>> Hello and welcome to the last video
from the first module, Data Collections.
This video is fully dedicated for
leveraging OSINT in cyber threat intelligence contexts.
Another interesting data source that can be used for
threat intelligence is OSINT
>> or open source intelligence.
>> Let's see together its advantages, disadvantages,
the purpose behind using OSINT in threat intelligence
and some examples and real cases of using OSINT.
Open source intelligence is derived from data and
information that is available for general public.
It's not limited to what can be
found using Google search engine.
Of all the threat intelligence subtypes,
open source intelligence or OSINT
is perhaps the most widely used,
which makes sense because it is mostly free.
There is a great deal of
critical information available about
your adversaries and startling amount about you,
your organization, your assets,
and infrastructure, and all of
them are easily available by anyone.
Before deep diving into OSINT,
let's start with a quick definition.
Open source intelligence, mostly called OSINT
is defined by both the US Director
of National Intelligence and
>> the US Department of Defense
>> as produced from
publicly available information that is collected,
exploited, and disseminated in a timely manner to
an appropriate audience for the purpose of
addressing specific intelligence requirements.
Here, the important phrase to
focus on is publicly available.
When it comes to advantages and disadvantages of OSINT,
the main advantages are;
OSINT offer unlimited potential in any topic.
They are relatively with low-cost and
generally up-to-date and can be shared with anyone.
However, the main difficulty in
OSINT is that it
could be disinformation or simply inaccurate.
In other word, the sheave difficulty
is identifying relevant,
reliable sources that are from
the vast amount of publicly available information.
OSINT is used for multiple purposes.
One of these that I will start with is
called the dark side of open source intelligence.
Basically, the dark side of OSINT is
anything that can be found by security professionals,
can also be found by threat actors.
Threat actors use
open source intelligence tools and techniques to
identify potential targets and
exploit weaknesses in target networks.
Once the vulnerability is identified,
it is often an extremely quick and simple process to
exploit it and achieve a
>> variety of malicious objectives.
>> This process is the main reason why
so many small and medium-sized companies
get hacked each year.
It's because vulnerabilities in their networks or
website architectures
>> are found using simple OSINT tools.
>> In short, they are easy targets.
Open source intelligence doesn't only
enable technical attacks on IT systems,
because threat actors also seek out
information about individuals and
organizations that can be used
for sophisticated social engineering campaigns.
OSINT can not only leverage by
threat actors and here what concern us
the most is using
>> OSINT from a threat intelligence side,
>> or by a threat intelligence team.
For instance, threat intelligence teams use
OSINT for two main reasons.
First, they can identify
the organization's exposed attack surface,
and we will see this aspect in
more detail in the next slides.
Also, the second use case is to collect
any information that might be
available about your adversaries.
Briefly, from identifying
which new flaws are being actively
exploited to monitoring
threat actor communications about upcoming attacks.
OSINT enables security professionals to prioritize
their time and resources to
address most significant trending threats.
The main purpose of using OSINT to identify
your attack surface is to
>> be one step ahead of attackers.
>> There are plenty of
information that you can collect through OSINT.
For instance, you can collect a public
IP ranges associated with your organization,
and their open ports.
You can identify company domains and
subdomains and their associated certificates.
You can identify technologies that
are being used in your websites.
You can also find emails
of your employees and their phone numbers.
You can find also exposed servers or databases.
These are not the only things that you
can find using OSINT because you can
also find public documents that are not
supposed to be public and public
source code that can
expose passwords, credentials, tokens, etc.
Of course, another big source
of information is social media.
Another purpose of using OSINT
particularly as cyber threat intelligence team,
is that adversaries leave their evidence that
you can enrich to
create context and help decision making.
For instance, if we take the example of
a phishing campaign targeting your company,
adversaries will start with
delivering via email or send you
the malicious email containing
a malicious link or
>> directing to a credential theft page.
>> Here by applying OSINT on the malicious URL,
you can find their WHOIS records
that will help you identify whether
the website belongs to
the adversaries infrastructure or
is it probably a compromised website?
Here you will ask,
what's the difference here?
Your course of actions may
change according to these facts.
Also, monitoring social media like Facebook,
Instagram, Twitter, etc, Reddit,
forums can also help you to get
an overview of threat actors activities.
Now let's move to some examples of OSINT.
One of the most known OSINT sources
is called OSINT Framework.
OSINT Framework is a cybersecurity framework,
a collection of OSINT tools that are
created to make intelligence collection
easier for analysts.
It provides a simple web-based interface
that allows you to
browse different OSINT tools filtered by categories.
When you click on the categories,
such as username, email address, domain name,
a lot of useful resources will
appear on the screen in form of sub trees.
I really recommend visiting
and discovering the different tools
offered by OSINT Framework
through their official website.
OSINT also offer specific search engine
like Shodan, Censys and BinaryEdge.
Probably, Shodan is the most known that lets users
find specific types of computers like webcams,
routers, servers, etc connected to
the Internet using a variety of filters.
The same thing is offered by Censys and BinaryEdge.
These websites crawl the Internet
for publicly available devices.
Multiple threat actors use Shodan to identify
publicly available devices or
services with default configuration.
Censys can be also used
>> to find websites associated with
>> certain certificate IPs related to organizations, etc.
I believe it's worth adding a real case example.
Here I chose Shodan.
I tried to find the number of
exposed Elasticsearch instances and
Docker instances that are publicly
exposed through their open ports and product
Elastic for Elasticsearch instances
and product Docker for Docker instances.
Using the same technique to detect your weaknesses
is a highly recommended measure for companies,
and a way to stay aware of your attack surface.