OSINT: Gathering pieces of the puzzle

OSINT: Gathering pieces of the puzzle

In this article you will learn about what OSINT is, what it can be used for and some examples of the data that you can use for your research. I am also bringing up a real-life example where I used OSINT to geolocate a fire.

What is OSINT?

One aspect of cybersecurity is OSINT (open-source intelligence). It can briefly be described as the usage of sources that are publicly available, either free or paid, in order to produce intelligence. Intelligence can come from information (which is unprocessed) or knowledge (which is processed and more actionable). Things that are learned from this type of research supports decision makers, business owners, governments and civilians.

It is also worth mentioning that if you engage in OSINT you need to consider the data that you gather and whether it is truthful or not, it can even be purposefully disinformative. You also need to have an understanding if your findings or your methods can have legal consequences. There is also a technical perspective to it, make sure that the programs and the websites that you use can be trusted.

You can read more about intelligence and OSINT here on Wikipedia:
https://en.wikipedia.org/wiki/Intelligence_(information)
https://en.wikipedia.org/wiki/Open-source_intelligence

Why engage in OSINT gathering?

Before we dive into the methodology and mindset, we will discuss the reasons and relevance behind gathering this type of intelligence and how it can be connected to cybersecurity.

One argument is that it is easily available for many researchers, the bar is low and you can get started with your research easily. There are sources that a regular civilian does not have access to, such as classified information, satellite data and military resources.

Another point of view is the cost. You can with relative ease get hold of data, information and knowledge from sources that offers it for free, but sometimes there are premium functions that you have to pay for, such as access to archived logs.

Lastly, there is a community with which you can share ideas, tools and methods with. Sometimes it is the people themselves that are the greatest resource, someone might recognize a symbol or know a specific dialect for example.

Just keep in mind that OSINT tools, as with any other tools, can be incorrect at times or they can be removed from where they are hosted, if you don't build research tools of your own or document your findings, you will be reliant on a third party.

OSINT is an important part of reconnaissance for both security testers, intelligence agencies and private individuals who wants to know more about the world. Someone investigating a security breach might find clues that they want to know more about, someone who is planning to test the security of a client might want to see what attack vectors there are. An attack vector is a specific path/method to gain unauthorized access.

From which sources can you gather intelligence?

To some degree it is your imagination that sets the limit to all the classes of information that you can gather. Essentially every bit of information and tiny bit of data could tell you something and help you build the overall picture. At some point however, you have to make a judgment of what contributes to your case, what is within scope, how easy the data is to work with and if it is worth the effort. The more you know the better, but sometimes your time is worth more if it invested into other ventures, that is where you draw the line.

Let’s dive into the types of information that you can gather with a handful of examples to get your inspiration going.

• An audio recording can contain background sounds that might be of interest beyond the intended content. In the background you might hear a public broadcast, a radio station, sounds from public transport that can be geolocated, languages/accents, construction sites and so on.
  
  
• Video recordings potentially contain the same information as an audio recording, but you can also gather information about the location in the video itself. Keep an eye out for street signs, advertising, stores and restaurants, famous buildings and even skylines.
  
  
• Images contain the similar visual information as a video might contain. You can for example get a pretty clear idea of where a picture is taken if you can go on to a map service and match the skylines on the map with that on the picture. There are also map tools that let’s you look at buildings from the street level. You can use apps that shows how shadows fall depending on the position of the sun which gives you a rough estimate of what time the photo was taken.
  
  
• If you have access to the original file, you can also come across metadata, such as location, usernames, time of creation and edit.
  
  
• Other popular tools are those that show airlines, trains, cars and marine vessels. From an OSINT point of view this can help you pinpoint timelines and locations as well, for example if a vehicle is seen in a picture.

Intelligence gathering in practice

Some time ago I read the news about a fire in an industrial building where they produce chemicals. Given the geopolitical situation and the close proximity to my city I decided to figure out which factory it was that had caught fire. The news didn't reveal any names or exact locations, but there were a general area and a blurry picture. 

The picture showed a building that was partially on fire and the neighboring industrial area, in the background a building stood out with a neon sign, where a slogan was partially visible.

By combining the slogan and the general district in my default search engine I managed to locate the neighboring company. From that information I could extract an exact address and look it up in a 3D map. I matched the 3D map (at the correct angle) with the image from the news and could then find the address of the burning chemical factory.

With the exact address of the fire, I could now find the name of the company and conclude my research.

Summary

This article explained how various sources of information combined with each other can lead to conclusions and insights.

You can use typical tools in non-typical ways to assist you in your work of finding information and sometimes there is more information than first meets the eye. You can refine a regular file into valuable knowledge in your research. Whether you are testing the security of a company, planning a trip or looking over your own public profile, OSINT is a nice skill to have.