social media self-defence and privacy workshop · 2018. 5. 20. · adversarial success •...

Social Media Self-Defence

and Privacy Workshop Ed Yuwono - CryptoAustralia

Who am I?

• Information Security strategist (by day)

• Director of Strategy CryptoAustralia (by

night)

• Blue Team/Defensive background

• Based in Europe

• Perpetual Traveller

Social Media Self-Defence and Privacy Workshop | OIC Qld PAW May 2018 | Ed Yuwono 2

Disclaimer

• Please, please, please don't use

material from this workshop to

violate moral, ethical & legal norms

• Views presented within are my own


Agenda/Objectives

• Social Media Privacy Basics

• Threats to privacy

• Defensive options in everyday life

• Q & A


In case you missed it


What does Zuck have to say?

• Source (April 10th 2018):

https://www.washingtonpost.com/news/the-

switch/wp/2018/04/10/transcript-of-mark-zuckerbergs-senate-

hearing/


Basic privacy tenets

• Individual: your physical and non physical traits (eg:

memories, emotions, secrets)

• Privacy protects your traits

• There is no 'undo‘, a disclosed secret is perpetually

public

• Privacy important enough for the EU to declare as a

basic human right


Speaking of EU GDPR…

• Apr 19th

• https://www.theguardian.com/technology/2018/apr/19/facebook-

moves-15bn-users-out-of-reach-of-new-european-privacy-law


No ‘one size fits all’

• Some of you:

• would like to remain private

• maintain a reputation in the workplace

• require a public presence

• Strike a balance between personal life and your public image

• Protect your

• Assets

• Reputation

• Right for privacy


Defending against levels of ‘adversary’

• Curious minds

• Bad software apps/Artificial Intelligence

• Unethical/immoral practices

• Declared Enemies

• Illegal acts

• Nation states

GOODBAD


Your adversary's motives

• Progressing to an age where wealth is:

• No longer physical

• eg: cash vs card vs crypto currencies

• Generated from information ‘on tap’

• eg: online ‘everything’: research, trading, betting,…

• Your personal worth

• Tangible: financial

• Intangible: knowledge, status, reputation

• What happens to you if your adversary steals, disputes, manipulates, block access to your information?


Adversarial Success

• Success=ability to execute to completion

• Ability to execute=capability x resources x time

• Attainable knowledge (capability)

• Cheaper computing power & access to

information (resources)

• The side with the most motivation & time will win

• However, if you can exhaust one or more of

the three elements, life will be hard for your

adversary


Knowledge is power

• You can deduce someone's:

• Social status

• Personal, Social, Public

• Reputation

• Social, Public

• Net worth, purchasing potential, risk appetite

• Personal, Public, Location

• Movement

• Personal, Location


The Age of Social Networks

• Provide opportunity for data enrichment

• Open Source Intelligence (OSINT) is a

discipline

• Case study


Who is watching the watchers?

• Apr 19th

• https://www.bloomberg.com/features/2018-palantir-

peter-thiel/


I have nothing to hide

• Apr 19th

• https://www.bloomberg.com/features/2018-palantir-

peter-thiel/


Ground Rules

• Don’t feed the system (use archives/takeouts)

• Look for

• Personally Identifiable Information (PII)

• Name, phone, address, work, gov ID, financials

• Passwords/password reset messages!

• Expletives

• ‘Not Safe For Work’ (NSFW)

• Anything personal/incriminating

• Tested with a browser, might work with a mobile app

• Small pauses


Countermeasures: Prevention

• Behaviour: If it’s something you can’t say

on TV, don’t post it

• Platform: Check and cover any holes

you might expose


Triage

• ‘Stop the bleeding’

• Revisit what you have posted

• Remember, not one size fits all

• Find your balance

• Search & destroy: selective delete

• Nuke: wipe everything (sometimes easier to

delete account)


Remediation

• Someone is using your information

• Horse has bolted

• Limit further damage

• Legal

• Procedural


LinkedIn: Prevention

• This is your professional persona

• Assume your work colleague is looking

• Manage your passwords!!!

• Got an account before 2012?

• Have I been pwned

• https://haveibeenpwned.com/



• Import your contacts – think twice

• Web/Mobile app

• Are you using a personal/BYOD phone or personal email address?

• Avoid importing your email/phone contacts

• Spammy, sends out invites to everyone it discovers!

• Working in a sensitive role?

• Stay off LinkedIn/all social media

• Use an alias

• Your employer may have policy or guidelines



• Settings & Privacy-Account:

• Removing email/phone numbers

• Microsoft (Applications)

• Permitted Services (Applications)

• Settings & Privacy-Privacy:

• Edit your public profile (Search engines)

• Who can see your Email address

• Who can see your Connections

• Last name

• Representing your organisation (company policy?)



• Settings-Privacy (continued):

• Profile visibility off LinkedIn

• Manage Active Status

• Discover from email/phone number (FB did this!)

