Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Thieves Are Using Open Source Intelligence
Transcript
- Lucas: If these conversations are useful for what you're building or running, I think the real story today is about how open source intelligence — OSINT — is actually being weaponized by cybercriminals. Luna: OSINT — that's the practice of collecting information from publicly available sources, right? Like social media, news articles, public records. Lucas: Exactly. And the key word is 'publicly available'. No hacking, no stolen credentials. Attackers are using the same techniques that journalists, researchers, and even stalkers use — to plan highly targeted breaches. Luna: So it's not about exploiting a vulnerability in software. It's about exploiting the fact that companies and their employees share too much information online. Lucas: Right. Let me give you a concrete example from earlier this year. A mid-sized healthcare firm in the Midwest got hit by a ransomware attack. The attackers demanded three million dollars. The investigation revealed that the initial access came from an OSINT operation. Luna: What did they find? Lucas: The attackers scraped LinkedIn for employees in the IT department. They found the network administrator's profile, which listed his certifications and his involvement in a local tech meetup. Then they cross-referenced his Instagram — he had posted photos from a vacation in Mexico, tagging the resort and the dates. That told them the office would be lightly staffed. Luna: So they knew exactly when to strike. Lucas: But it gets deeper. Using a tool called theHarvester, they pulled email addresses associated with the company domain. They found a forgotten subdomain that still hosted a login page for a legacy VPN. The page was indexed by Google. So they didn't even need to scan the network — Google did the reconnaissance for them. Luna: And that's all legal? Scraping public data? Lucas: Technically yes. The data is public. But using it for malicious purposes is obviously illegal. The point is, the barrier to entry is incredibly low. Anyone can learn OSINT from free tutorials on YouTube. Luna: I've heard of 'Google dorking' — using advanced search operators to find exposed information. That's part of OSINT too, right? Lucas: Exactly. For example, you can search 'filetype:xls site:example.com confidential' and find Excel files that were accidentally left accessible. Or 'intitle:index of' followed by a directory name to browse open directories. These aren't hacks — they're just clever queries. Luna: And attackers use that to find database dumps, configuration files, even credentials in plain text. Lucas: Right. Now, the interesting thing is that OSINT isn't just for initial access. It's also used for social engineering. Once they have a list of employees, they can craft spear-phishing emails that reference real projects, real vendors, real conferences. The victim thinks it's an internal message. Luna: So the traditional advice — 'don't click on suspicious links' — becomes nearly useless when the email looks completely legitimate because it's built from real data. Lucas: Exactly. And this is where the defense side comes in. What can security teams do? First, they need to understand their own digital footprint. That means running OSINT against their own organization — the same way an attacker would. Luna: Penetration testing companies offer that as a service. They call it 'external reconnaissance' or 'attack surface management'. Lucas: Yes. And there are tools that automate this. But a lot of companies still don't do it. They focus on patching vulnerabilities inside the network, but they leave the front door wide open. Luna: There's also the human element. Should companies have policies about what employees can post online? Lucas: They should. But it's tricky. You don't want to be the company that tells people not to have a life. But you can educate them: don't post your badge photo, don't share your work schedule, don't mention specific software versions you use. Attackers piece together small clues. Luna: It's like a puzzle where each piece is harmless on its own, but assembled, it reveals the whole picture. Lucas: That's exactly it. And there's another layer: data brokers. Companies that scrape public data and sell it. Attackers can buy employee lists, contact info, even inferred interests for pennies per record. Luna: So one practical step is to request data removal from those brokers. There are services that automate that. Lucas: Yeah, and some states now have laws that make it easier — like California's Delete Act. But it's still an ongoing battle. Luna: I want to circle back to something you mentioned earlier: the forgotten subdomain with the VPN login page. How does something like that get forgotten? Lucas: It's incredibly common. Companies spin up test environments, dev servers, marketing landing pages. They get used for a project and then abandoned. Nobody remembers to take them down or secure them. Attackers love that. Luna: So part of the solution is asset inventory — knowing every internet-facing system you have. Lucas: Exactly. And that's hard for large organizations. But if you don't know what you have, you can't defend it. And by the way, this is where threat intelligence feeds come in. Some security vendors now offer OSINT feeds that alert you when your domains or IPs appear in scraped data. Luna: So you can get a notification if your employee credentials show up on a paste site, or if a new subdomain is discovered. Lucas: Right. The key is to make it a continuous process, not a one-time audit. Attackers are constantly scanning. You need to be monitoring your own exposure. Luna: And if today was actually useful to you, the way these stay ad-free is listener support. You can buy me a coffee at buy me a coffee dot com slash fexingo. It helps us keep digging into these topics. Lucas: Yeah, seriously. Even a small contribution goes a long way. No pressure, but if you find value, that's how we keep it sustainable. Luna: Alright, back to OSINT. One more thing I want to cover: the ethical side. Is OSINT always used for bad? I mean, security researchers use it too. Lucas: Absolutely. In fact, most penetration testers rely heavily on OSINT. They find exposed data and report it to the company. That's the white-hat side. Also, journalists use it to uncover corruption. Activists use it to hold power accountable. Luna: So it's a double-edged sword. The same techniques that protect us can also be used against us. Lucas: Exactly. And that's why awareness is so important. If you know how OSINT works, you can take steps to minimize your footprint. Not just as a company, but as an individual. Luna: So what's the one thing you'd recommend every business do this week to reduce their OSINT risk? Lucas: Run a Google dork against your own domain. Search 'site:yourcompany.com filetype:pdf confidential' or 'site:yourcompany.com intitle:index of'. See what comes up. You'll be surprised. And then remove or secure anything that shouldn't be public. Luna: That's a simple, concrete step. And it costs nothing but time. Lucas: Right. And from there, you can build a more comprehensive program. But start with that. It's the lowest-hanging fruit.