both require you to work towards unraveling facts that can be used for your purpose.

[THREAD] #Hacking & #OSINT are not just about skills, it's also a mindset!

Here's a brief list of documentaries/movies/series that I recommend to watch to discover our wonderful domains.

And also to stop my students calling me a boomer
— Sylvain Hajri (@navlys_) May 13, 2021

Link to Twitter thread: https://twitter.com/i/status/1392941294394253314 Open / Comment

2021-05-20 17:16:01 https://www.bellingcat.com/resources/2021/05/18/unsure-when-a-video-or-photo-was-taken-how-to-tell-by-measuring-the-length-of-shadows/ Open / Comment

2021-05-20 12:11:01 https://christina-lekati.medium.com/cyber-terror-campaigns-against-high-value-individuals-public-figures-34b7b0711043 Open / Comment

2021-05-20 09:08:00 Week in OSINT #2021-19 - Sector35 -Instagram Tools

Wopita, formerly known as Pictabear, seems to be gone since some time. The website offered a nice way to anonymously browse and search Instagram posts. But '7oaster' and 'nomoredroids' on the SearchLight Discord shared some sites that offer the same functionalities: Dumpor, Pixwox and Picuki. You can search by hashtags, locations or accounts, where Pixwox seems to be the most stable and looks to me it offers more recent content compared to Dumpor and Picuki. Another issue is that Pixwox and Dumpor had issues with showing posts from locations, where Picuki had no issues with that, though it was running half a day behind. So I wouldn't always recommend these sites on a regular basis, but as 7oaster commented: These sites might have archives posts on archive.is or archive.org, making it a good option to find removed posts.

Dumport: https://dumpor.com

Pixwox: https://www.pixwox.com

Picuki: https://www.picuki.co Open / Comment

2021-05-19 19:18:00 Week in OSINT #2021-19 - Sector35 - OSINT on North Korea

While browsing around a bit, I found an awesome YouTube channel called SecurityFWD. On this channel you find videos on cybersecurity, hacking and digital investigations, and in this video they have a look into North Korea. Kody Kinzie looks at a domain name with Maltego, pivots on DNS servers, finds breached email addresses and discovers more North Korean websites. Wonderful showcase on how to use Maltego in digital investigations that involve domain names. Except maybe for the part where he runs all transforms after not finding a specific option

Link:

Open / Comment

2021-05-19 17:35:02 https://jakecreps.com/osint-tool-tuesday-multi-tool-usernames-snapchat/ Open / Comment

2021-05-19 12:11:01 https://www.bbc.com/news/57102499 Open / Comment

2021-05-19 09:08:47 Week in OSINT #2021-19 - Sector35 - Clint Watts

Shakira on Security shared a link to an interview with Clint Watts, the former FBI agent and executive officer at the CTC. He shares some really useful tips that are applicable to the investigative work that most of you readers are interested in. Good advice like focussing on investigative techniques rather than tools or platforms, and a useful 'Link Analysis Matrix' to get insight in relationships.


Link: https://brackets.substack.com/p/7-life-lessons-from-25-years-in-counterterrorism Open / Comment

2021-05-18 19:18:00 Week in OSINT #2021-19 - Sector35 - Tool: Hunchly Mobile

Justin Seitz announced a nifty little tool for Android and iOS. Hunchly Mobile enables you to collect certain evidence and create an evidence file, that can be shared with others, or imported into a case file on the desktop version. This for instance enables journalists to let people share content like video footage to be shared with others. I did miss the option to save URL's in the app, especially since I work a lot with digital information from the web. But as a workaround Hunchly tells you to create a screenshot, and you can then easily add the URL in the notes.

iOS: https://apps.apple.com/ca/app/hunchly-mobile/id1566453410

Android: https://play.google.com/store/apps/details?id=com.hunchly Open / Comment