copyright notice – use of webex login/password

COPYRIGHT NOTICE – USE OF WEBEX
LOGIN/PASSWORD FOR ACAMS WEB SEMINARS
Each site license entitles registrant to one login: one phone connection (if
accessing audio via teleconference) and one Internet connection for
simultaneous Webcast, in one room where an unlimited number of listeners
may participate.
Providing your login instructions and password to another for their use, using
your login ID/password more than once, or any simultaneous or delayed
transmission, broadcast, re-transmission or re-broadcast of this event to
additional sites/rooms by any means (including but not limited to the use of
telephone conferencing services or a conference bridge, whether external or
owned by the registrant) or recording is a violation of U.S. copyright law and is
strictly prohibited.
1
Conducting Internet Investigations
to Support Customer Due Diligence
Processes
November 3, 2011
Noon – 2:00 PM EDT
A sound check will be performed 5 minutes before the start time.
2
Technical Assistance
• Send a message via the Q & A box
• Or Call WebEx Technical Support:
(US & Canada) 866-229-3239 (International) 916-229-3239
Attendee instructions on how to use Audio Broadcast
• Do not close the Audio Broadcast panel
• If you are not able to listen to the audio on your computer speakers,
press the stop button, wait 5 seconds then press play.
• Make sure to adjust the volume button on your computer speakers and
also adjust the volume on your sound card. To do this, go to the Start
Menu, click Control Panel, then click Sound & Audio Devices and adjust
accordingly.
• If you do not have speakers, please refer to your login instructions for the
Teleconference Domestic and International Numbers and Access Code.
• You may request the Teleconference Number by clicking ―Request‖
under the attendee box on your left hand side.
3
• Can you hear the
sound check?
• It has begun
4
Conducting Internet Investigations to Support Customer Due Diligence Processes
To send a question:
• Locate the Q & A box on the bottom right
hand corner of the WebEx platform.
• Type in your question and click send!
5
Conducting Internet Investigations to Support Customer Due Diligence Processes
Conducting Internet
Investigations to Support
Customer Due Diligence
Processes
November 3, 2011
6
Speakers:
Michèle Stuart
Owner
JAG Investigations, Inc.
Denzil Fearon
Senior Investigator
New York State Police Computer Crime Unit
7
Conducting Internet Investigations to Support Customer Due Diligence Processes
Michèle Stuart
JAG Investigations, Inc.
8490 S Power Road #105-146
Gilbert, Arizona 85297
480-988-2580
Michele@jaginvestigations.com
8
Conducting Internet Investigations to Support Customer Due Diligence Processes
• Open Source Intelligence (OSINT) is an
information processing discipline that involves
finding, selecting, and acquiring information
from publicly available sources and analyzing
it to produce actionable intelligence.
•http://en.wikipedia.org/wiki/Open_Source_Intelligence
9
Conducting Internet Investigations to Support Customer Due Diligence Processes
FEE BASED DATABASES
• WWW.IRBSEARCH.COM
• WWW.USTRACERS.COM
• WWW.MERLINDATA.COM
• WWW.LOCATEPLUS.COM
• WWW.TRACERSINFO.COM
• WWW.FLATRATEINFO.COM
• WWW.SKIPSMASHER.COM
10
Conducting Internet Investigations to Support Customer Due Diligence Processes
FIRST THING FIRST
•
•
•
•
•
•
•
11
ALWAYS SEARCH DIRECTORY ASSISTANCE!
www.masterfiles.com
(pay)
www.internetda.com
www.whitepages.com (200 million)
New application: HIYA
A feature allows you to ask your contacts to provide missing information — for example if you only
have someone’s email address and want their phone number as well. This still works if your contact
isn’t a Hiya member. They’ll just get an email with a link, then they can submit information on the Hiya
website without registering themselves.