• Sync contacts

• Others:

• Profile

• Contact Info-Date of Birth-Visible to: Only you


LinkedIn: Triage

• Takeout

• Interesting items

• Ad Targeting

• Connections

• Comments

• Imported Contacts

• Logins

• Messages

• Receipts

• Registration

• Search Queries

• Security Challenges

• Job Applications


LinkedIn: Triage

• Social Profiling

• Connections

• Name, Email, Company, Position, Connected date


• From your email or phone contacts!

• Name, Company, Title, Email, Phone, Created, IM handle, Address

• Messages

• From, To, Date, Subject, Content


LinkedIn: Triage

• Public Profiling

• References

• Endorsements

• Comments

• Group comments

• Group Posts

• Likes

• Shares

• Articles


LinkedIn: Triage

• Personal Profiling

• Profile

• Ad Targeting

• Ads Clicked


• Messages

• Search Queries

• Applications


LinkedIn: Triage

• Location Profiling

• Logins

• Profile

• Receipts

• Registration

• Security Challenges


LinkedIn: Triage


• My Network-’See All’-Manage synced and

imported contacts-Imported

• https://www.linkedin.com/mynetwork/contacts/imported

• Select All-Delete (This does not delete your

connections, only information stored on

LinkedIn)


LinkedIn: Triage – Search & Destroy

• Posts/Comments/Likes

• Me-Posts & Activity-Posts or All Activity

• Messages

• Search for person and delete thread

• Deletes entire thread!

• https://www.linkedin.com/help/linkedin/answer/420/deleting-a-conversation


• Jobs-Applied Jobs-Delete Job


LinkedIn: Triage – Search & Destroy

• Search History

• Click in Search bar

• Wait

• Click on ‘Clear’


LinkedIn: Triage - Nuke

• Close your Linkedin Account

• Me-Settings & Privacy-Account-Account

Management-Closing your LinkedIn

Account

• https://www.linkedin.com/psettings/account-management/close-action-needed

• You must downgrade to the Basic plan first

• If you paid, you lose your credits


Facebook: Prevention

• Your personal persona

• Exception: people in the personal/lifestyle

industry

• eg: fitness, home, health, etc

• A higher level of engagement is required

• Test: if you can’t say it at work:

• Don’t post it or

• Lock down your profile



• View As

• Different view of your profile

• Public

• Friend (View as specific person)

• Profile-…-View As…

• Default: Public…could see a lot!



• Lock down your public profile

• Settings-Privacy



• Location

• VPN

• TOR

• Browser

• https://www.torproject.org

• FB

• https://facebookcorewwwi.onion

• Apps!

• Security-Apps & Websites


Facebook: Triage

• Old Takeout


Facebook: Triage

• Takeout


• Just about everything

• Extract and open index.htm

• Activity Log

• Everything you did on Facebook!

• Profile-View Activity Log or

• Settings-Your Facebook Information-Access your information


Facebook: Triage

• Are you affected?

• https://arstechnica.com/information-technology/2018/03/facebook-scraped-call-text-message-data-for-years-from-android-phones/


Facebook: Triage


• Photos/Videos

• People who like/comment

• Friends

• Date connected

• Messages

• Lots of info

• Events

• Events you attended


Facebook: Triage


• Posts

• Photos

• Videos

• Comments

• Likes/Reactions

• Posts & Comments

• Groups

• Events (Public)

• Public profile

Information

• Your places


Facebook: Triage


• Profile

• Timeline

• Posts

• Photos

• Videos

• Comments

• Likes/Reactions

• Groups

• Events

• Personal profile information

• Your places

• Other Activity-Pokes

• Friends

• Ads

• Search history

• Location history

• Messages

• Saved items

• Apps


Facebook: Triage


• Deep dive –

Everything about you

• Ads Interests

• Advertisers who've

uploaded a contact

list with your

information

• Search History

• Location History

• Calls and messages


Have you been scraped?

Facebook: Triage


• Profile (Address)

• Photos (Phone/IP)

• Videos (IP)

• Events (Event Locations)

• Your places (GPS)

• Location history

• Security and login information (Time/date, IP, Browser, Carrier, GPS Location)


Facebook: Triage – Search & Destroy

• Activity Log

• Profile-View Activity Log-(Filters)More-

Security and login information

• Review and delete as appropriate

• Use filters to help with deleting

• You can’t:

• Delete tracking information

• Modify Ad information



• Messages

• Delete any sensitive information

• Contact details

• Financial

• Medical

• Legal

• Use your archive to search!



• Search History

• Click in search bar-Edit-Select ‘Edit’ next to

the search-Delete (select searches) or

• Clear searches (all searches)


Facebook: Triage - Nuke

• Deactivate

• Temporary

• Delete

• Permanent

• Settings-Your Facebook information-Delete

your account and information


Google: Prevention

• Your private persona

• Don’t mix work and play

• Lock it down tight and don’t share

• Is it necessary?

