Category
In the last article, I wrote about how legal firms can utilise cyber threat intelligence and the SOS Intel toolkit for cyber defence. But in this article I want to explore a different idea, namely, offensive threat intelligence for legal firms.
When someone says “cyber crime” what do most people think of? Likely something along the lines of “hacker”. Most will picture someone in a dark room staring at a computer screen with hundreds of lines of code flashing by while frantically typing on their keyboard.
While hackers like this do exist, they make up a minority of cyber criminals. Cyber stalking is, by far, the most common cyber crime.
Every year almost 10 million people in the United States are victims of cyber stalking or harassment. The vast majority, about ~80%, of cyber stalking incidents go unreported to law enforcement. To make matters worse, cases of cyber stalking that are reported often go unpunished. From 2010 – 2013, of the roughly 2.5 million reported cases of online harassment, only 10 cases resulted in a prosecution.
A major reason many of these cases go unresolved is the extensive evidence required to make a case. Collecting evidence on a cyber stalker is a difficult and time consuming process. But, this doesn’t have to be the case.
Utilising cyber threat intelligence tools, it is possible to collect large amounts of data on a target. Much like other cyber criminals, cyber stalkers use platforms like Telegram and Signal. Threat intelligence tools like the SOS Intel toolkit can pull data from these platforms on a mass scale. Just by crafting a few keywords you can search thousands of terabytes of data.
This “offensive” use of the SOS intelligence toolkit is not isolated to just cyberstalking cases. The SOS toolkit is incredibly versatile, it’s capable of assisting with any sort of research into any internet crime. Let’s take a look at what the SOS toolkit is capable of…
SOS Intelligence Toolkit API
The best way to utilise the SOS Toolkit is the API. The API allows you to integrate the toolkit into 3rd party programs. The API provides you the raw aggregate data and leaves the organisation up to your personal preferences. To start working with the API, first you will need to generate your API key.
You can do this in the “API” tab of the web interface. Once you click the “generate” button you will see this message:
There are many API clients out there, but for the purpose of simplicity in the example I will be using Postman.
SOS Intelligence offers a Postman Collection file to further simplify the process of implementing API requests in postman. If you are interested in using the Postman collection, please send an email to “[email protected]”
Once you have your API key and have imported the Postman collection file (or you plan on manually adding the API requests) you need to add the key to Postman as such:
Once you have your API key set you are ready to start making API requests! In this example I will be making queries as if I was investigating a cyber crime case.
Quick note: The user I am searching for in this example is “pompompurin” a known cyber criminal who is active on Twitter and Telegram and administrator of the infamous “Breached Forums”.
Here is a simple query for “breached forums” using the Twitter search function. (Note: At the moment the Twitter search function has a search history limit of 6 months)
The Twitter search function will return any data that matches the search query. If the query matches any of the values or sub-values of a post, the function will return all of the data of said post.
The data aggregated on each post is entirely dependent on the post itself, i.e. if other users are mentioned or if there are hashtags. It’s worth noting that searches are passed as phrases with “AND” logic. For example, my search for “breached forums” searches for “breached” AND “forums”. This way you can refine your results easily by crafting search queries that match exactly what you’re looking for, automatically weeding out all of the bad results.
Sometimes collecting intelligence from clearnet sources is not sufficient enough. Many hacking forums run both clearnet and darknet sites. The SOS Darkweb search function can search with several different categorical options. The first option is the “Full Text Search” as seen below.
The “full text search” searches through the full text of the site’s page. To narrow down your search results, you can set parameters like “phrase” to true. For example, if I search for SOS Intelligence, the query will pass as SOS “OR” Intelligence. However, if I set the “phrase” parameter to true, this query is passed as SOS “AND” Intelligence.
The Dark Web Search tool also has special functions for more specific searches like emails and Bitcoin wallet addresses.
The SOS Toolkit puts all of these tools at your disposal instantly. The API is just one method of utilising the toolkit.
The SOS web application allows you to access the same tools with a more friendly user interface. But the API allows you to integrate the SOS Toolkit into 3rd party OSINT frameworks as well as your own programs/scripts.
The API provides a simple way to work with the tool kit “offensively”. Utilising several or all of these search functions you can gather a great amount of information on a suspect. You can try these searches out yourself! Remember, we have two community APIs:
Both can be accessed via a free plan which you can sign up for here 🙂
Photo by Tingey Injury Law Firm on Unsplash.
