What is OSINT?
One part of cybersecurity is the aspect of OSINT (open-source intelligence). It can briefly be described as the usage of sources that are publicly available, either free or paid, in order to produce intelligence. Intelligence can come from information (which is unprocessed) or knowledge (which is processed and more actionable). Things that are learned from this type of research supports decision makers, business owners, governments and civilians.
It is also worth mentioning that if you engage in OSINT you need to consider the data that you gather and whether it is truthful or not, it can even be purposefully disinformative. You also need to have an understanding if your findings or your methods can have legal consequences. There is also a technical perspective to it, make sure that the programs and the websites that you use can be trusted.
Sources:
https://en.wikipedia.org/wiki/Intelligence_(information)
https://en.wikipedia.org/wiki/Open-source_intelligence
Why engage in OSINT gathering?
Before we dive into the methodology and mindset, we will discuss the reasons and relevance behind gathering this type of intelligence.
One argument is that it is easily available for many researchers, the bar is low and you can get started easily. There are sources that a regular civilian does not have access to, such as classified information, satellite data and what not.
Another point of view is the cost. You can with relative ease get hold of data, information and knowledge from sources that offers it for free, but sometimes there are premium functions that you have to pay for, such as access to archived logs.
Lastly, there is a community with which you can share ideas, tools and methods with. Sometimes it is the people themselves that are the greatest resource, someone might recognize a symbol or know a specific dialect for example.
Just keep in mind that OSINT tools can be wrong or they can be removed, if you don't build tools of your own or document your findings, you will be reliant on a third party.
From which sources can you gather intelligence?
I guess it is your imagination that sets the limit to all the classes of information that you can gather. Essentially every bit of information and tiny bit of data can say something, but at some point you have to make a judgment of what contributes to your case, what is within scope, how easy the data is to work with and if it is worth the effort.
- An audio recording can contain background sounds that might be of interest beyond the intended content. It could be a public broadcast, a radio station, sound from public transport that can be geolocated, language/accents, construction sites and so on.
- Video recordings potentially contains the same information as an audio recording, but you can also gather information about the location, keep an eye out for street signs, advertising, stores and restaurants, famous buildings and even skylines.
- Images contain the similar visual information as a video might contain, you can for example get a pretty clear idea of where a picture is taken if you can go on to a map service and match the skylines on the map and on the picture. You can use apps that show how the shadow falls from the sun to get a rough estimate of what time the photo was taken.
- If you have access to the original file you can also come across metadata, such as location, usernames, creation and edit time.
- Other popular tools are those that show airlines, trains, cars and marine vessels. From an OSINT point of view this can help you pinpoint timelines and locations as well, for example if a vehicle is seen in a picture.
The intelligence gathering in practice
Some time ago I read the news about a fire in a industrial building where they produce chemicals. Given the geopolitical situation and the close proximity to my city I decided to figure out which factory it was that had caught fire. The news didn't reveal any names or exact locations, but there was a general area and a blurry picture.
The picture showed a building that were partially on fire and the neighboring industrial area, in the background a building stood out with a slogan that was visible.
By combining the slogan and the general district in my default search engine I managed to locate this neighboring company. From that I could extract an exact address and type it into a 3D map. I matched the map with the image from the news and could then find the address of the burning chemical factory.
With the exact address of the fire I could now find the name of the company and conclude my research.
Summary
This article shows you how various sources of information combined with each other can lead to conclusions and insights.
You can use typical tools in non-typical ways to assist you in your work of finding information.