DuckDuckGo Search Cheat Sheet

A handy cheat sheet for searching DuckDuckGo can be found at Techglimpse. Click on the image to see the larger version.

DuckDuckGo Search tricks

Social Media Early Warning System

Today, Social Media (SM) informs about emergencies, scandals, and controversial events before the traditional media. The news media has become a second source that tries to improve the signal to noise ratio.

Using SM as an early warning system isn’t a new idea, but few organisations actually do it because they never get around to creating an organised process for this function.

How to Create a SM Early Warning System

I start the process by first identifying the subject matter that I need in my early warning system and what informational role it will play. This includes identifying who will receive its output and who must act upon its output.

Carefully plan how you will communicate with the rest of your organisation. This needs to include an emergency distribution list with alternative distribution methods if normal communication methods start to break down.

The people who must act upon your information must trust that you will give them timely and accurate information. They must also know what you won’t provide. Gaining ths trust and understanding will take time and good old-fashioned salesmanship.

Next, I start identifying sources that provide reliable information that I then store, aggregate, and evaluate. As these sources become more trusted, I begin grouping them by topic, special knowledge, geography, and other factors. I then start asking them for more contacts that are equally reliable. To manage my contacts or sources, I build Twitter Lists, Facebook Interest Lists, Google Plus Circles, and use other similar list tools.

I contact my sources by email, Skype, and other means to build a relationship based upon trust and common interests. I note their strengths, weaknesses, skills, contacts, biases, and other relevant characteristics. It is important for me to treat all my contacts with respect and to view them as colleagues, rather than people to order about. I also act as a source to all my contacts as this isn`t a one-way street. I make it clear that I am looking for help rather than someone circulating rumors and misinformation. I do this by letting my contacts know what I do and do not know while steering clear of all inflammatory aspects of the topic as SM tends to amplify these without adding factual data.

I have seen many attempts to use SM for this fail once they realise that for this to work, it must be a collaborative effort. They don`t want to give as much as they receive as that requires too much effort, trust, and organisation.

To organise a SM early warning system you need to start a decision tree that allows you to go through the research, evaluation, and verification process in a logical and orderly manner without missing any steps. Design the process to identify the original content source or creator, verify that it represents events truthfully, and that the context of the content is not intended to mislead the viewer.

Use your favourite flow-chart software to make a decision tree suitable for the type of content and SM that you typically handle. Keep it simple. Start with only yes/no decisions. Each person on the team should add to the decision tree for their tasks as they learn new sources and methods.

Divide the decision tree into three components. First, identify the original poster or creator of the content. Second, investigate the source or creator of the content to help determine his reliability, biases, and online history. Third, investigate the content itself for defects that indicate that it is a fake, an intentional hoax, or some form of propaganda.

Over time, the decision tree and its supporting documentation will make your team seem super-human in its ability to wade through large volumes of complex material to expose fakers and reveal the true story.

WebMii

I have written about pipl.com before and often find it useful when I am trying to track-down people. Unfortunately, its usefulness is limited if the subject person lives outside the U.S.A..

When searching people outside the US, I turn to WebMii. This has data sets for specific countries which you can select or you can select all by selecting ‘International’  as the region.

You may also search by keywords to get a list of people associated with the keywords. However, this has never worked for anything I have searched. Searching by company or brand name often returns useful results, but selecting a region failed to change the results in any search that I have done.

What was the Weather Like?

Wolfram Alpha is an interesting answer engine. It answers questions by computing the answer from curated, structured data, rather than providing a list of web pages that contain the search words like normal search engines.

Investigations often hinge on local conditions such as weather. When I need to estimate the weather conditions or compare someone’s description of the weather to actual conditions, I type in a search term like “what was the weather in toronto on july 1, 1967″. Sometimes, Wolfram Alpha has no data from which to formulate an answer such as happened with this search. If you substitute the years 1950 or 2000 you get answers, but not for 1967.

Of course I verify what I get from Wolfram Alpha through official sources.

How to be an Internet Eyewitness

Eyewitness testimony is the weakest evidence an investigator can collect. The vessel that contains this evidence is subject to illness, death, corruption, and a myriad of defects that compromise the evidence. Being a trained investigator does not make you immune to all these weaknesses.