A new service launched today aimed at helping prevent what is sadly a growing menace – scam calls and people being defrauded.
People who think they are being defrauded on the phone are encouraged to stop, hang up and call 159. Any real bank or person will not mind you doing this. A scammer *will* mind and will always try and keep you on the phone.
It has been launched in conjunction with a number of major banks and phone service providers, including HSBC, Barclays, BT and Kcom.
Scams and financial fraud are increasing at an unprecedented rate. They have become a fast-moving and industrialised business.
Criminals stole over £1.26bn through fraud and scams in 2020. There were over 80,000 instances of fraud reported by UK telecommunications companies in 2019 as well.
The challenges presented by the COVID-19 pandemic have presented new opportunities for scammers to exploit. There were 149,946 reported Authorised Push Payment scams in 2020 – up 22% from 2019. These are scams where victims are conned into making a payment to a scammer who has posed as genuine and gained their trust. These scams often use legitimate platforms to reach victims, borrowing the credibility of the platforms and services they abuse.
Banks and financial institutions are making great efforts to stops frauds and scams. In 2020 that they stopped £1.6bn of attempted unauthorised transactions.
Stop Scams UK website
Having listened to a number of features about this on the radio today, it is always deeply troubling to hear about people losing money to scammers and fraudsters.
People think that they will be clever enough or switched on enough to know when it is happening to them, but in a lot of cases, the criminals are being incredibly devious and can trick you into transferring money.
In one instance, the scammers pretended to be not only the bank, but also the bank’s fraud prevention team PLUS sent official looking text messages at the same time from a spoofed number.
How does the new number work?
If you think someone is trying to trick you into handing over money or personal details…
…Stop, hang up and call 159 to speak directly to your bank.
Last year criminal gangs stole over £470m by pretending to be your bank or other service provider.
159 is the memorable, secure number that contacts you directly to your bank if you think you’re being scammed.
159 works in the same way as 101 for the police or 111 for the NHS. It’s the number you can trust to get you through to your bank, every time.
159 will never call you. Only a fraudster will object to you calling 159.
How does 159 work?
SOS Intelligence provides Real Time Threat Intelligence for everyone. We are not connected with fighting scam phone calls directly but we are actively fighting fraud online with our service.
Often scam callers use details they may have obtained online, often from breaches of popular services which are then sold on the Dark Web. We monitor keywords, key phrases and email addresses in realtime on the Dark Web and offer a free option to monitor an email address you use when signing up. As a result, you get alerted when your data / email address is out there on the Dark Web.
Sadly businesses and organisations don’t know until too late when their data has been compromised. We prevent that from happening.
It’s really good to see this new service launch.
If you are looking to understand:
Then this guide will provide you with all of the answers you need.
What is the Dark Web?
The Dark Web is a peer-to-peer interconnected network of computers that use the Tor Protocol, commonly known as the Tor browser.
Tor uses the top-level domain .onion which takes its name from the method of routing the Tor network’s users.
Anonymity is maintained by building a circuit each time a user tries to connect to a certain .onion domain.
The circuit becomes a multi-layered encryption chain, with each layer unwrapping the next one until it gets to its destination. Hence the reference to an onion.
This method ensures that the relaying nodes on the network between sender and recipient never know who the other one is. They only know the next layer as they unwrap it.
It provides 100% anonymity whilst on the network.
The Dark Web is essentially the containing of that encrypted traffic within the Dark Web itself.
There are only 2 places where you can breach Dark Web anonymity.
Either the client end before you transmit data onto the Tor network or via the other end using an Open Relay.
Anyone can download and install an Open Relay and capture information then pass it out onto the internet if the data hasn’t been sufficiently secured within itself.
The Tor Project is an open-source foundation that was started as a US Navy research project.
It was originally part of the National Security Agency, a national-level intelligence agency of the United States Department of Defense.
It’s likely that it predates its official launch by a number of years.
The early development of the .onion protocol was designed to allow spies to communicate with each other and contact their commanders via the internet in as safe and secure a manner as possible.
For it to work properly, they needed a sufficient number of nodes in order to allow traffic to pass anonymously.
Too few nodes would simply allow adversaries to intercept and attack their encrypted data.
So (the story goes) the Tor Project was started as a free open source project to encourage widespread use.
It has become increasingly popular over the years and undergone a number of significant iterations since its release in 2002.
