Unravelling the Norton Scam – Chapter 2

Art is often considered the process or product of deliberately arranging elements in a way that appeals to the senses or emotions. OSINT is art and sometimes OSINT produces art.

This is the second chapter of a series of short blog posts covering the investigation of a massive online scam network. If you are a new reader, I would advise you start with the first chapter to understand the context of this project.

The Art of OSINT

This is big! So far, we have collected information on hundreds of different entities; including websites, names, phone numbers, email addresses and much more. When we started, relevant data was just dumped into a text file. We also used Hunchly during our collection and then realized we needed to structure the most important data and moved on to a spreadsheet. This worked for a while, until we felt the need to display links between entities in an easy and understandable way. A more visual approach was chosen, and Sector started what I call “The Art of OSINT”: a link chart.

Sector used Maltego for our case, but there are many alternatives you can use as well. I have grown fond of draw.io and others might use one of the various mind mapping apps and platforms. The idea behind link analysis in general is to evaluate relations and connections between entities. Link charts are the visualization of this data, which in many cases make it easier for an analyst to discover connections. Sometimes the connections are not direct, but indirect, linking entities to each other by a third-party individual.

Let us take a look at how link charts can be built from scratch. In the first chapter of our series, I posted a screenshot of one of the scam sites.

4

On here I already have multiple pieces of information that I can connect. A name, a postal address, a phone number and lastly an email address. Each of these is the starting point for further OSINT investigtions. We found that the email address was used to register the domain allbagmanufacturing(dot)com. This domain also lists an Indian phone number in the WHOIS data.

phone number register.png

It turns out, that the Indian phone number was also used to register the site roadrunneremailsupports(dot)com.

all links.png

In conclusion, both sites are likely connected. However, how do we know that this phone isn’t just a burner phone or a random phone number? More OSINT research is required to verify if the phone number is existent and who it belongs to. I also mentioned a little social engineering coming up, didn’t I? If you were hoping to read about this topic in the second chapter of our journey, I have to disappoint you. Rest assured, we have a nice story on social engineering in one of the later chapters. Now, let’s get back to our link analysis.

One piece of information leads to another and soon we find new leads and many connections between the entities. The chart itself has grown quite a bit in the meantime. At first glance, it will seem a bit chaotic. However, it is still easier to handle than relaying this information in a text-based form. For me, link charts have an artistic character. Each chart, whether built manually or automated, is one of a kind. Unique data, unique arrangements, all coming together to form a piece of modern art.

Modern Art.jpg

Put this on a large canvas, have Sector sign it and it would be something that could be found in the Guggenheim Museum of Modern Art. One day I plan to do exactly that. A vernissage on “The Art of OSINT”. Until then, let’s keep creating more masterpieces with our online investigations and link charts.

Sector035/MW-OSINT – 04.08.2019

Unravelling the Norton Scam – Chapter 1

If you have problems with Norton 360 or Norton Antivirus, please do not call +1-844-947-4746. You might end up with malware on your computer.

This is the start of a series of blog posts revolving around a massive scam network that targets individuals looking for tech-support regarding various software products. The scam mostly starts with fake Norton 360 and Norton Antivirus sites, however, has also been linked to fake Microsoft support sites and fake Facebook support sites (just to mention a few). We dug into this network, trying to identify the perpetrators behind it and used lots of different OSINT techniques over the course of several months. Every once in while a little social engineering came in handy, as we also contacted some of the suspected perpetrators directly. Our investigations are not over yet, there is still more to be found, but let us take you along this fascinating journey of online investigations.

Chapter 1 – It all starts with a bad sock puppet

Do you have a look at the accounts that connect with you on Twitter or Medium? I do, and so does my buddy Sector035. In late April 2019, a new person followed Sector’s blog on Medium and he had a look at this new follower.

1

A weird URL? A nice picture of a female named Pierre? This profile was begging for further research. The URL led to a tech-support site that listed the following phone number: +1-844-947-4746. Sector didn’t even wait to check this number on his computer and immediately googled it on his cell phone. I guess that’s what you call OSINT curious.

