Rootconf 2019

In today’s age, when every organization has an online presence in multiple shape (eg. social media, code repositories, cloud infrastructure, etc.), it’s difficult to keep a track of the assets as well as the amount of sensitive information that goes out knowingly or unknowingly. Such assets or information can cause catastrophic damage to the organization, unless identified and remediated.

Examples of such data could be a legacy host running unauthenticated mysql, or a list of confidential subdomains leaking via Certificate Transparency, an anonymous read-only bucket serving images along with backup.tar, etc.

Since such issues can allow any attacker to compromise organization’s perimeter security, Security Teams should keep a very close eye on what information (about the organization) is being leaked out on the Surface as well as the Dark web.

This talk will discuss Open Source Intelligence (OSINT) Tools, Techniques and Procedures (TTP), that are highly useful and effective for Blue Teams in order to keep their perimeter security intact.

Outline

Below is an outline of the presentation:

• Overview of OSINT
• Why Security Teams should use OSINT
• Continuous Discovery and Monitoring of Assets
• Use OSINT Data for Periodic Attack Simulation
• Discovering Sensitive Information Leakage
• Monitoring Breached Passwords
• Proactively Identifying Security Incidents using SOCMint
• OSINT Countermeasures

Speaker bio

Shubham Mittal is co-founder of @RedHuntLabs and is an active Information Security researcher with 7+ years of experience in Pentesting, OSINT and Perimeter Security. He has worked both in offensive as well as defensive security roles. He is a BlackHat Asia Review Board Member and has spoken/trained at multiple conferences including BlackHat, NullCon, HackMiami, c0c0n, etc. He is the author of OSINT Framework - DataSploit (listed in Top Ten Security Tools of 2016) and is co-founder of @Recon-Village which runs @DEFCON Vegas and China. He works from the command line, uses vi and loves beer.

Links

• Previous Session (Example): https://www.slideshare.net/reconvillage/empowering-red-and-blue-teams-with-osint-c0c0n-2017 (This was for a mixture of Red and Blue team, but more focused towards Red Teams).