Ep. 259: “Capture The Flag!”

“What the Hack?” is DeleteMe’s true cybercrime podcast hosted by Beau Friedlander

Nicholas: This person [Beep] is interesting, but her profile is private. Let’s see your stories. So this person is from [Beep]. I have somebody by the name of [Beep]. I have her.

Beau: Open source intelligence. You’ve heard me talk about this before, probably ranting. Open source intelligence, OSINT. It’s not hacking. Nobody’s breaking into anything. It’s just looking at what you posted, at what your family posted, or your neighbor, or your love interest, your boss, what you tagged, what they tagged, hashtags. That’s right, you don’t even have to be on the platform. Someone can just hashtag your name. It could be what your phone timestamps in a photo’s metadata. Maybe there’s a court filing that should be sealed, but oops, it’s not. Enough of that digital flotsam and jetsam. That’s the debris and cargo from a wrecked ship to you non-nautical types and totally perfect. I’m sorry. I have to go say that’s the right image. Together, piece it together, that flotsam and jetsam, and you don’t need a warrant. You don’t need a badge. You don’t need a camera on somebody’s property. You just need some patience and imagination.

Spongebob Clip: Imagination.

Beau: I’ve spent years following the surveillance infrastructure that makes it possible for anyone to collect information about all of us without anyone asking permission. OSINT is the zen of surfing the raw material of the surveillance economy. Intelligence analysts use it, journalists use it, investigators use it, even Birds and the Bees use it. No. Anyway, so do scammers, stalkers, and the incel creep figuring out who you know to search for tagged pictures of you in a bathing suit and where you live from just a legible logo on a coffee cup, maybe, in the background of your Instagram story. That fleeting thing. The thing that makes OSINT so powerful is that it can be fueled by people with many degrees of separation from you. A picture at a party, and you have no way to stop it from being out there. But the real power comes from putting it together. A geotag here, a username there, a property record, an old resume, a deleted tweet someone archived years ago. One piece tells you almost nothing. 50 things can tell a stranger a lot of things, like where you work, who you know, where your kids go to school, and on and on and three steps ahead.

Nicholas: That wouldn’t make sense. Dad posts quite a bit.

Beau: Boom. Got it.

Nicholas: Did you?

Beau: It can be super invasive.

Nicholas: We have first, middle, last, and a general location, right? So I’m gonna end up searching mom’s profile to see if I can find anyone who has other profiles like Ethan’s.

Beau: I found Ethan. Oh, that tricky mu– Okay. So Ethan’s name on Facebook is Ethan [Beep] And…

Nicholas: Oh, it is, and he owns an LLC. So let’s see. I wanna know where that LLC was registered, so I’m gonna go ahead and look that up really quick.

Beau: And you find so much out by looking up other people connected to the person you’re looking up. You being me, being a person who does this. Which means no matter how safe you are or you think you are, you are [BEEP]ed. He’s not tagging anybody, so he doesn’t tag everybody.

Nicholas: That is true. I’m gonna put a pin in that for a minute because I believe-

Beau: Did we get this wrong? I think we did. Maybe they just broke up.

Nicholas: ‘Cause I see the family pic photo.

Beau: Oh, it’s 100% his– That’s his love interest. My colleague Nick and I are playing Capture the Flag. If you listened to the episode from last year’s Social Engineering Village at DEF CON, you already know what that is. Capture the Flag. Okay, so basically these are kinda hacking challenges. How far can you get into a system, an organization, a person’s life? You met Ethan recently in the episode called The Bait Bites Back. Scammers were using his images from social media to catfish women all over the world and scam them out of money, and then he found them and, you know, scared them and, well, it was, it’s a good episode. You should listen to it. He’s also a colleague. We all love this stuff. So when Ethan asked Nick and I to hack him using OSINT and capture four flags, four facts about his life hidden somewhere in the noise of the internet, or not so hidden. We were totally on board, ’cause the not so hidden was the first thought we had. Nicholas Olson is an associate security engineer at DeleteMe. His OSINT skills are better than any I’ve come across in the wild, or just as good, but better, I think, actually better. When it comes to just looking through what’s already out there online, hidden in the everyday, the mundane, Nick is very, very good. A few hours, a few phone calls, a leaked password with a cat’s name in it, and a willing victim who’d already learned the hard way how exposed he could be. None of that’s the lesson here. What you’re gonna walk away with is how everyone we know gets hacked. Everyone we know gets us hacked. If you don’t send this episode to everyone you know, for real, whatever. You really should. I’m Beau Friedlander, and this is “What The Hack?” The podcast that asks, in a world where your data is everywhere, how do you stay safe online? Ethan Merritt, welcome back to What The Hack.