2.jpg

It turns out that this phone number was listed on numerous obviously fake sites and blog posts offering tech-support. Out of curiosity, we decided to take a closer look at some of the sites, in order to see how they were connected to each other and possibly find out who was responsible for creating them. At the time we had no idea how time consuming and big this project would be! Among the sites using the phone number, we initially concentrated on these four:

3

Each site looked worse than the other. Horrible design, bad English and next to the aforementioned phone number, they all used the same address:

4

While Sector started to check the WHOIS information using DomainBigData, GoDaddy and Whoxy, I looked into to Google Street View and did a little reverse image searching on the photos. It turns out that all the photos used were either stock pictures or stolen off other people’s social media profiles and the address itself was in an inconspicuous housing area. Googling the address led us to more suspicious sites, some of them using a different phone number. Among these was one belonging to a company allegedly called Energetics Squad LLC. No records existed for such a company in the State of Illinois, nor in any other state. Keep this company in mind, as it will show up in a later blog post as well!

The WHOIS check didn’t always provide the exact name of the registrant, but we found another similarity: most of the websites had been registered around March 13-14, 2019 in India.

5.png

Using DNSLytics, Sector also checked the Google Analytics ID and found that the sites were not only linked by all of what was described above, they also shared a common tracking code (UA-code). At this point, it was time to start linking the information in Maltego.

6

What started with a bad sock puppet, led to googling information and from there to a deep dive into domain data, Google Analytics research, as well as pulling corporate records from official state registries. The hunt was on and upon finding all this correlating data, we couldn’t just let go and decided to push forward.

Soon after, we started collecting information on an actual suspect and at a certain point engaged in an interesting conversation with this person. So, stay tuned for the next chapters of our fascinating journey!

Sector035/MW-OSINT – 31.07.2019

Why Primary Sources Matter

Hurray! German company data is now available in OpenCorporates! Does this mean I don’t have to pay for the official company register access anymore?

This morning I confronted my boss Christian with a fact that I had found on the internet yesterday evening. Although he claimed to be the director of his company, I could not find him on OpenCorporates. For those of you who do not know what this platform does: OpenCorporates is the largest open database of companies and company data in the world. The site claims to have over 160 million companies indexed. As of yesterday, they added 5 million German companies to their database. Should I believe Christian or OpenCorporates in this matter?

When I conduct due diligence and background checks, OpenCorporates is among one of the first platforms I use. As good as it is, OpenCorporates is still a secondary source and when it comes to reliable and present-day information, I rather choose to trust primary sources.

Don’t get me wrong, secondary sources such as the aforementioned or compliance tools like LexisNexis are amazing and are really helpful to get an overview of what you are dealing with, but they all have little flaws. In some cases, the data is not as up-to-date as it should be, in other cases they are lacking essential information, such as the company shareholders. The worst-case scenario is when data is falsely aggregated during the import-process, linking the wrong entities to each other. Throughout my investigations, I have stumbled upon these issues more than once when using secondary sources.

Based on yesterday’s import of the German company data into OpenCorporates, I decided to check my own employer: Corporate Trust, Business Risk & Crisis Management GmbH. This is what OpenCorporates provided:

sources

There are some flaws in this dataset, because I am sure Christain would love to see his name in here as well. After all he founded the company and has been the director of Corporate Trust ever since. This is not just a problem within OpenCorporates, I have seen similar issues quite often in expensive commercial compliance databases as well. As you can see, the dataset is also missing information on the company’s shareholders. Even when this information is contained in compliance databases, it is sometimes outdated.

These are the reasons I always try to use primary sources, such as official government company registers, whenever possible. OpenCorporates is a great starting point to tell me where to look for more detailed information, especially since it offers the possibility to search for individuals (something that many government company registers lack), but the official company registers provides the real intelligence. This is where things can get challenging. Let us have a look at the company register in Germany, our Handelsregister. It requires a formal registration, which is only available in German. No credit card payments are possible, only direct debit. For many countries, this alone may prove to be an obstacle. On the bright side, once you have access to this database, you will gain access to the original company documents, including a list of shareholders for private limited companies.

In other countries, you can only gain access to the national company registers if you are a resident of that country and in most cases against payment. Unfortunately, nothing in life is free (except the amazing British Companies House). So when it comes to obtaining all relevant and up-to-date data, a bit more is required than just the access to (free) secondary sources.

