There are two methods of data collection and information gathering used in military observation. Covert gathering refers to the use of clandestine, or secret data sources. As a result, covert methods are often illegal due to being performed secretively. Overt data collection refers to methods used openly or in plain sight. Overt does not involve the use of secretive methods and is generally not illegal. But what is Open Source Intelligence?
Open Source Intelligence is an overt method of data collection. Furthermore, publicly available resources are what distinguish OSINT from other forms of intelligence gathering.
How is Open Source Intelligence performed?
Open source intelligence involves gathering information from publicly available resources. There are six main categories to OSINT.
- The first is the use of public media sources. This category includes news reports, printed magazines, and newspapers.
- Internet is the second category and can include everything from online databases, social media, and search engine manipulation. In addition, it also includes online publications such as blogs and discussion groups.
- Category three involves the use of public government data. These sources include public hearings, budgets, directories, and publicly available government reports. Although included in public records, the data comes from official sources.
- Professional and academic publications is the fourth category. These sources include academic papers such as theses, dissertations, and journals.
- The fifth category is the use commercial data such as corporate databases, financial, and industrial assessments.
- The final category is the use of grey data. Grey data, or “hard to find” data includes business documents, unpublished works, technical reports, as well as patents.
What are the risks involved with Open Source Intelligence?
There are a number of tools available for performing Open Source Intelligence. Exploits exist for manipulating public records and search engines such as Google Dorks. Open-source software to streamline and automate this process is widely available online. Tools such as Shodan and The Harvester come pre-packaged in Kali Linux. Websites exist for the sole purpose of exploiting databases and searches.
The main risk involved with practicing OSINT is data overload. The rapid increase and collection of data, called “information explosion,” can cause an overload of information. Interpretation can be stalled if there is too much information to sort through. In addition, corporate or industrial espionage can result from certain forms of OSINT. Espionage is highly illegal and can result in fines, imprisonment, or both. In extreme cases, acts of treason can occur through the use of OSINT.
Implications to cybersecurity
Open Source Intelligence has many practical applications. However, Social Engineering hackers employ OSINT to research their target prior to an attack. Pretexting requires extensive research prior to setting up the attack. A pretexter will use OSINT to gather extensive information about the target. Impersonation is another form of pretexting that requires extensive research. Cyberstalkers and bullies use OSINT to monitor, track, and exploit their victims.
Doxing is the practice of researching, gathering, and publishing information via the internet. This is used to expose their victims as a means of humiliation. Open Source Intelligence can result in data breach or exposure of personally identifiable information on the internet. This can leave the victim wide open for cyber-attacks. Additionally, identity theft can result from such exposure.
There really is no way of protecting yourself from Open Source Intelligence. It is not in itself a form of hacking. But rather, hackers use OSINT as a tool for reconnaissance. Public records are the number one source for OSINT. Data will always be freely available as a result. The best advice one can give is to be proactive with what information is shared online. Perform regular searches to ensure what type of information is available.
Tags: Covert, Data Collection, Doxing, Google Dorks, Grey Data, Hacker, Hacking, Identity Theft, Kali Linux, Open Source Intelligence, Pretexting