How we access and share information and how we communicate has changed dramatically over the last 30 years. This evolving technology is changing how we conduct investigations. It is changing how we observe criminal activity. The number sources of evidence available in some investigations have become overwhelming.

The Investigator as an Internet Eyewitness

The key to believable evidence gathered from the Internet is that it is visual, understandable, and could be reproduced if someone else did it at the same time as when it was originally collected.

When I review an investigation, I apply these criteria to determine if it was done by an expert or a bodger.

Investigators are taking on the role of eyewitness by observing evidence that might not be visible to any other available investigator as it appears only momentarily in internet venues. To be a reliable eyewitness, the investigator needs to create a record of what he or she sees at any particular point in time. This must be done in the same manner as handwritten notes. However, these records must provide a visual representation of the evidence collected. With Investigative Internet Research, the computer’s camera and mic, along with software that records screen activity, become the investigator’s notebook.

Typically, screenshots combined with written eyewitness reports, are used to record what an investigator observes in social media and other internet sites. However, screenshots and written reports do not provide a full representation of the research process or the evidence uncovered.

Twenty pages of social media content along with text detailing each screenshot is time consuming to produce and mind-numbing for a Judge or jury to endure. The Judge and jury need an eyewitness to tell them what happened and to illustrate why they should believe this evidence.

As with any eyewitness testimony, two corroborating witnesses are much better than one. The second eyewitness improves the credibility of the evidence presented in the courtroom. The consistency of the eyewitness testimony needs to be established through documentation as would be done with traditional witness statements given at different times to police before trial.

Follow the Script

Wherever possible, rehearse the visual, logical, and reproducible nature of the witness testimony to produce a clean copy of the investigators’ witness testimony. Don’t be afraid to script the testimony. Don’t be afraid to admit scripting the recorded testimony. Explain, if asked, that the recorded collection process is just a representation of what you did without any irrelevant material or wasted time. Explain that the recorded collection process is what really happened as it happened.

Visual

The hallmark of a good report is that it looks organised and complete without being over crowded with text and other material. The recorded testimony of the investigators must also be organised and complete without any extraneous content. Sometimes, accomplishing this requires scripting and rehearsal.

The investigator’s recorded process of collection must present the page as he saw it and the viewer must see and hear the investigator as he goes through the collection process. Just because you did this before and scripted the presentation of your collection process does not make the recorded content any less valid.

Understandable

Above all else, be logical. The collection process must proceed in a straight line from a clearly explained starting point to the next logical point. Continue in like fashion until you reach a logical conclusion.

Explain the logic and connections in the accompanying report. Your report will probably need elements from PowerPoint, screen shots, images, graphs, etc. to accomplish this. Use visual aids to make connections and illustrate logic!

Explain how you got there. Explain what you saw. Explain the importance of what you found. Explain material that meets the elements of the offence or supports the continuation of the offence in some way.

Reproducible

The viewer must see and hear the second investigator doing the same thing as the first investigator. The viewer must see the second investigator collect the same material as the first one. Doing this will require some scripting and rehearsal.

Raw Evidence

Some situations happen too fast to allow scripting and rehearsal. In that case, you will have to use the raw recording of the IIR that captured the evidence. Even if you are creating a scripted and rhearsed presentation of the collected evidence, you should have a recording of the original IIR collection effort.

New Bing Image Search

Images that appear on a web site offer many insights into the people who created the site. They tell you if they have the money to buy copyrighted content, or that they took the time to create their own imagery to get across their message. The imagery may also tell you that they don’t respect copyright law. The use of the same image on several sites may indicate a relationship between the sites that use the image.

Bing now offers an image search facility that allows you to paste the specific image URL into the search box at Bing.com/images.  If you have a picture that you want to match, then you may upload it directly to Bing.com/Images and Bing will search for matches. To match an image, submit a URL, or upload an image, just click on image match.