• My account-Personal info & privacy

• Date of birth

• Gender


Google: Prevention

• My Account-Personal Info & Privacy-My Activity-Activity Controls

• https://myaccount.google.com/activitycontrols

• Web & App Activity


• Device Information

• Voice & Audio Activity

• YouTube Search History

• YouTube Watch History


Google: Prevention

• My Account-Personal Info & Privacy-Ad

Settings

• https://adssettings.google.com/


Google: Prevention

• Apps!

• My Account-Sign-in & security

• https://myaccount.google.com/security#connectedapps


Google: Triage

• Google dashboard

• Maps

• Search

• Android

• Calendar

• Chrome

• Contacts

• Drive

• Play

• YouTube

• Plus

https://myaccount.google.com/dashboard


Google: Triage

• Takeout


• Just about everything

• Extract and open

index.html

• Mail

• https://www.thunderbird.net

• Activity Log

• Everything you did on

Google!

• My account-Personal info &

privacy-My Activity


Google: Triage


• Google +

• Google Photos

• Groups

• YouTube


Google: Triage


• Google +

• Google Photos

• Groups

• YouTube

• Like/comment


Google: Triage


• Bookmarks (If synced

with Chrome)

• Calendar

• Contacts

• Drive

• Google Photos

• Groups

• Hangouts

• Keep


• Mail

• Maps

• My Activity

• My Maps

• Tasks

• YouTube

• Search History

• Apps


Google: Triage


• Deep dive

• Ads

•Ads Personalisation

• https://adssettings.google.com/

• Emails

• My Activity

• Search History

•Google Trips


Google: Triage


• Google timeline

• https://www.google.com/maps/timeline

• Calendar (Addresses)

• Contacts (Addresses)

• Location History (GPS)

• Maps (your places) (GPS)

• My Maps (GPS)


Google: Triage – Search & Destroy

• Create offline backups using takeout

• …then delete material

• Search offline package

• Gmail

• older_than:1y or older:2017/01/24

• https://support.google.com/mail/answer/7190



• All services

• My Account-Personal Info & Privacy-My

Activity-Delete activity by…

• https://myactivity.google.com/myactivity



• Google Timeline

• Delete any sensitive locations

• Go to the date then delete


Google: Triage - Nuke

• Delete Products

• My Account-Account Preferences-Delete

your account or services-Delete Products

• Delete Google Account and data

• Permanent


Twitter: Prevention

• Your public persona

• Privacy and safety

• Protect your Tweets

• Emergency Lockdown

• Tweet with a location-Untick

• Discoverability

• Let others find you by your email address-Untick

• Let others find you by your phone number-Untick


Twitter: Prevention

• Privacy and safety, continued

• Personalization and Data-Disable all

• Twitter for teams

• Only allow people you follow to add you to their team

• Send/Receive read receipts-Untick


Twitter: Prevention

• Apps!

• Settings-Apps

• https://twitter.com/settings/applications


Twitter: Triage

• Takeout

• Extract and open

index.html

• Beware: not entirely

offline!

• Use CSV version

• No messages

• Offline Search!!!


Twitter: Triage


• Followers

• Following

• Likes


Twitter: Triage


• Tweets

• Retweets

• Likes


Twitter: Triage


• Tweets

• Location

• Messages

• Device

• Ads

• Advertiser list

• Or DIY!

• https://github.com/x0rz/tweets_analyzer


Twitter: Triage


• Location

• Device

• PC, night, regular patterns-static location?


Twitter: Triage – Search & Destroy

• Create offline backups using takeout

• Search using takeout search

• …then delete material

• If you can’t say it in public, delete it


Twitter: Triage - Nuke

• Deactivate

• 30 Days before delete

• https://twitter.com/settings/accounts/confirm_deactivation


Remediation

• Procedural

• Report a privacy violation

• Video/Photo

• Cheaper option

• Requires time!

• https://www.linkedin.com/help/linkedin/answer/146

• https://www.facebook.com/help/1561472897490627/

• https://support.google.com/legal/troubleshooter/1114905

• https://help.twitter.com/en/rules-and-policies/twitter-report-violation


Remediation

• Procedural

• Report a fake profile

• Could be used for ‘misrepresentation’

• Cheaper option

• Requires time!

• https://www.linkedin.com/help/linkedin/answer/61664/reporting-fake-profiles

• https://www.facebook.com/help/167722253287296

• (Google+) https://support.google.com/plus/troubleshooter/1715140

• https://help.twitter.com/forms/impersonation


Remediation

• Legal

• Mileage may vary

• Depends on legal jurisdictions

• $$$

• Lengthy

• Little protection against immoral/unethical

acts


Q & A

• Questions

• Email:

• Ed.Yuwono.MSISM <a t> gmail.com


THANKYOU


social media self-defence and privacy workshop · 2018. 5. 20. · adversarial success •...

Documents