Ethan: How’s it going?

Beau: Ethan, you had a phenomenal idea in the land of nerding out on data that’s available online. Open-source intelligence means that we can find all kinds of stuff online about people and I think, you know, the assignment that you gave me and Nicholas Olson was really simple. Capture the flag. Find four flags about you.

Ethan: I wanted to show this real vulnerable experience. I’ve already been targeted in the past. So I wanted to see what you guys could find that was real about me, for one, and what you might find that might be extracurricular things that were not actually me, which there was probably a lot of that as well, since I was already previously targeted before.

Beau: So let’s go through the flags, Ethan. Number one

Ethan: Seeing if you can find the love interest that I have.

Beau: All right. And what’s flag number two?

Ethan: Seeing if you could find who my sister is.

Beau: Okay. And flag three?

Ethan: Finding out if you can find my sister’s husband, who’s even more elusive.

Beau: And the fourth flag?

Ethan: Would be my current roommate.

Beau: So Ethan Merritt, I think that he is not going to be a very difficult person to crack open. What do you think is his most obvious vulnerability?

Nicholas: Social media.

Beau: That’s Nick again.

Nicholas: He is also a podcast host. And so I think what a lot of social media influencers or people with a personal brand tend to do is they tend to overshare quite a bit, right? So-

Beau: They’re not oversharing. That’s not fair, Nick. He’s not oversharing. He’s sharing as much as he needs to to become an influencer.

Nicholas: Exactly, and connecting with your audience is a really important thing, right?

Beau: Nicholas, as you know, is a ridiculously good open source intelligence researcher. Now, Ethan, why don’t you tell us why you thought they were good flags?

Ethan: Yeah. So a few of the flags were specific that I knew would be challenging. Some of them are pretty normal that somebody would wanna look at, right? So I started with understanding the fact that there’s some people in my life that are fairly easy to find that might be my family members, and fairly easy is kind of relative. And then like finding a love interest is somebody that actually is not that, that I have not promoted anywhere, that we have not been seen together anywhere at all yet. So I thought that those would be two interesting flags to kinda go with.

Nicholas: Ethan has also been a target of pretty advanced catfishing in terms of of he is being used as the catfish, right? And so because of that, a lot of his digital footprint, he needs to be very careful about what he portrays online and portrays in media.

Beau: Well, he hasn’t been. And so here’s the deal. I was gonna take a page out of your notebook, to do something with basic people search. You know people search sites, the Whitepages, the Spokeos, the BeenVerifieds of the world. All these sites, they crawl public records, they scrape them. Old leases, voter rolls, whatever they can scrape, and they just lay it out there for anyone who types in a name and has whatever they’re charging to get that information. I didn’t do anything clever here. I didn’t need any advanced tools, actually. I didn’t need a leaked database. I just searched Ethan’s name, and it handed me his neighbors by name, nine of them, right on the screen. So I have right in front of me one, two, three, four, five, six, seven, eight, nine. I have nine neighbors of Ethan Merritt here. Every one of those neighbors are potential sources of information about Ethan. If I were trying to capture a more serious flag, one that has maybe, maybe one that’s worth some money, the people I find on people search sites present potential leads. But that’s just the tip of the iceberg when it comes to the current CTF challenge. Now, Ethan’s problem here is I can also use his podcast to clone his voice and I can hack him through his neighbors and a cloned voice.

Nicholas: Absolutely. Absolutely. And I think that’s another big part of being an influencer, right? Is especially having your voice very publicly accessible. People can clone my voice off of what we’re talking about right now. And so it makes really, really tricky, and especially, like I said, since Ethan has been that victim of catfishing, now we have voice cloning and video cloning, and we can sound, look, and be like Ethan. It’s gonna make him a pretty easy target for these types of things.

Beau: He’s toast. No, I mean, so… And I’ll just tell you something very funny before we go on to exactly how we’re going to toast this marshmallow. For years, I would answer scam calls like this. Mm-hmm. ‘Cause I would think like, “They’re gonna spoof my voice and I’m gonna get hacked.” And meanwhile, there’s 350 episodes of “What The Hack” with my voice. That’s how bright I am. And this kind of is what it boils down to at the end of the day, is you do what I do and what Ethan does for a living, your attack vector is really wide open. This seems like a good time to talk about safe words, to me anyway.