Just to be sure about Christian, I checked our company in the official German company register. Turns out he is listed as director in the Handelsregister after all.

MW-OSINT / 06.02.2019

It’s a Match! Combining Tools & Methods for Email Verification

Email permutators and the browser extension LinkedIn Sales Navigator have been on the market for quite a while. Both are among the basic tools of trade for marketing and sales. Combined, they make a powerful OSINT tool for email verification.

Let’s imagine the following white-collar crime scenario. We are investigating a fraud case and screen one of the suspects: Fritz Marchow. He has a LinkedIn profile but what we do not know is his email address.

Most people use rather unsophisticated email addresses based on a variation of variables such as firstname, lastname, middle and nickname or the respective initials and use a common email provider. Therefore, it is not rocket science to guess these combinations.

An email permutator will do most of the work and, hence, save us a lot of time. Our tool of choice is Email Permutator+, since it allows us to permutate addresses for three domains at the same time.permutator

We fill in the information we have: our suspect’s first- and lastname. We choose the domains manually. We start with gmail.com and yahoo.com and pick outlook.de as the third option, since our case is set in Germany. The tool permutates 102 email addresses, waiting to be copied to our clipboard.

permutator2

We have already installed the LinkedIn Sales Navigator for Gmail Lite browser extension from the chrome web store. Now all we have to do is open our Gmail account and paste the copied list in the ‘to’ field of an email that we are composing. While we hover over the addresses with the cursor, we see the details appear in the Sales Navigator sidebar on the right.

permutator3

It’s a match! Hovering over fritzmarchow@outlook.de the Sales Navigator shows the LinkedIn profile that belongs to this address. We now have our suspect’s confirmed email address. If there is no matching LinkedIn profile for one of the addresses we are hovering over, the Sales Navigator will show that.

On a side note: Hovering over any Gmail address will also reveal a corresponding Google account with first- and lastname and the profile picture or an initial in case no picture has been added. This is an easy method for verifying gmail addresses. Sometimes this also works for other email providers as well, such as Hotmail.

In our case, we have another match hovering over fritzmarchow@gmail.com. Recognizing the same profile picture he used for LinkedIn we now have a second email address that can be attributed to our suspect.

permutator4

Email permutation has its limitations. It can only use a number of preset variables. As with most OSINT tools: Combined with the LinkedIn Sales Navigator it will most likely not solve your case. However, it adds another puzzle piece. In the end, many of those make up an overall picture.

It is worth mentioning that this tool ONLY uses publicly available data and it cannot help finding the email address of people who want to keep it hidden.

Sebastian Schramm / 16.11.2018

The Sunny Side of Geolocation Verifications

The sun is a useful helper in investigations and geolocation verifications. Looking at shadows in pictures could reveal the moment of capture. This helps debunking false information.

Three weeks ago we showed you how to use EXIF data in pictures to receive indications on the location and precise moment of capture. Unfortunately, not all pictures contain EXIF data, or even worse: the EXIF data could be falsified. The shadow cast in pictures enables us to check if the sun position correlates with the exposure time contained in the pictures’ metadata.

Let us look at the following picture:

IMG_5542_2

I claim, that this picture was taken in front of my office on April 11, 2018 at 10:30am. True or false?

An evaluation of the EXIF data confirms that the coordinates and exposure time back my claim. The following screenshots depict the results of the fotoforensic check on fotoforensics.com. Try it yourself, the picture actually contains the EXIF data.

  1

2.png

Case closed, information verified? Not really, because I altered the EXIF data in the picture. While the coordinates were left unchanged, the exposure time was modified. To verify this, we’ll take a closer look at the picture and dissect it into it’s single pieces of information. Hereby, we will concentrate on the shadow cast by the tree on the left.

Bild1-eng.png

Next we will use the website suncalc.org to check the casted shadow. Suncalc uses Google Maps to diplay results and the existing satellite imagery on Google is good enough to pinpoint each tree. In the first step, tree 1 will be used as the reference point (red marking). It is important to know the precise location of your reference point, or else the final results may be distorted. Afterwards, we add the presumed exposure time. The result of this actually shows, that the cast shadow (black arrow) of tree 1 fell towards the west, and not towards tree 2 as shown in our picture.

Bild2-eng.png

EXIF data canbe manipuliated, however, no one can change the course of the sun. Without any doubt the exposure time in the picture’s metadata is wrong.  Now, let us cross check the actual exposure time. The picture was taken on April 25, 2018 at 02:58pm.

Bild3-eng.png

This method can be used in many different ways. Imagine someone stands trial and presents  a picture of himself containing EXIF data to prove that he or she was at a certain location at a certain time. Or it can be used to verify propaganda pictures and videos of ISIS in Syria, supposedly containing images of an attack the previous day.

MW-OSINT / 02.10.2018

Licht und Schatten bei Ermittlungen

Die Sonne ist ein nützlicher Helfer bei Ermittlungen und Geolocation Verifications. Ein Blick auf den Schattenwurf in einem Bild gibt Rückschlüsse auf den Aufnahmezeitpunkt. Dadurch lassen sich auch Falschinformationen entlarven.

Vor drei Wochen haben wir Ihnen gezeigt, wie man mittels EXIF-Daten in Fotos Hinweise auf Standort und Aufnahmezeit des Bildes bekommt. Leider liegen EXIF-Daten nicht immer vor oder noch schlimmer: sie können gefälscht sein. Anhand der Schattenwürfe in einem Bild lässt sich überprüfen, ob der Stand der Sonne mit dem in den Bildinformationen genannten Aufnahmezeitpunkt übereinstimmt.

Schauen wir uns nun folgendes Bild an:

IMG_5542_2

Ich behaupte, das Bild wurde vor meinem Büro am 11. April 2018 um 10:30 Uhr vormittags aufgenommen. Richtig oder falsch?

Die Auswertung der EXIF-Daten ergibt, dass die Koordinate zum angegeben Standort passt und die Uhrzeit sich ebenfalls mit meiner Aussage deckt. Die folgenden Screenshots zeigen die Ergebnisse einer Foto-forensischen Auswertung auf der Webseite fotoforensics.com. Probieren Sie es auch selbst aus, das dargestellte Bild enthält EXIF-Daten.

  1

2.png

Fall abgeschlossen, Informationen verifiziert? Nicht ganz, denn ich habe die EXIF-Daten in diesem Bild manipuliert. Der Standort passt, der Aufnahmezeitpunkt allerdings nicht. Um dies zu verifizieren, zerlegen wir das Ausgangsbild zuerst in seine Einzelinformationen. Hierbei konzentrieren wir uns auf den abgebildeten Schattenwurf des linken Baumes.

3.png

Danach nutzen wir die Webseite suncalc.org zur Überprüfung des Schattenwurfs. Suncalc nutzt Google Maps zur Darstellung der Ergebnisse und auf dem vorliegenden Google Satellitenbild sind die Bäume gut zu erkennen. Im ersten Schritt wählen wir Baum 1 als Referenzpunkt (rote Markierung) in Suncalc. Es ist wichtig, den genauen Standort des Referenzpunkts zu kennen, damit die Ergebnisse nicht verfälscht werden. Anschließend tragen wir den vermeintlichen Aufnahmezeitpunkt ein. Als Ergebnis sehen wir, dass der Schattenwurf (schwarzer Pfeil) von Baum 1 zum angegeben Zeitpunkt 10:30 Uhr nicht wie im Ausgangsbild in Richtung Baum 2 fiel, sondern in westliche Richtung.

4.png

Man kann EXIF-Daten fälschen, aber nicht den Lauf der Sonne. Somit ist zweifelsfrei bewiesen, dass der Aufnahmezeitpunkt gefälscht wurde. Hier ist die Gegenprobe mit dem richtigen Aufnahmezeitpunkt. Das Bild wurde tatsächlich am 25. April 2018 um 14:58 Uhr aufgenommen.

5.png

Diese Methode kann in vielen Fällen angewendet werden. Stellen Sie sich vor, ein Angeklagter in einem Strafverfolgungsprozess möchte Anhand eines Bildes samt EXIF-Daten nachweisen, dass er zu einem bestimmten Zeitpunkt an einem bestimmen Ort war. Oder im Falle von Propagandamaterial des IS in Syrien, in dem ein vermeintlicher Angriff am Vortag gezeigt wird.