Of course, you can also pull contact data from WhitePages, and you’ll receive notifications when
WhitePages updates the listing for one of your contacts. (None of your private contact data will get
shared with WhitePages)
www.411.com
(show spouse / children)
Czech computer security software company AVG releases findings based on
data from its Community Protection Network, which it says represents the
majority of its 98 million active users world-wide
http://blogs.wsj.com/tech-europe/2011/10/13/androids-popularity-attracts-malware-authors/?mod=google_news_blog
• Android’s popularity makes it an increasingly attractive target for
attackers. Angry Birds Rio Unlocker is the most widely distributed
malware application that is luring Android users. According to AVG,
tricking Android users into downloading an application from both
Android market as well as lesser know third party app stores. ―We have
noticed a marked increase during 2011,‖ AVG said. ―Malicious
applications are often masked as useful applications, games or adult
content.‖
• AVG said. "Malicious applications are often masked as useful
applications, games or adult content. Two examples of
• fake applications were fake versions of HandcentSMS and AngryBirds."
More than 50 Android apps found infected with rootkit
malware
12
www.dirtyphonebook.com
13
Alibinetwork.com
We Understand The
Delicacy of Real World
Personal relations and
can help you solve any
sensitive problems and
situations resulting
from them with a variety
of discreet services we
provide. Whether you
are interested in a
doctor's excuse note to
skip work, a virtual
seminar to hide your
discreet affair or need
us to place a discreet
phone call on your
behalf, we'll provide the
support you are looking
for.
14
Click this!
Hertz – another avenue
PUBLIC RECORDS
• Property records / Foreclosures
• Court records
- civil, criminal, family, probate, bankruptcy
• Licensing
- medical, real estate, contractors ect…
• Corporations / Partnerships / UCC’s
• Non Profits
• Political Contributions
• Dead beat parents
• Inmate searches / Warrants
• Traffic tickets
• News paper articles
16
I see dead people….We see YOU!
• Allison DuBois
• Married to Joseph
George DuBois
• Filed for a change
of name from…
• DuBois is an “alias”
17
Property Search – Tax Assessor
HOME ADDRESS!!!
18
19
Back to maricopa.gov
20
21
22
Additional Search Sites
www.brbpub.com/default.asp
(public records blog, new site info, upcoming seminars and
legislative issues)
www.publicrecordcenter.com
(updated hourly - Search billions of records through tens of
thousands of government and public links)
www.blackbookonline.info
(Post office box locator)
www.blackbookonline.info/bbo_poaddress.aspx
http://publicrecords.searchsystems.net/
www.virtualgumshoe.com/resources
23
Publicrecordcenter.com
24
TIME TO START PROFILING
The Internet – Where men are men, women are men and children are the FBI
25
Free Databases
•
•
•
•
•
•
•
•
•
•
•
•
26
Google.com
Bing
Zabasearch.com
aol.com
Copernic.com
Ask.com
Yahoo.com
Altavista.com
Alltheweb.com
Birthdatabase.com
411.com - not only telephone numbers anymore
Gigablast.com
Meta (Multi Dimensional) Search Engines
• Dogpile - searches all of the "big four" (Google,
Yahoo!, MSN, and Ask) simultaneously.
• Turboscout – the ―big four‖ plus 17 additional
search engines
• Zuula - which plows through 16 search engines at
a time for you.
• Infospace – searches Google, Bing, Ask, Yahoo
and Twitter
27
Basic Searching - GOOGLE
• Try the search with and without ―quotes‖
• Use whole name (may want to try using middle
initial depending on how common the name is)
• Search the name front and backwards
• If last name is uncommon… just search by the
last name
• If state is known run: ―first name last name‖ az or
arizona
• Can quote more than one search
• Lower case / Upper case
28
Simple Google Search
- You can’t control what others will post!
• Happy Birthday Allison DuBois
• by Sheila on January 24th, 2007
• Today is the real Allison DuBois’ birthday. She was born
in Phoenix, Arizona, January 24, 1972, which makes her
35 years old today.
• Happy Birthday to the woman who inspired our beloved
show Medium.
• Source / photo: phoenix.about.com
• Tags: allison dubois, medium, medium nbc, allison
dubois birthday
29
Veromi
30
Additional Avenues
• Craigslist
• Ebay
• YouTube
31
Surface Web to Deep Web
The term “invisible web” mainly refers to the vast repository of
information that search engines and directories don't have direct
access to, like databases. Unlike pages on the visible Web (that is,
the Web that you can access from search engines and
directories), information in databases is generally inaccessible to
the software spiders and crawlers that create search engine
indexes.
How Big is the Invisible Web?
In a word, it's humungous. Sources estimate the invisible, or deep,
web as being 500 times bigger than the searchable, or surface,
Web. Considering that Google alone covers around 8 billion
pages, that's just mind boggling.
32
Additional sites that search
both surface and deep web
• www.peekyou.com
• www.pipl.com
• www.123people.com
• www.whozat.com
33
Social Networking Data
Facebook
•
•
•
•
•
•
•
800+ million current users
50% of our active users log on to
Facebook in any given day
Average user has 130 friends
People spend over 500 billion
minutes per month on Facebook
#1 photo sharing app
25 billion pages of content (web
links, news stories, blog posts,
notes, photo albums, etc.) shared
each month
Approximately 6 Million user
groups
MySpace
•
•
•
•
•
•
223 million monthly users
1 out of 4 Americans on MySpace
14 Billion comments
1.5 Billion images
8 Million images uploaded daily
300,000 people sign up everyday
Quantcast estimates MySpace's
monthly U.S. unique visitors at 19.7
million as of May 2011.
On June 29, 2011, Myspace was sold to
Specific Media for US$35 million
34
http://webcache.googleusercontent.com/search?q=cache:TDJowv7ytwUJ:www.socialnetworkingwatch.com/all_social_networking_statistics/+myspace+statistics+users&cd
=1&hl=en&ct=clnk&gl=us
35
MySpace
36
Search Gang Names
Backgrounds… does it matter?
http://profile.myspace.com/289****
38
About me:
i'm not you're usual 20 yr. old male... i'm an aspiring rapper... and to those
of you who think that's funny, o well, that jus adds fuel to my fire. sounds
weird, but i like to jus get in my car and drive, just drive. it's such a calming
feeling. i don't know if this will come as a shock to the ppl that i alrdy talk to
on here or not, but i smoke... not cigaretts  I have a great job working for
as a sub-contractor for Time Warner Cable, I'm the guy that either shows
up REALLY early to hook up your cable or the F**** late cable guy... cuz I'm
blowed out my mind lol. I have an amazing relationship with my fiance
Nicky, if it wasn't for her I would have done somethin stupid, like ended up
in jail or worse. Now... I work pretty much everyday, and come home to the
most beautiful person ever. hmmmm, what else?? i like to make ppl laugh,
uhhhh... i'm not really ABLE to think of anything else right now, so if ya
wanna know more, jus ask bone
39
TO BRAG OR NOT TO BRAG?
Gun-toting Manhattan thief James Roberts gave detectives all they
needed to bust him: ill-advised crowing on his MySpace page a
day after he mugged a man at a Chelsea bus stop.
"This guy's boasting, 'I've got new bling!' " said a police source.
Roberts, 27, sealed his fate with pictures of himself and his ill-gotten
gain, which included an expensive watch and ring he swiped
from the victim at 10th Avenue and 25th Street in 2008.
'MUG' SHOT: This picture of alleged drug dealer Tyrell Blue on his
MySpace page helped prosecutors' case.
"He's sitting on the couch, and then there's a close-up of his hand
with the ring out," the cop said. "It's very distinguishable, with
blue and white stones."
Detectives showed the photo to the victim, who quickly identified the
stolen ring. Roberts and his cohort, Darryl Calier, were
convicted of robbery, and are serving five years each.
Prosecutors said Facebook revelations were "instrumental" in
busting up a ring of drug dealers who sold coke, ecstasy and
designer dope at nightclubs like Rebel and the Roseland
Ballroom last year.
40
Use in Court
Important!
