Skip to contentExploitQuest

What They Can Already Find

Before anyone attacks an account, they look you up. Most of what identifies you is not stolen — it is public, scattered across posts, records and old breaches, waiting to be assembled.

4 min readNot yet reviewed
Wrenlearner

When I picture an attacker I picture hacking — breaking in. Is that how it usually starts?

Magpieadversary

Rarely. I start by reading. Open-source intelligenceOSINTOpen-source intelligence — finding out about someone using only public information: profiles, posts, records, and the links between them. — I look you up. Your name, your photos, your old accounts, a breach from years ago. I assemble what is already public before I ever try a password.

Rookmentor

And that is the uncomfortable truth of this whole course: most of what gives you away was never hidden in the first place.

A footprint you did not know you were leaving

Your public footprint is larger than it feels. Social posts and the profiles behind them; data brokers that sell assembled dossiers; old breachMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. dumps pairing your email with a password; public records; a photo whose caption or background gives away where you live. Each is minor. The problem is that they combine.

None of these facts is secret: your first name, your city, your employer, your dog's name, your gym. Why would an attacker care about such ordinary things?

The aggregation problem

A single post says little. A hundred posts, cross-referenced with a profile photo, a reused username, and a location tag, say where you work, when you are out, and who you love. This is the same lesson as metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often., pointed outward: an adversary rarely needs one revealing thing when a hundred ordinary ones will do.

The kind of picture that assembles itself
# nothing here was hacked. all of it was public.
reused username "wren_h" -> found on 4 old forums
a 2021 breach -> that username + an email + a password
photos geotagged to one neighbourhood, posted every weekday 8am
# a home, a routine, and a password to try. from looking, not breaking.

Why does an attacker collect ordinary, non-secret facts about you — your city, employer, pet, usual coffee shop?

Assuming public means harmless

- Posting routine, location and relationships in the open, under one identity
- Reusing the same username everywhere, linking every account into one profile
- Assuming an old, forgotten account is gone rather than archived and searchable

Managing your footprint

- Looking yourself up first, and cleaning up what an adversary would use
- Removing yourself from data-broker sites, and keeping new posts sparse
- Separating identities so no single search returns your whole life
- Assuming anything posted is permanent, because for practical purposes it is

You cannot un-publish the internet, but you can shrink and split your footprint. Match the effort to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: an advertiser buys the aggregate; a determined person assembles it by hand.

Wrenlearner

So before any clever attack, there is just... looking. And I left most of it out in the open.

Rookmentor

Which is good news, oddly: the first improvements are free. Look yourself up, remove what you can, stop linking every account through one username. You raise the cost of the easiest attack there is.

Magpieadversary

And you take away my favourite tool. I would always rather read you than hack you — right up until you stop leaving the pages open.

So the attack usually begins with a search, not a break-in, and the raw material is what you already made public. Look yourself up, shrink and split your footprint, and you defeat the cheapest attack before it starts. Next, the last piece of Foundations: metadataMetadataData about your data — not what you said, but who you said it to, when, from where, and how often. — how you keep giving yourself away even when the words are encrypted.