detecting/honeypotting OSINT

Now we've had a lot of discussions about doing OSINT/other recon, but what about being on the other opposite side of it? Any ideas as to how to go about finding out if someone's trying find information about you/your stuff? I think this can really turn the tables and be very valuable to the blue team if implemented

Define open source. Is a portscan still OSINT?

>>22679 I was thinking of anything a motivated actor may do, not just OSINT. I'm assuming a lot of portscans are happening all of the time so that doesn't say I pissed off FPI more than it says that some Chinese or Russian crossdresser decided scan a chunk of the internet

>>22681 Then you might want to set up some suspicious open ports for typical insecure protocols, then look at what the potential attackers do there. Or if you are running a webserver, look at what dirbuster and other tools like that try to find and use some of those urls to make a honeypot.

>>22682 Well thanks for the suggestion. To clarify this weird idea I have is more about setting a trap for the attacker who wants to target you personally, like a three letter agency wanting to keep tabs on you (after you, I dunno, sell a ton of Monerinos, only ever use anonymous setups to debate waifus on the darknets instead of spyable normaluser tech, do shady-yet-legal stuff). If someone like that wanted to get YOU, presumably they'd first do some intelligence, try to find info, before actually trying to gain access to your personal soykaf. Which is where IMO it would be great to get a call home saying WIPE fuarrrkING EVERYTHING GTFO^C^C^C^ZMOVE TO HONG KONG WITH FAKE ID AND LIVE ON A FARM INNAWOODS. I'm not talking about trying to get random malware from random people, trying to secure a server that's for everyone to see. Sorry if this is too schizo I'm not really a real schizo and hopefully this has a real use case

Depends on what your threat model is. If you're trying to protect against foreign agencies, your local government or just random threat actors. In my case the most common threat actor is just random amateur criminals. I have found that trolling them is really fun. Check this out: https://github.com/paralax/awesome-honeypots The WordPress honeypots are hilarious. Most see it and think they are low hanging fruits and you can just see them break their heads on how to get in them. Then there's Hellpot (one of my personal favorites). It is meant to leave bots and crawlers looping by giving them fake entries in your robots.txt file. All non-existent urls get proxies through it and it makes the bots think that they are navigating an authentic webpage when all that's happening is that they are getting flooded with passages from the dawn of tragedy. Most of all just give out as many false positives to common tools to keep the script kiddies wasting their time. I have seen some servers that tell nmap that all ports are open when common scanning scripts are used against them which can be a huge pain in the ass. As far as osint goes I have given it thought before but I haven't found a good way of detecting it. What I would recommend is to create some ctf style rabbit holes with fake identities and send who ever is investigating you on a wild goose chase. I mean the possibilities are endless you can make a bunch of accounts with pics of the same person but each with a fake family and social circle and so on. Use these identities to post on forums asking questions about cars you don't even own. Make fake posts asking for rentals in neighborhood that you you've never been to. Etc, these are somethings I have done but I don't have a concrete way of verifying how effective they are. But I have my fun.

>>22675 https://www.canarytokens.org/generate Unique ones everywhere. Should work unless OSINTer renders offline AutoOSINT incoming traffic to servers. Tor exits and some IP blocks (gov/corpo/VPN/VPS/DC) are sus. Fingerprint traffic bc VMs also sus Also >>22748

>>22683 The classic says: > A good working assumption is that the NSA can read any message that it chooses, but that it cannot read all messages that it chooses. The NSA is limited by resources, and has to pick and choose among its various targets. Another good assumption is that they prefer breaking knuckles to breaking codes; this preference is so strong that they will only resort to breaking codes when they wish to preserve the secret that they have read the message.

>>22753 Was just reading through Extreme Privacy again and was coming here to say this because i remember some goober asking about it here and couldnt think of anything at the time “I would like to add one technique that I have found valuable for those desiring an aggressive approach toward monitoring situations where other people may be searching for details about them. Canary Tokens (canarytokens.org) offers an advanced way to monitor this behavior.This free service allows you to create a Microsoft Word document, among other options, including PDF files, which includes a tracking script within. Anyone who opens the document will unknowingly launch the script which will collect the user’s IP address, approximate location, operating system, and browser information” Excerpt From Extreme Privacy Just post a bunch of these tied to your name everywhere and profit

>>22675 Technically, with the cooperation of certain 3rd parties, it would be possible to catch some stalkers relatively easily. By posting fake doxxes online, someone can try ordering pizzas/sex toys/whatever to certain addresses. At this point you most likely have someone's IP address, which can be used to ask their ISP who used one in the given time and pay this person a visit. This is however restricted to either law enforcement or someone with a big influence on the society and local businesses. Wouldn't recommend doing that if normal conditions.