41
42
Getting Around the invite:
• Find your subject
• View their friends
• Look for associations
• Do not interact with debtor
43
Facebook
44
•
•
•
•
•
About Me
Basic Info Sex: Male
Birthday: August 11, 1963
Relationship Status: Married to Carrie Wilson
Current City: Chandler, Arizona
Hometown: Chandler, Arizona
Political Views: Republican
Religious Views: Catholic
•
•
•
Work and Education
Employers Southwest Airlines May 1996 - Present Pilot
Phoenix, Arizona
•
College University of Arizona '83 Business Degree
•
High School - George Brown High
•
•
•
Contact Info Email: studpilot@+++.net Mobile Number: 6023**1232
Other (Home): 4808**9897
Home Address: 10697 E. Sunset Dr.
Chandler, AZ 85248
Embezzlement?
Workman’s Comp or
location?
Known associates?
Facebook can provide photographs
needed to prove certain situations.
45
TWITTER
• Twitter is a website where you can leave messages of up to 140
characters long for other people to read. Think of it as the online
equivalent of sending mobile phone SMS messages. The
messages will instantly appear on your page in the form of a
timeline (newest messages at the top going down to oldest at the
bottom).
46
47
48
Early Morning – Several tweets at @5:30am
Late night home
49
50
Denzil S. Fearon
• Member of New York State Police
Computer Crime Unit
• Senior Investigator
• State Police Member since 1993
• Supervise Computer and Technology
Related Investigations
51
Conducting Internet Investigations to Support Customer Due Diligence Processes
Computer Crime Unit
•
•
•
•
•
Started in 1990, expanded in 2002, 2006
Assist Local, State, and Federal Agencies
Securing of Digital Evidence
Processing of Digital Evidence
Computer Related Investigations
– Identity Theft
– Online Child Exploitation
52
Conducting Internet Investigations to Support Customer Due Diligence Processes
Computer Crime Unit
• Assist agencies with obtaining information
from online sources
– Search Warrants
– Bench Warrants
– Intelligence Investigations
– Criminal Investigations
53
Conducting Internet Investigations to Support Customer Due Diligence Processes
Conducting Internet Investigations to Support Customer Due Diligence Processes
Tools Available to LE
• Criminal History
• Subpoena
– Subscriber Information, basic log info
• Search Warrant
– Privileged Content, conversations
• Department of Motor Vehicles
– Vehicle Information, Drivers License Info
– Offline searches, Special Searches
54
Conducting Internet Investigations to Support Customer Due Diligence Processes
Tools Available to LE
•
•
•
•
Shiny Badge
Nice Vehicle
Pressed Uniform…
We have the luxury of acting under the
Color of Law...
• People will give us information just by
asking…sometimes…
55
Conducting Internet Investigations to Support Customer Due Diligence Processes
Challenges
• Not enough information to obtain Legal
Process
– Information obtained is old, obtained from an
unreliable source
– Certain entities unwilling to submit to legal
process…without a fight
• Newspapers, Privacy Advocates, etc…
– Prosecutor unwilling to give legal Process
• Misdemeanor Investigations, low amount of
criminal loss
56
Conducting Internet Investigations to Support Customer Due Diligence Processes
57
Conducting Internet Investigations to Support Customer Due Diligence Processes
Open Source Information
•
•
•
•
Great deal of information available online
Free information
Shows a person’s online footprint
Gives insight into a person’s activities,
interests
• Identifies friends, associates
• Generates leads
58
Conducting Internet Investigations to Support Customer Due Diligence Processes
60
64
Tax Parcel Information
• Many County websites offer Tax Parcel
information
– Business Information
– Owner of Residence
– Pictures of Residence
– Date of Purchase
66
Conducting Internet Investigations to Support Customer Due Diligence Processes
67
Conducting Internet Investigations to Support Customer Due Diligence Processes
Professional Licensing
• State and Local Government Websites
maintain information regarding
professional licensing
– Doctors, Nurses – Office of Professions
– Teachers – State Education Dept
– Security Guards – Department of State
68
Conducting Internet Investigations to Support Customer Due Diligence Processes
69
Phone Number Information
Phone Number Information
