Category: Security online

Fake Profiles & Online Impersonation

When watching my local news the other evening, I heard of a case that really surprised me. A Town Commissioner of a small town in North Carolina, disagreed with his fellow board members over a specific topic. So much so, that he decided to create a fake Facebook profile and use it to harrass and argue with residents. Later, he admitted using a Charlotte area businessman’s real name & real profile picture. The surprising part of this is that we expect this from scammers, but not someone who would be sitting on a board of a city or town. It seems that these days, anything is possible. Being proactive is a must.

Online Impersonation Tricks

  1. Facebook Marketplace: Fake ads on the site have become a real problem. Some of the ads look like they are from legitimate businesses such as Home Depot, Lowes, etc.. They make the post look very real, using lots of pictures. The Better Business Bureau says the fake ads are common and they get thousands of complaints each year. “Impersonation is one of the key factors of what scammers love to do,” Sarah Wetzel of the BBB said. “They love to impersonate those well-known companies because that way they already have a foot in the door with the consumers.”
Source: Digital Information World

2. Rental Scams: Scammers ( who operate anywhere in the world ) can advertise a fake rental online. Next, they add a sense of urgency to attempt to get a deposit on the property. They will use excuses as to why they can not meet you in person. They also make sure to tell you that several people are looking at the property. Nationally, over 230 rental scams have been reported this year, up from the same time last year. Victims report losing an average of $550.

Better Business Bureau offers these tips:

  • Do an online search for the landlord’s email and phone number. If the same ad is listed in other cities, that’s a red flag.
  • If you can’t see the property in person, try to find someone you trust to go and confirm the unit is what’s being advertised online.
  • Don’t fall for deals that are too good to be true. If a unit is well below market rate or promising extra amenities than normal, it could be a red flag.
  • Be wary of required payments through cash transfer apps. Peer to peer apps are meant to be used with people you know.

Use the Better Business Bureau’s scam tracker as a tool to both report and prevent scam.

3. Catfishing: When someone creates a fake identity online for the purpose of starting a relationship. They then use this as a way to gain interest and confidence so they can scam the person out of money. Social Catfish is a software company that works to help people who believe they have been the victim of catfishing. It is one of the many software platforms we use at eChatter when conducting online research. They also have a great reverse image tool within the platform.

Impersonation of a Business

This is sometimes called Domain Spoofing. When done correctly, it can damage a business’ reputation while scamming consumers who fall for their pitch. All while impersonating the business. Two of the most common ways is cybersquatting and typosquatting.

  • Cybersquatting: Scammers use already established business websites and copy them to look just like the real website. They then sell counterfeit products.
  • Typosquatting: Scammers register a domain name similar to that of the legitimate business. They purposely use typo errors to change it but at first glance, people take it as the legitimate company’s website. This is sometimes used to redirect someone to a competitor’s website or try to collect ad revenue.

This just scratches the surface of the many ways scammers use the web and social media. It is a subject we will continue to write about in the future, so check back often for updates.

Adults Contacting Minors Online

Adults contacting minors online for the purpose of sextortion or meeting up for sex continues to be a big problem. Federal investigators believe there are more than 500,000 online predators active each day and they all have multiple online profiles. The ACM’s (Adults Contacting Minors) attempt to groom their minor victims, one step at a time.  They start by making a connection. Next, they spark conversation, and then try to lure them in by sending a provocative photo of themselves. For most, the end goal is to meet for sex. In some cases, they are satisfied by either video chats or even exchanging of photos. More than 50% of victims are ages 12 to 15 and 89% of victims are contacted by a predator through a chatroom and instant messaging.

Most ACM’s have a level of confidence in this because currently it Is underreported. There is a sense that the ACM is “anonymous” online with no way to find out who he really is. This makes it almost impossible to catch them. With the help of great organizations like SOSA (Safe From Online Sex Abuse), whose goal it is to raise awareness and combat abuse, they are making some headway.

Recently the organization created a documentary on this subject that every parent should watch. It is called Undercover/Underage.  Roo Powell is on a mission to expose the dangers of and prevent online child sex abuse. She works together with her nonprofit group, SOSA to set up aliases to engage with child predators.  She works with law enforcement and professionals in the field. Over the course of the documentary, Roo transforms herself into several 15–16-year-old personas. It is no easy undertaking to make 30-year old’s look (Roo) and act like a 15-year-old minor. However, she pulls it off. She has done her research and understands the behavior, likes/dislikes of an average teen.

Alias Creation (aka Sock Puppets)

  1. Setting up and creating a fake profile requires a lot of upfront work. Because this may lead to a video meeting or even an in-person meeting, everything must jive. Using the same username is critical across all platforms.
  2. Creating a community of “friends” to make the profile look believable.
  3. Photos – hiring a professional photographer who specializes in photo editing. The photographer in the documentary works in the fashion industry and is great at identifying and removing any age regressing features. The goal is to make her look like a teenager.
  4. The use of hashtags is very important. Teens will use hashtags – #freshman, #15yearsold, #mixedgirl, #daddyissue, etc. The more the better to get the right kind of attention online.

OSINT Work

One thing that I found to be interesting as I watched the documentary, is how the team used OSINT techniques every step of the way. They used the “Leave no stone unturned” strategy to try to ID the guy. In one episode, the ACM loved to talk about himself. He talked about his work history, his hobbies, the fact that he has 4 kids, etc. The team is shown searching all of it to connect the dots and find out information about this guy online. He’s a pro however- he knows what he is doing and is careful. Just one small little crumb could be enough to point them in the right direction. The average person has no idea how much information is housed on the web. It could be an old press release that has been forgotten about that names him. Or it could be an obituary of a deceased relative that includes the name of the ACM. Anything is possible and that is why it is important to take the time needed to search.

The group also uses Honey Pot computing to lure in the ACM. A honeypot is a decoy computer system for trapping hackers or tracking unconventional or new hacking methods. In this case it is being use as a lure to try to identify the ACM’s IP address. For this case, it is being populated with the teen girl persona’s photos, poetry, etc. On the backend of the site there is an activity log. This lists out the visitors of the site. From that IP address, one may be able to identify the location of the ACM, if they do not use a VPN of course.

Keeping Up With the Apps

It makes sense that teens are more inclined to use apps. Apps allow users to share photos and videos with their friends through their mobile device. The documentary mentions a few sites/apps you may not have heard of before.

  • boardgamegeek.com :This site’s database has more than fifty thousand board games along with their developers and players. The games themselves are linked to users through lists called GeekLists, along with owned/played/wanted etc. connections, ratings, reviews, session reports, and so on. It has a forum which has some search capabilities. Good to keep in mind if your subject is a gamer. Search by location and then by name.
  • Online chat groups, Message apps, Gaming apps, make it easy for a predator to make a connection with a minor online. Interactions can easily escalate to “sextortion”, in which minors are coerced into sending explicit imagery of themselves. According to a New York Times recent article titled, “How to Protect Your Children From Online Predators”, the following are the ones to watch closely

In summary, the team uses outstanding critical thinking skills along with online research to try to identify the ACM’s. Some fall through the cracks, but in some cases, she does provide enough evidence to law enforcement to “take it from there”. It is not an easy task, and it really takes a thick skin and a strong stomach. Some scenes show Roo emotionally drained from the experience of playing out conversations with child predators. But in the end, it is her deep desire to help the kids. If she can get one or two arrested, she has done what she set out to do.

Employee Fraud in the Digital Age

In today’s digital world, employee fraud and theft is up and can cost a company a lot of lost revenue. This is an area in which a Private Investigator can be be very valuable to a loss prevention department.

A recent article in the The Atlanta Journal-Constitution reported two employee fraud investigations.

“Home Depot just caught an employee who stole over 100K in electronic gift cards. “Said accused did, between January and November 2018, use his position as a Home Depot employee to send E-Gift cards to email accounts that he set up himself, or were provided to him from a third party, in the amount of $156,330 U.S. dollars,” the arrest warrant states.”

“A teenager was arrested after he was accused of stealing nearly $1 million from the Kroger store where he worked. According to police, 19-year-old Tre Brown created more than 40 returns for non-existent items in December and January, including lottery tickets that were never sold, spokesman Cpl. Collin Flynn said. Those returns, which ranged in price from $75 to more than $87,000, were then placed on several credit cards, investigators said.”

Benefits Pro, an employee benefit firm, recently published an article on the warning signs.

Employee Fraud Red Flags:

• An employee living beyond their means
• An unwillingness to share duties
• Being under pressure on the job
• Family problems or divorce
• Defensiveness
• Past legal problems
• Refusal to take vacations

According to Certified Fraud Examiners, a typical company can lose up to 5% annually to employee fraud. In fact, the Association of Certified Fraud Examiners conducted a study in 2018 titled, “Report to the Nations: 2018 Global Study on Occupational Fraud and Abuse.” The study included 2,690 known cases. Many do not get reported due to the stigma and bad public relations to the company itself.