When you come across an image on a site you find in the Bing Web results, go to Bing Image search and clear the search box. That will make the Image Match link appear next to the search box. When using this, the best approach is to have Bing Web open in one tab and Bing Images in another. As you click on Web results, they will open in a new tab between Bing Web and Bing Images. To isolate the images you wish to search, in Firefox, right click the image and click on view image. This will take you to the image itself and its unique URL. This makes it easier for Bing to isolate the image it is trying to match.

Eye Witnesses & Bears

I have never liked dealing with witnesses. They are fickle things that frustrate and annoy me. They change their stories or offer-up bizarre versions of events. Eye witnesses are the bane of any experienced investigator. A news item and my own failure to observe accurately this morning illustrate the dangers of relying on the eye witness.

The first item is comical the second not nearly so. Early this morning a taxi driver discharged his passenger and then got stuck in the snow. He called police saying he couldn’t get out of his car because there was a bear circling his car.

The bear turned out to be Bear, a Newfoundland dog.

The second example is something much more personal. I have been fighting a cold that migrated to my lungs. During an online interview I began to feel very disoriented and lightheaded. I had to stop the interview but I had no idea what was happening to me.

In a past life I was both a diver and a pilot. I was trained to recognise hypoxia and I had experienced it firsthand during operations. On a quiet morning, during an online interview, I was wholly unable to make out what was happening to me.

So many things can effect what an eye witness reports. The cab driver was a city guy with no experience with dogs or bears. He couldn’t distinguish between a bear and Bear the Newfoundland dog. I wasn’t in a high performance aircraft or underwater with a dodgy re-breather. My environment and mindset this morning made it impossible for me to realize that I was suffering from hypoxia brought on by a lung infection.

Witness testimony may be critical to most investigations, but please give me physical evidence that can be sent to a lab for analysis or documents that can be read, examined, and filed away until trial.

The Strange Case of Juicejacking

Have you ever seen people recharging their mobile phones at a public recharging station in an airport or shopping mall? They no doubt do this to avoid the severe symptoms of Twitter and texting withdrawal.

Don’t they realize that their mobile phone adaptor USB cable is a combination power-and-data connection? Plugging your phone into an untrusted USB cable is just plain stupid. Letting a stranger plug their phone into one of your USB ports is just plain stupid too.

Take a minute to think about the treasure trove of data on that smart phone. Your smart phone has more computing power and memory than my first three computers combined. Your digital and communications life history is on that thing.

When charging your phone from an unknown USB port, use a power-only USB cable. USB plugs have four or five connecting wires. The outermost two are for power. If your cable has two or three of the inner wires missing, then it can’t carry data, only power. This will slow the charging as the data wires allow the phone to control the charging amperage to get it above the minimum 100mA. Never trust a USB cable given to you by a helpful stranger, as a visual inspection will not reveal if it is power-only or power and data (I’ve tested this with a lot of people and over 90% got it wrong). To speed charging in a secure manner, use the charging adapter that came with the phone, not the data connection.

You can increase your security by configuring your device to require a password for all data-transfer features of the charging port. This stops synchronizing your data with another device unless you authorize it. This is good practice, but don’t rely on it if you are hooked-up to a hostile device. Don’t rely on shutting-off the phone as a protection either. It is hard to determine how much of the phone is truly powered-down. Even if the phone is powered-down, a USB connection may provide the hostile device an avenue to the memory card.

If you are in a foreign hotel and don’t have an adapter, please don’t get one from the concierge as you never know where it has been—like maybe to that country’s intelligence agency. I recently encountered a case where the helpful concierge provided an extremely effective and hostile power adapter probably engineered by either a moneyed industrial spy or the host county’s intelligence agency. Most national intelligence agencies conduct economic and industrial espionage— don’t be offended by this, be cautious, don’t take your entire life history with you on that smart phone, and don’t get juicejacked.

Good-bye Windows XP

If you have older machines running Windows XP, then  Microsoft will cut-off support of the operating system on April 8, 2014. That means no more patches, no more new software versions, no more drivers for new peripherals–and most importantly, no security updates and patches.

If you have an older machine that is running properly with XP, then you will probably find that installing Windows 7 or 8 will make it run like molasses in January. Most machines running XP don’t have enough memory to run Windows 7 or 8 efficiently.

I’ve been using Ubuntu 12.04 because it is the most secure of all the current OS offerings. The CESG, the UK government’s arm that assesses operating systems and software security agrees with me. Ubuntu also has the largest collection of applications in the Linux world.

Zorin OS 7, is also a good option when switching from Windows XP. It is faster, looks better and offers better performance than Windows, yet its user interface is similar to Windows and intuitive for long-time Windows users. It allows you to run Windows programs using WINE and PlayOnLinux emulators, as will other Linux distributions.

The US Department of Justice has “found” that Microsoft Windows is run by more than 95% of personal computers and that means that there are thousands of programs that will only run on Windows. WINE and PlayOnLinux allow you to use familiar programs to avoid a steep learning curve.

FinSpy & Browser Hygiene

Recently, I had run-in with the FinSpy trojan, or some variation of it. FinSpy is a component of the surveillance product FinFisher, a commercial trojan made and sold by Gamma International, a UK company. This thing was sold to some very nasty state actors, but now it’s in the wild. It allows the operator of the trojan to have complete access to the computer. Its design  makes it very difficult for the target or his anti-virus software to recognise its presence. It even permits the villain to activate the computer’s webcam and microphone to see and hear what is happening near the computer. Everything collected by the trojan goes to a command and control server located somewhere on the Internet.

This insidious thing tried to masquerade as Firefox. I think it was part of an image I examined for Exif data. It tried to ‘update” Firefox. The funny thing was that I wasn’t using Firefox, but a browser based on it. I was conducting the research within a Windows virtual machine hosted on a Linux distribution; therefore, it was unable to cause any damage.

What surprised me was that the subjects had seeded the site with information that would interest me to get FinSpy onto my PC. They created the site to gather intelligence on anyone who might investigate them. They are not state actors, just a bunch of criminals.

Chrome is Listening

So you want to use Chrome as your browser. Are you aware that it has recently been reported that a Chrome Bug Allows Sites to Listen to Your Private Conversations?

The best way to avoid this threat is as follows:

  • Go to chrome://settings/content
  • Scroll down to Media
  • Select “Do not allow any sites to access my camera and microphone.

This will disable Google’s Conversational Search, etc. but security will be increased.

I never liked the way Chrome ‘phoned home’ to Google with user tracking, bug tracking etc. I have also found extensions that had malware-filled updates. However, it is faster than Firefox, which over the course of a research project may save hours of extra time. I resisted using Chrome due to security & privacy issues.

I now use is Comodo Dragon, which is based on the open-source Chrome browser, however, it is more private and secure if used properly. I disable the camera & mic as SOP, so I haven’t investigated how Dragon responds to this exploit. The setting change that I outlined was in reference to the actual Chrome browser and this particular exploit, there may be more that I don’t know about.

I am very careful about exposing myself to the internet. My outward-facing computers don’t have cameras or mics to entirely circumvent malicious software like this and the likes of Finspy.

Fortress Firefox II

The browser is the most used outward facing software you will use. It interacts with suspect web sites and other internet sites. Firefox is still my first choice for security and plug-ins, even though Chrome offers a speed advantage that adds-up over the course of many hours of research, while this little problem makes me avoid MS Internet Explorer: Microsoft warns of critical IE9, IE10 zero-day-Just visit the wrong web site and get remote-code execution.

No matter which browser you use, it will require proper configuration. No browser blocks JavaScript and all third-party cookies by default. These are my first security concerns.

In Firefox, go to Tools>Add-ons>Plugins and set the Java Script and Toolkit to Ask to Activate. I also set all the other plugins to Ask to Activate as well. This prevents a plugin from activating at the wrong time and thereby sending out data to the site that caused it to activate. A malicious site may activate a plugin to have it to transmit data that can be used to thwart your investigation.

Third party cookies compile a long-term record of your browsing history. This is dangerous as it can reveal what you are investigating. In Options>Privacy>History select Never for third party cookies. In my sandbox, I have several versions of the browser with different settings. For example, I prefer to never accept cookies of any kind, but some sites need them to function so I have a version with normal cookies enabled.

