Want to improve your OSINT skills while being a horrible person? Try speed runs on public transit before the next stop.
Open AirDrop and pick your mark. I see 5% using First & Last name for their device name. Quite a few C-Suites around here.
Then... 1/n
Open AirDrop and pick your mark. I see 5% using First & Last name for their device name. Quite a few C-Suites around here.
Then... 1/n
...then use the info to find what you can. Pics of them, their spouse, kids, pets, etc. Then standard OSINT game, but you only have a few minutes between stops.
Now AirDrop the find to your mark. The image is displayed on their phone whether they accept or not.
but... 2/n
Now AirDrop the find to your mark. The image is displayed on their phone whether they accept or not.
but... 2/n
...but you can also add text overlay if you want to combine info for added effect. "Should we stop at Donna's again for her turkey dinner?"
"Make sure to get Timmy after soccer practice, 7pm!"
or... 3/n
"Make sure to get Timmy after soccer practice, 7pm!"
or... 3/n
...or maybe you have a series of OSINT finds. You can try to slide a phishing image on top of the image deck. I've found a lot of people will accept this image. Be sure to change your own device name to something helpful!
and... 4/n
and... 4/n
...and maybe once they accept you want to take a victory lap. (Ooor you could just airdrop them a link to instructions for reducing their public data leakage.)
Lots more can be done here. OSINT goes much deeper, devices are leaking other types of data, & so are people.
5/n
Lots more can be done here. OSINT goes much deeper, devices are leaking other types of data, & so are people.
5/n
6/n. If you like this, check out @HydeNS33k. She does fun OSINT. A good example is her coffee shop hunting:
7/n. I wish I could share the real attempts on here, but I don't want to post people's names and pictures. If you physically identify the person, there is more info to be pulled and abused.
Or you can start crossing passengers. Send A's face to B's phone, then wait...
Or you can start crossing passengers. Send A's face to B's phone, then wait...
8/n. There also seems to be no rate limiting on AirDrop, at least meaningfully. So it might be hard to google "how do I turn off AirDrop on the hidden-menu-dumpsterfire that is iOS 11" or really anything else on the phone.
9/n If all you have is a name, you can get the person to visually ID themselves with the right image. Then you have all the work branded clothing and exposed badges (with name) to work with.
90% success rate on this one.
90% success rate on this one.