The study goes on to reveal some other commonalities.

  1. The overall amount of loss by men is 75 percent larger than those caused by women.
  2. The most common way employee frauds are discovered is via tips.
  3. Internal control weakness is responsible for nearly half of frauds.
  4. Employees committing fraud who have been with their companies longer stole twice as much.
  5. Small businesses lost almost twice as much to fraud per scheme as larger ones.

Deep Web Research

If the investigator is looking for stolen merchandise, then the web is one of the best places to begin. Conducting a deep web search on a person of interest can provide a starting point. Details may emerge that will provide various emails, phone numbers and user names. Connecting the person with online social media groups, market places, Craigs List, and more may provide you an exact place where the stolen merchandise is being sold.

Auto Parts for Sale

We once worked on a scan for an Investigator whose subject was suspected of selling a very unique set of stolen auto parts. The employee had created an eBay account and made the mistake of using a familiar user name. After the user name was revealed in our Deep Web Scan, we turned our attention to the online websites that sell goods to consumers. We were able to piece this information to that of our client’s subject. A huge catalog of stolen auto parts were on display!

The internet has certainly helped employee fraud. With more avenues to sell stolen merchandise, it can be just the right kind of lure an employee needs to do the unthinkable.

Outdated POS systems, computer programs and data storage entry gaps can be additional areas of concern for many retailers. Being proactive is always your best approach to take away the temptation. Smaller businesses may not have the money for a loss prevention department. That is where a Private Investigator can be a valuable asset to your business, specifically one who deals in computer forensics.

Analyzing Social Media Posts

Analyzing social media posts is most likely something you don’t really do on a regular basis. Unless the case calls for it, there is not always a need for it. However, when there is, so much can be uncovered!

Don’t F**k With Cats: Hunting an Internet Killer

If you are a Netflix subscriber you may have seen this documentary. It is one of the best OSINT films out there. The documentary uncovers the months it took a group of online sleuths to reveal a real life killer. During the documentary it is revealed how helpful social media posts were in finding clues to the whereabouts of this criminal. It is graphic, so be forewarned. However, the diligence of these average people is noteworthy. It takes time to really dig and even when your subject leaves clues, it can be difficlut.

One scene in particular focuses on the street lights in a city. The subject posted a photo of himself in social media on a city street. One person recognized the style of the street lights and pinpointed them correctly as being in Ontario, Canada. She was correct, however it took so long to persuade the local police to believe her story, the suspect was already on to a new location.

It is also a great example of how important it is to really look at social media posts.

Social Media Post Threats

When scrutinizing social media posts, carefully look beyond the person in the post. Is there a computer screen or tablet that you can zero in on? What about a clock in the background? Cross reference this with the date and time of the post.

Photos of a person’s home can be important as well. Recently, we conducted a deep web scan on a person who was suspected of selling drugs from her home. We searched for a post that she may have forgotten about online that showed her with the drugs. While we did not uncover anything like that, because she had deleted it all, we did uncover something else.

She was showcasing herself in a very specific Reddit group that served as a an advertisement of sorts linking to an online porn site. In this case, she did not show her face on any of the posts. She did however, take all the photos in her bedroom. We were able to link her bedroom from her public Facebook posts to the bedroom from her Reddit posts. Since this was a child custody case, this was an important find.

Reverse Image and Exif Information

Where possible, reverse image searching and checking exif data can help provide additional information when investigating uploaded images. We explained in more detail what Exif data is in a recent post titled, “Where Was This Social Media Photo Taken?”

Reverse image can be done with a Google Image search or Bing Image search. Some paid versions are Tin Eye and Social Catfish.

The Dark Side of OSINT

After the horrific attack on U.S. Congress this month, many law enforcement people turned to photos on social media and the deep web to locate people of interest and to investigate further.

An article, “The Dark Side of Open Source Intelligence” warns to be careful when using this method.

“While the use of open source intelligence has been praised by law enforcement and investigative journalists for its crime-solving efficiency, public data can be dangerous when used in haste on social media. The speed that makes OSINT so effective as an investigative tool can also make its use more susceptible to blunders and bias. From terrorist attacks to protests and mass shootings, open source intelligence has led to inaccurate vigilante-style justice and the doxxing of innocent individuals.“

Like everything else online, some is real and some is not. Cross referencing for data accuracy is critically important.