MW-OSINT / 02.10.2018

I2PO: OSINT in Support of HUMINT Operations

In a previous post I explained a concept I named ‘Interdisciplinary Intelligence Preparation of Operations’ and how this could be used to support military operations.

This post will concentrate on the use of OSINT to prepare and monitor HUMINT operations. I will not distinguish between military intelligence HUMINT and sources used by law enforcement agencies or journalists. In both cases, getting access to a source and the preparatory work needed for this are quite similar. Each HUMINT operation starts with the identification and selection of a potential source, thus finding someone in vicinity of our actual intelligence target, who is able to consistently report key intelligence. In the past, even the acquisition of a source was accomplished by HUMINT means. A case officer heard or knew of someone who might have access to specific information and he then talked his way around to finally approach the potential source.

With more and more information being available online, especially through social networks, this approach can be done virtually in some cases. Scavenging Facebook, VKontakte, Instagram, but also LinkedIn and Xing can prove very valuable when searching for potential sources. Of course, this always depends on how outgoing a potential source is on the internet. Sometimes an approach solely through social media could be sufficient, at other times this will not produce any results at all.

The following diagram in theory depicts the steps for OSINT support to a HUMINT case. This scheme is roughly based on the general intelligence cycle with its different stages. We have planning & preparation, collection, processing and evaluation and lastly dissemination covered. In our case the information will be disseminated to the HUMINT operation, which itself will start the whole intelligence cycle over again.

HUMINT-OSINT-Intel-Cycle

For a better understanding, I have created a fictive case (well, some of it is true…). Let us assume we are part of police special commission in Hamburg focused on the Albanian mafia. The recent shooting of an Albanian national and member of the local Hells Angels, with ties to the Albanian mafia, caused an upstir among different mafia groups operating in the area. So far, no information has emerged on the background of the shooting and existing police sources struggle to provide any intelligence on this topic. The Key Intelligence Questions (KIQ) are ‘What are the current activities of the Albanian mafia in Hamburg?’ and ‘Are there signs of an uprising conflict between different mafia groups?’

Therefore, our special commission has decided to attempt to win additional sources within this network of mafia groups. The higher leadership in a mafia network will not easily cooperate, so someone on the perimeter, with insight into the core, has to be found. Instead of the traditional approach on the streets, we will use OSINT to pave the way ahead of any physical approach.

This leaves us with our initial intelligence objective: Recruiting a HUMINT source within this network to answer the KIQs. Before we start our hunt for sources there are a couple of things we need to know. Who are the key players, do they have nicknames? We should have in-depth knowledge about our targets, e.g. is there target-specific behavior or a specific language used? Having this information gives us a baseline, which we can use to start our OSINT research. Our first step is to identify the known key players and their online profiles. Luckily, most of them are active on Facebook and Instagram and they like showing off their flamboyant life style. Clubbing, exotic cars, girls and champagne seem to be a vital part of the thug life in Hamburg.

Hamburg-Network

This chart depicts the results of the OSINT research on the core network of Albanian mafia in Hamburg, as it is visible on Facebook and Instagram. Now that we have found our potential intelligence targets online, we can survey their activities and figure out who is linked to them. There are many people surrounding this core network, so how can we identify someone who might be worth recruiting as a HUMINT source?

While reading comments to the pictures that these guys post, we stumble upon an individual who constantly idolizes the mafia leadership and their henchman und who frequently asks when he will be a part of ‘the inner circle’. ‘Soon’ is the most common reply and over the course of time he seems to get annoyed. Furthermore, a quick check in police databases reveals that he was registered  on minor crimes and was not yet linked to the Albanian mafia. Let us draw a quick conclusion: We have a person with a criminal record, who has contact to senior leadership of the Albanian mafia and is increasingly aggravated on the fact that he is not fully accepted in the organization yet. That sounds like a promising HUMINT source to me!