The Tor Project quickly gained users thanks to its advanced anonymity properties.
Let’s face it, you build a road and people are going to start driving on it.
Yet here’s the thing:
There are numerous key global events that have seen spikes in growth of Tor.
These include the following:
Meanwhile, various Hacking Communities began using it because it became the ‘cool thing’ to do.
Most of the activity taking place on the Dark Web is as dull and trivial as the rest of the Internet.
In truth, for all its negative connotations the Dark Web shouldn’t be something to be afraid of.
Of the 95,317 sites we currently track, less than 5% are flagged as having potentially abusive content on them.
However:
There is also a significant amount of fraud taking place here, along with a percentage sharing abusive content.
The biggest threat to organisations comes in the form of Ransomware.
Ransomware is the process of hackers encrypting and stealing sensitive company and customer data then ransoming it back to the organisation for profit.
Let’s look at this in more detail in the next chapter.
In June 2017, the chief technology and information officer for Maersk, a Danish shipping and logistics giant, returned from his honeymoon to discover that the company has suffered a major malware attack.
The attack on its IT systems was so bad that the company was virtually unable to operate, even to the point that its ship’s captains were forced to navigate the globe using paper and pen.
4 years later and the company is still remediating, estimated costs to date are as much as £300 million.
No one is sure whether this attack was Ransomware gone wrong (no public request for payment has been made) but the damage to its business continues to be felt to this day.
The Dark Web enables hackers to remain anonymous whilst providing them with a marketplace to force you as the victim to pay to have your data decrypted.
It gives them a foothold, a place where they can publicly advertise to the world all of the organisations they have hacked.
This data often includes intellectual property, financial information, and customer data and is usually placed on the Dark Web and made free to download until the organisation pays to have it removed.
These are very professional operations with call centers, helplines, and live-chats. Some of them even provide a ‘Get 1 File for Free’ service to prove that the decryption works.
This term describes when a group of hackers come together and plan an attack. This would often involve them having a good look around your network before they begin encrypting specific files and servers.
They typically look to exploit vulnerabilities in your network and appear to be reasonably agnostic when it comes to sectors and industries.
Victims could be a dental surgery or multinational aerospace company. The primary motivation is getting you to pay for your encryption keys.
Another way into your systems is via ‘phishing’.
This could involve an IT employee’s credentials are stolen and where the company doesn’t have sufficient protection to prevent the hackers from gaining access to the system.
Ransomware is developing and maturing into a more industrialised activity, with a much greater trend towards automation.
A lot of Ransomware programmes will automatically send your encryption keys off to an onion domain that is spun up just for you, gaining access through something as simple as a Word or Excel document that executes a Macro in the background.
The Macro will then automatically begin to encrypt your data and spin it out onto the Dark Web.
Apart from disabling Macros, patching applications to keep things up-to-date, not opening docs you aren’t sure about and using good security software there isn’t much more you can do.
At present we are aware of between 26-30 active ransomware groups.
If you find yourself on a Ransomware site, there is nothing you can really do except pay and begin remediating.
However, police forces are active on the Dark Web looking to take down operations and have had some success. Dutch police were recently so pleased to have taken down one botnet network that they even posted about it as themselves on a hackers’ forum.
Protecting your organisation from hacking and Ransomware is a difficult task, especially when a concerted hacking campaign coupled with human error comes into play.
If as an IT Professional and/or diligent CTO you have done everything within your power to secure the network and Ransomware still finds its way through a lot of it will simply come down to bad luck.
Hackers work hard to ensure that they are fully undetectable and use dynamic systems that generate malicious downloads on the fly, making it difficult to defend against these types of attacks.
The priority then becomes managing the fallout and particularly the PR as best as you can.
A data breach quickly moves from being an IT problem to a business problem. If you can show that you have behaved competently and done as much as you can there is a chance to come out of it looking better.
Our Dark Web Monitoring tool supports you in this process by providing early warnings of any Dark Web activity around your brand.
SOS gives you awareness, time, and context by letting you know if your information is out there; what information that is; and who is talking about it.
Having these instant alerts can be very reassuring, giving you time to react with the full knowledge of just how big your exposure is.
—
Now we’d like to hear from you. Have you been affected by any of the issues raised in this guide? Do you have any concerns around data breaches and threat intelligence?
Please get in touch if you need to find out more using the contact info below. And if you’ve found this information helpful, please feel free to share it on your social networks!
Recent Comments