Fortress FireFox

To create my everyday fortress Firefox, I use the following:

For more anonymity, privacy, and security, I do the following to my instance:

  • To preserve privacy, I use a VPN.
  • To preserve anonymity, I use Tor to connect to an anonymous VPN.
  • To maintain security, I work from a Virtual Machine hosted by a different OS on a clean machine.

If you aren’t doing the same, then you don’t know what is on your PC and what it might be doing to work against you. There are a lot of bad actors out there trying to insinuate malware onto as many machines as possible. If you are using your PC to gather evidence, malware can destroy the integrity of everything you collect.

Conducting Investigative Internet Research is not as easy as it might seem. There is more to it than doing a few poorly structured Google searches. You need to understand how to create a clean machine that will pass muster under S. 31 Canada Evidence Act. You must prevent all your research, and your identity, from ending-up in the hands of the very people that you are investigating. This happens. I have to believe that it happens often but isn’t recognised by most investigators. Would you know if your machine had a trojan like FinSpy? Do you know how to prevent the installation of something like FinSpy? Do you know how to get rid of it?

If you frequent bad internet neighbourhoods, then you will encounter bad people doing bad things, and they will try to do bad things to you.

Exif Viewers

In a past article, I explained Exchangeable Image File or Exif data and pointed you to www.regex.info, an easy to use exif viewer with a geo-locator. The regex.info Exif viewer allows you to enter the image URL or to upload an image for analysis. It doesn’t require JavaScript and it doesn’t have any widgets.

Another easy to use online exif viewer may be found at www.fotoforensics.com, but you must enable JavaScript to use it. You can use the URL of the picture instead of uploading the image.

The online exif viewer at www.gbimg.org has a lot of widgets on it.

My last discovery was the Exif site at http://www.findpicturelocation.com. Just upload the picture and it will show the location where it was taken. It only works with .jpg or .tif files. You must upload the image to the site, so who knows where it might end-up. This uses the Google API for the mapping. Not all pictures have the GPS coordinates in them.

Trolling RSS Feeds

RSS (Rich Site Summary) is a format for delivering regularly changing web content. Many news-related sites, blogs and other online publishers syndicate their content as an RSS Feed to whoever wants it.

I have written quite a lot about RSS in the past. The following are my choices for both installation on a PC and for a web-based reader.

RSSOwl

RSSOwl is cross-platform as it’s Java-based. It handles RSS, Atom and RDF in terms of feed formats. You must have Java installed, no matter where you run it. It cooperates with Firefox to add feeds to RSSOwl from the browser. Just go to the feed and copy the URL then go to RSSOwl and click on add feed and it knows where to find the feed. You can also drag and drop Feeds from Firefox into RSSOwl. RSS Owl has an embedded web browser, so you don’t have to open up a separate browser window to view links or to view the full version of feed items that are shortened. You do have to set this up under “Browser” in the Preferences menu option. Choose to Default to the Embedded Browser. To get the RSSOwl embedded browser to work properly with OneNote so that it includes the URL in pasted items, you must enable Java Script. I do not recommend doing this except on an isolated machine otherwise, malicious Java Script code could cause serious problems.

RssBandit

When I need to collect video and podcasts from RSS feeds, I turn to RssBandit. The embedded browser is MS Internet Explorer, therefore, it includes the pertinent URL when you copy to OneNote as the embedded browser is the same.

This is my favorite RSS reader overall, though, I have experienced occasional problems with exporting feeds for another implementation of the reader. This problem seems to stem from differences in the underlying OS on the importing computer. It can be an irritation when starting a project with tight deadlines.

RSSOwl has an edge for a group of researching working in a collaborative environment as it is easier to set-up and distribute to the group.

Web-based RSS Reader

The two most popular seem to be Feedly and Inoreader readers that offers similar features and options.

Inoreader offers secure HTTPS access and over 40 different customization options. If I must use a web-based reader this is the one.

I refuse to use Feedly because extensions like NoScript, Adblock, HTTPS Everywhere, etc. prevent the site from loading. I never use sites infested with stuff that my normal suite of extensions prevents from loading. You only have to encounter one ad with malicious code to cost you many hours of work to purge the problem code from your machine.