Keep in mind that this whole procedure, especially the actual HUMINT work done afterwards, takes time. No quick success will come from this. Once we have acquired the source and he is reporting from within the network, our OSINT work does not stop. Now is the time to evaluate the HUMINT information with OSINT. As we have already seen, our targets are very active on social media and this also applies to our source. If our source tells us he had met with one of the bosses on a specific date or time, it could be validated through a Facebook or Instagram post.

One day our source tells us, that in the aftermath of the shooting, the Albanian mafia leadership had met with Chechen mafia leadership the previous evening. At first, this seems unbelievable, as we had assumed that these two groups were currently opposed to each other. One of the Albanian leaders posted about this the following day on Facebook:

Hamburg-Meeting

This picture not only shows the Captains of the Albanian mafia, but also senior leadership of the Chechen mafia and our HUMINT source. We now know the meeting took place and we have the statement of our source on the topics of the meeting. It is vital that the source does not know we are tracking him and others on social media. We would not want any of this to be staged to back his statements and purposely give us false leads.

This short and fictive case shows how to use OSINT to enable HUMINT and to support HUMINT while an operation is ongoing. Of course, these techniques could also be applied by military HUMINT as well as journalists, as long as the targets and the potential sources are able to be located online.

OSINT supporting HUMINT: Another example of ‘Interdisciplinary Intelligence Preparation of Operations’, I2PO in short.

MW-OSINT / 03.09.2018

Using Strava in Law Enforcement Investigations

Strava is social network used to track athletic activities with wearables that has been fallen into disrepute in the past, because its Global Heatmap featured the ability to pinpoint military bases and patrols as well as covert locations of intelligence services, based on the aggregated user information. Initally, zooming into the heatmap would also reveal the profiles of individual athletes. That isn’t exactly how you imagine OPSEC.

This sparked a huge outcry, and several nation’s militaries subsequently banned the use of activity trackers. Strava also reacted promptly, updating the heatmap and ensuring that they “respect your privacy and share your concerns about the security of information you may submit to Strava’s websites”.

However, even after the updates made, it is still possible to harvest sensitive information from the data published by Strava. Strava informs users via their website that if the Enhanced Privacy Mode is toggled on, “your activities are still visible in public locations like the Flyby, group activity features, and segment, public club, and challenge leaderboards”. The means that profiles of individual athletes can still be accessed through segment leaderboards.

Now how can we use this knowledge for law enforcement investigations?

Imagine the following situation: The body of an unidentified male was found on July 18th 2017 near a pond named “Amphibientümpel” in the Forstenrieder Park in Munich. Initial crime scene investigations come to the conclusion, that the victim was murdered on site. The autopsy reveals that the victim had deceased during the afternoon of July 16th 2017.

The Forstenrieder Park is favored among athletes. Dozens of runners, hikers and cyclists use the trail next to which the body was found on a daily basis. Maybe one of them had noticed something suspicious on the day of the crime?

strava1

Law enforcement investigators trained in OSINT check the Strava website to see if the aforementioned trail is classified as a segment. It is and on the day of the crime, two top times were added to the segment’s leaderboard. Via this leaderboard the investigators are able to access the profiles of these athletes, including the names of both and also pictures they have uploaded.

strava2

One of these athletes uses Enhanced Privacy Mode, hiding the athletic activities on his profile from users. To view these activities he must give consent to individual users and allow them to follow him.

The other athlete publicly provides access to all his data. After all, he is using Strava to compare himself with other athletes. The investigators go through his activities and notice that the run listed in the leaderboard started at 16:59 p.m. In conclusion, he was in the vicinity of the crime scene at the presumed time of death.

strava3

The athlete uses his real name in his profile, which makes it easy for the investigators to find him and contact him for further questioning. The athlete was unaware of the crime as of now. However, he did recall seeing a small truck parked in between trees near the pond that afternoon. According to his accounts, the truck belonged to a local crafts business. Although he had initially wondered as to why the vehicle was parked there, he hadn’t spent any thoughts on it after the run. This clue was vital to commence further investigations and eventually led to an arrest.

The quintessence of the story: OSINT should be integral part of all investigations. In our case, OSINT provided a witness and this witness’ accounts led to solving this violent crime. Nonetheless, this requires skilled investigators…

Sebastian Schramm / 31.08.2018