news.com: Tool mines personal data from across Net

Fri Apr 20 08:42:07 PDT 2007

Dave

Perhaps for IP.

Bob

Tool mines personal data from across Net

By Joris Evers
http://news.com.com/Tool+mines+personal+data+from+across+Net/ 
2100-1029_3-6177625.html

Story last modified Thu Apr 19 12:51:40 PDT 2007

VANCOUVER, B.C.--Who needs to dive through dumpsters or steal snail  
mail when so many details on people are available simply by searching  
the Web?
South African security researcher Roelof Temmingh, known for his work  
on security tools such as Wikto, is taking the search for personal  
information a step farther.

Temmingh--who spoke at the CanSecWest security conference here  
Wednesday--has crafted a tool dubbed "Evolution" that associates data  
found in multiple search engines and social-networking Web sites such  
as MySpace.com and LinkedIn. It also uses other sites' tools to find  
information behind Internet Protocol addresses, Domain Name System  
entries, domain registration and more.

As a result, a search for a person will associate the individual with  
results found across the Net. The idea is that data found in one  
place can bring up results elsewhere. For example, an e-mail address  
may bring up a domain name, which in the next search may bring up a  
physical address.

The searches could also connect work e-mail addresses with home phone  
numbers and expose details such as which NASA employees use social- 
networking sites and find people at the National Security Agency who  
use Google's Gmail, said Temmingh. Evolution, currently in its early  
stages, does all that automatically, he said. Temmingh created the  
tool not just to demonstrate his skills, but also to highlight just  
how much personal data the Net holds, and how vulnerable it is.

The results can help somebody doing research into an individual, but  
they can also help a potential fraudster, Temmingh said. A search can  
expose information helpful for social-engineering attacks. Also, it  
can expose secondary targets as it will bring up information on  
individuals' alliances with people or organizations.

Another possible use is "virtual identity theft," Temmingh said. You  
can assume a person's identity by registering free e-mail addresses  
in their name, setting up MySpace and LinkedIn profiles as them and  
getting the identity out so it gets indexed by search engines, he said.

-------------------------------------------
Archives: http://v2.listbox.com/member/archive/247/=now
RSS Feed: http://v2.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE