You have heard it all before – recycling passwords for multiple services can be catastrophic. One service being breached and your shared password recovered can lead to the compromise of multiple accounts as discussed in my previous blog. However, the use of shared passwords is not the only piece of information that poses a risk. Security questions, password hints, usernames and photos are all types of information that can be used to compromise common accounts or to profile targets. Let’s look at one of these pieces of information – photos – in a bit more depth.
Many people are quite happy to populate public profiles with a common photo, thinking nothing of it. However, that same photo could be used to identify multiple profiles using reverse image searches, such as Google’s “Search By Image” (SBI). A reverse image search is used to identify other places on the Internet where a particular photo has been used.
Let’s say that a hostile actor has targeted your organization. As part of this, a profiling campaign of all exposed infrastructure and personnel is common practice. Through various techniques, they identify the professional profiles of many employees – including yours.
These profiles are scraped for information, such as:
- Name
- Job Title
- Location
- Photo URL
- Work Experience
- Products used
The information collected can then be stored for further profiling or targeting.
The photo URLs from the profiles can then be used as a search term through reverse image search systems in order to identify similar images. While this technique does produce a lot of false positives, it will regularly return a number of positive matches when used at scale.
The attacker searches using the Photo or Photo URL from your profile, which you may have used on your Instagram, Twitter, personal blog and Google Plus account. From this, they can identify several personal profiles. Each of the profiles identified are then scraped for personal information, such as:
- Favorite color – Gathered for social engineering or building custom wordlists
- Pet names – Gathered for social engineering or building custom wordlists
- Times of posts – This information can be used to identify if you regularly access personal accounts during working hours, which could be used for targeted attacks through personal email.
These types of searches can be difficult to automate due to the accuracy of image searches, however custom tools can easily be created that will perform the lookups for employees of an organization. Attackers can then perform the necessary searches to obtain potentially related profiles that can be manually verified so that the process of automated scraping can continue. The information retrieved can be stored against individuals in a database, which can be used at a later stage for targeted attacks, such as phishing campaigns that use personal information as a lure.
When these profiling campaigns are carried out against large organizations, a great deal of information can be gained about employees, and many associations between employee’s professional accounts and their personal accounts can be made. So, while the use of shared passwords can compromise several accounts, other unique identifiers can be used to compromise an entire organization. By taking the perspective of an attacker, organizations can better understand which aspects of their online presence can constitute a security risk.