1 of 35 © 2017 Association of Certified Fraud Examiners, Inc.

Advanced Online Investigations

Cynthia Hetherington, CFE, CII

President

Hetherington Group

Hetherington Group © 2017, all rights reserved.

Advanced Online

InvestigationsCynthia Hetherington, CFE, CII

• ACFE faculty

• OSMOSIS conference host

• ASIS educator

• Global OSINT presenter

• Author & publisher

• Analyst

• Security practitioner

• Investigator

• Tech

• Librarian

Cynthia is a…

Objective

• This exercise will help asset protectors focus their attention and sharpen their skills on utilizing social media and open-source searches effectively.

Poll #1

• How do you feel about your social media and open-source monitoring programs in place?

A. Confident

B. Better than the rest of them!

C. I silently worry that we are not doing enough.

D. What monitoring program?

Middle of the Road Is OK

• Being in the MIDDLE here means you’re aware that something needs to be done and you are thinking about this!

A. Confident

B. Better than the rest of them!

C. I silently worry that we are not doing enough.

D. What monitoring program?

• Social media is ever changing, and you can’t afford to be confident. Nimble is the only way to stay on top!

“Five-Finger Discount”

• Echosec popped 472 matches.

Poll #2

• What is your monitoring plan?A. We have in-house analysts/security pros monitoring our assets.

B. We sub this work out.

C. Public relations/communications does this and alerts us.

D. We don’t need a monitoring program.

Monitoring Awareness Is Now Necessary

• Answers A to C are excellent to OK.A. We have in-house analysts/security pros monitoring our assets.

B. We sub this work out.

C. Public relations/communications does this and alerts us.

D. We don’t need monitoring program.

• Beyond keeping your assets safe, this is also a tool for first response to incidents, a track record for compliance, and a management tool for fraud and reputation.

Alert Services: Free or Fee

FREE

• Google.com/alerts – Varied

• free.Echosec.net – S.M.

• Socialmention – S.M.

• Biznar – Varied

• Searchtempest – Auction

• Claz.org – Auction

FEE

• Enterprise.Echosec.net – S.M.

• Snaptrends – Social media

• Liferaft – Social media

• Cision Vocus – Social media

• Factiva – News

• Nexis – News

• ProQuest – News

Google.com/Alerts *

Auction and For-Sale Sites

• Amazon

• Craigslist

• eBay

• oodle

• Backpage

• Dark Web onion sites

Amazon

eBay

• Go to “Advanced Search” from the homepage, in upper right-hand corner.

• Choose “Find a Member” from the left-hand column.

Type in the first half of the

person’s personal email address.

For example:

crazybird@gmail.com

Type in “crazybird”

Check HR for the person’s

resume for old email addresses.

eBay

• Multiple results to explore!

eBay User ID History

Check out the new and exciting names!

Craigslist.com

• Ultimately, you will need to hunt and peck.

• Craig Newmark is one of the last hold-outs.

• Search strategy through Google.com:• Searchtempest.com *

• Site:craigslist.com <expression>

SearchTempest *

Precious Nuggets for Sale

Hit Me Up!

• OUTER LIMIT EXTRACTIONS

TEXT OR CALL ONLY 909-450-7405

Donations

King OG kush 45.00 A gram Crumble

PLATINUM BLUE DREAM MASTER KUSH 40.00 A GRAM CRUMBLE

PLATINUM MASTER KUSH 40.00 A GRAM CRUMBLE

CHERRY PRIVATE STOCK 30.00 A GRAM CRUMBLE

NO WHOLESALE

MUST HAVE REC AND VALID ID

TEXT OR CALL ONLY 909-450-7405

HIT ME UP 909-450-7405 TEXT OR CALL

Google That Number!

• 909-450-7405 = “909 450 7405”

• No dashes, parenthesis, backslashes, etc.

• Just spaces

• Scrutinize the results

Bingo!

Key Items

Address Search on maps.google.com

Address Search on maps.google.com

Address Age Progression

2007

2008

2012

2011

Back to SearchTempest

• You can add or minimize eBay and Amazon.

• Expand your search area by a local area or the world.

• Set up alerts for things you really want to know about in your area.• Third-row seats

• Drugs and contraband

• Human trafficking

• Terrorism, drug trade, or other nasty things

SearchTempest

Get the RSS Feed as an Alert

• You save your search as an OPML.

• File on your desktop. Open Google Reader

or Microsoft Outlook and

• Import that OPML File.

Claz.org for All Others

Backpage.com

Dark Web

• Start with Tor, or another anonymizing search engine.

• Search with torhiddenwiki.com or onion.city.

• Not a place to dabble.

• Don’t download or open files without having a virtual machine (separate cold computer) to view them.

• Have a strong stomach.

Onion.city : Puppies Search

Poll #3

• Can you friend individuals in closed accounts to see what they are up to?

A. Yes

B. No

C. I don’t know

Friending and Linking

• You’ve done your homework.A. Yes, who is going to catch us?

B. No, aren’t we breaking some law?

C. Best answer: When in doubt, don’t!

Hunting USER Profiles

• Finding profiles is straightforward if you follow these steps.

• Do you know their nickname already? • Check email addresses.

• Start with Google.• Search by “first last name,” and you will locate popular social media accounts.

• Use the following list of social media platforms, and add the username to the end.

• Pinterest.com/animal.

Looking for Matches Here: /username43 Things DailyStrength Fotolog Ibibo Meettheboss PokemanGo Streetlife We Heart It

About.me DeviantArt Foursquare Identi.ca Meetup (website) Poolwo Students Circle Network WeeWorldAcademia.edu Diaspora* Friendica Indaba Music MillatFacebook Qapacity StudiVZ Wellwer

Advogato Disaboom Friends Reunited Influenster MocoSpace Quechup StumbleUpon Wepolls.com

AsianAvenue Dol2day Friendster Instagram MouthShut.com Qzone Tagged Wer-kennt-wenAthlinks DontStayIn Fuelmyblog Itsmy Mubi Raptr Talkbiznow Wooxie

Audimated.com Doximity Gaia Online Jaiku My Opera Ravelry Taltopia WriteAPrisoner.comBebo Draugiem.lv GamerDNA Jiepang MyHeritage Renren Taringa! XINGBiip.no Dreamwidth Gapyear.com Kaixin001 MyLife ReverbNation.com TeachStreet XangaBlackPlanet Elftown Gather.com Kiwibox Myspace Ryze TermWiki Xt3Bolt.com Elixio Gays.com Lafango Nasza-klasa.pl ScienceStage The Sphere YammerBusuu Ello Geni.com LaiBhaari Netlog Sgrouples TravBuddy.com Yelp, Inc.Buzznet English, baby! Gentlemint Last.fm Nexopia ShareTheMusic Travellerspoint YookosCafeMom Eons.com GetGlue Late Night Shots Ning Shelfari Trombi.com YounowCare2 Epernicus GirlsAskGuys LibraryThing OUTeverywhere Sina Weibo Tsu Zoo.grCaringBridge Experience Project Gogoyoko Lifeknot Odnoklassniki Skoob Tuenti ZooppaClassmates.com Exploroo Goodreads LinkExpats Open Diary Skyrock Tumblr aNobii

Cloob Facebook Goodwizz Linkagoal Orkut Smartican Twitter aSmallWorldClusterFlunk Faceparty Google+ LinkedIn Partyflock SocialVibe Tylted deliciousCouchSurfing Fetlife GovLoop Listography PatientsLikeMe Sonico.com Uplike doubanCozyCot FilmAffinity Grono.net LiveJournal Periscope SoundCloud VK eToroCross.tv Filmow HR.com Livemocha Pingsta Spaces Vampirefreaks.com hi5Crunchyroll FledgeWing Habbo MEETin Pinterest Spot.IM Viadeo italki.comCucumbertown Flickr Hospitality Club MOG Plaxo Spring.me Virb mixiCyworld Flixster Hotlist Makeoutclub Playfire Stage 32 Vox tribe.netDXY.cn Focus.com Hub Culture Meerkat Playlist.com Stickam WAYN weReadDailyBooth Fotki IRC-Galleria Plurk Wattpad

Sum Up

• There are only penalties for avoiding social media and open-source investigations.

• Stay abreast of changes in the social media world.

• Work with your policy makers to address what is permissible for your investigators.

• Many vendors offer excellent products, but constantly question their abilities.

• Even more free resources and techniques that are equally efficient for asset protectors.

Questions?

#whoknew!

Hetherington Group © 2017, all rights reserved.

Thank youCynthiahetheringtonHetheringtonGroup@HetheringtonGrp

Cynthia Hetheringtonwww.hetheringtongroup.com

CH@hetheringtongroup.com

Email Paul@hetheringtongroup.comfor the latest deck slides & handouts

42 of 35 © 2017 Association of Certified Fraud Examiners, Inc.

Advanced Online Investigations

Cynthia Hetherington, CFE, CII

President

Hetherington Group