• http://www.fonefinder.net
• http://www.nanpa.com
71
Conducting Internet Investigations to Support Customer Due Diligence Processes
Social Networking Sites
• First gained prominence with Classmates
• Scores of different sites
– Myspace
– Facebook
– Adult Friend Finder
• Lots of different sites based on interest
74
Conducting Internet Investigations to Support Customer Due Diligence Processes
Wealth of information
• People are social animals
– Want to connect with friends, like minded
individuals
– Sometimes provide too much information
– Great tool in locating targets
75
Conducting Internet Investigations to Support Customer Due Diligence Processes
IP Addresses
• Many online websites log IP addresses in
postings
• IP address can let you know…
– Where a person is living
– Where a person works
– Type of cellphone, service
76
Conducting Internet Investigations to Support Customer Due Diligence Processes
MaxMind
http://www.maxmind.com
77
IP Address Check
• http://www.domaintools.com
• http://www.dnsstuff.com
• http://www.centralops.net
78
Conducting Internet Investigations to Support Customer Due Diligence Processes
79
Google
•
•
•
•
•
•
Stores an incredible amount of information
Not just web site information
Web Log (Blog) Postings
Newsgroup Postings
Website Postings
Google Ads
– Credit Card Information
80
Conducting Internet Investigations to Support Customer Due Diligence Processes
Advanced Searches in Google
• Click on the ―Advanced Search‖ Tab
• Information can be tailored to search
– Date
– Region
• Exact match – Use Quotes ―‖
• Use minus to exclude words
• Search with synonyms – Use tilde ~
81
Conducting Internet Investigations to Support Customer Due Diligence Processes
82
Google Search
• Ten word limit on search
• Try to use the most obscure word in your
search
– Regularly used words will generate false hits
83
Conducting Internet Investigations to Support Customer Due Diligence Processes
Google Translate
• Extremely powerful tool
• Translates Text, Websites
• Allows gathering of intel of foreign
individuals
84
Conducting Internet Investigations to Support Customer Due Diligence Processes
85
86
87
Conducting Internet Investigations to Support Customer Due Diligence Processes
TLO
•
•
•
•
•
90
www.tlo.com
Free to LE, pay service otherwise
Excellent access to public records
Created by inventor of Accurint
Similar to Accurint, Lexis Nexis
Conducting Internet Investigations to Support Customer Due Diligence Processes
Email Addresses
•
•
•
•
Take a look at the syntax of the address
Most email addresses are:
username@domain.com
The username could be used at different
domains (Yahoo.com, hotmail.com)
• How about the domain for their work?
• Google searches for email address,
username
92
Conducting Internet Investigations to Support Customer Due Diligence Processes
93
Uploaded Pictures
•
•
•
•
Show friends, associates
If you save pictures, check for Metadata
Date, time photo was taken
Sometimes Geolocation
– Latitude, Longitude
– Locate area of photo on map
94
Conducting Internet Investigations to Support Customer Due Diligence Processes
Conducting Internet Investigations to Support Customer Due Diligence Processes
95
96
Q&A
• Locate the Q & A box on the bottom right
hand corner of the WebEx platform.
• Type in your question and click send!
97
Conducting Internet Investigations to Support Customer Due Diligence Processes
If you have additional questions for today’s expert,
please send them to
training@acams.org
Thank you for joining us today!
98
Conducting Internet Investigations to Support Customer Due Diligence Processes
Web Seminar Certificate of Attendance
To request a certificate of attendance, please fill
out the request form, found in your reference
materials, and email the form to info@acams.org
along with your payment information. First
certificate is included in cost of seminars. There is
a $40 administrative fee for each additional
certificate.
You may also call +1 305.373.0020 to process
payment over the phone.
99
Conducting Internet Investigations to Support Customer Due Diligence Processes
Next Web Seminar:
Securities Focus for Introducing BrokerDealers: Customer Identification Program
(CIP) Challenges and Strengthening KYC,
CDD and EDD Processes
November 9 – Noon to 2:00PM EDT
100