Nicholas: Absolutely. And that’s something I always, especially to students and young people, right, is in an age especially where older people are phished, voice phished, a lot of scams kind of with that fear element of, “Hey, you need to send me money or else,” right? Uh, “Your son, your daughter is a victim of kidnapping. Send me money or else.” And then especially using those advanced voice cloning techniques. Now, you know, you have a five-second voicemail sounding like your kid saying, “Hey, I need help. Send me money. I’m in so and so place.” How do you confirm that’s them, right? And always setting up that safe word in some capacity: butterfly, avocado, any of these, right? Just where you choose a random arbitrary word that people can’t guess. If you say, “Tell me your safe word,” and you’re on a phone call with a scammer, it’s a pretty good way to tell them like you’re bluffing. I know you’re bluffing, and here’s how I know, right?

Beau: Okay, time to review.

Nicholas: In the digital media space, like a last name is a key to a lot. If people know your legal government last name, not only is it populating on data brokers, but it’s also, “Hey, I’m gonna look this person’s family up on their social media profiles. I’m gonna see if anyone related to them knows, what they do, who they are. And so even with Nicholas O, creating these identities, right? Where Nicholas O, my last name does start with an O, right? But I never give that out anywhere. And even with that certain bit of information, it’s much harder to get Nicholas O because it’s a very broad spectrum of last names that begin with O. But then you start to create identities around this where I know that Nicholas Osteen, right? That was an identity that I used at a jump zone or wherever I went with nephews that I had or people that I was with, right? Regardless of what that is, I know that that exact identity was used in this one place, and because they’re calling me from this number, I know that they’re doing something else with that information. And so it kind of adds to that element of just protecting your identity and who you are. And so Ethan being who he is, has his full last name on display, which I feel like we’re gonna be able to use in a lot of nefarious ways.

Beau: Now it’s time for the main attraction, capture the flag. Flag one, find a love interest.

Nicholas: The first thing I always like to start with is just some sort of generic Google search, right? Searching a name. And for Ethan, the first thing that pops up is a social media account that contains his name and all of these posts and all of these other things that he does. There’s two places that I like to go here. One of them is tags, especially the earlier tags, if that is public in photos. And the other place I like to go-

Beau: I’m in his tags right now.

Nicholas: And the other place I like to go is the very first post.

Beau: Why the first post? ‘Cause that’s the one nobody curates. By the time you’ve got a following or maybe just a few hundred friends or more, you start thinking about what you post. You crop things, you skip the photo with your mom’s address in the background. But that very first post before anyone’s watching or not many people are watching, before there’s anything to really protect, chances are it’s just a raw sample of life, your life, family, hometown, license plates, people in your life who actually matter. It’s something people forget about. It’s still sitting there because why would you delete it? There’s probably some nostalgia. Anyway, it’s still there. All right. What do we got here? This is what I’m looking for. No. N- uh.

Nicholas: This person is interesting, but her profile is private. Let’s see your stories. So this person is from [Beep], I have somebody by the name of [Beep].

Beau: Yeah, I have her.

Nicholas: Yeah, she looks, she looks interesting because she’s definitely from [Beep]. This seems like somebody that he would be interested in. And he also was in [Beep] the last time that I saw him. And so she has a tag in her story feed with her puppy from [Beep], I believe. So I would assume this is probably the correct person.

Beau: All right. Well, you got it faster than me. I had her in my list, but you got it faster than I did. I think that is who it is. What’s her full, her full handle?

Nicholas: [Beep]. The first time that they met was in [Beep] I know about two months ago. And so I believe love interest would be her, but nothing official as of quite yet. I know she also visited him in [Beep], so if there’s some sort of confirmation there that we can find, I bet this would be the person.

Beau: Flag number two, find the sister.

Nicholas: So first place I’m gonna go: Merritt. I’m just looking in his following list, for anyone with the last name of Merritt.

Beau: Searching for Merritt gives us a few things. It’s faster with People Search, sure. Using the first data broker that pops up, that’s what we did. We narrowed it down to some likely Merritts. Family members are a real source of online exposure. We got [BEEP], we got [BEEP], we got [BEEP], definitely mom.

Nicholas: I’m also gonna pivot a little bit to Facebook now, because people tend to overshare on Facebook more so than Instagram. And so she posted-

Beau: Oh, here’s whole family. I already got it.

Nicholas: Oh, I have an old prom photo of Ethan from 2010.

Beau: There are some funny pictures of him, yeah. And there’s, the, the one, his mom posted one that he probably doesn’t love either.

Nicholas: Okay, so [BEEP] is someone that I’m seeing come up. So [BEEP] Merritt.

Beau: His sister?

Nicholas: That would make sense. Dad posts quite a bit.

Beau: Boom. Got it.

Nicholas: Did you?

Beau: Who is [BEEP] Merritt? Is that who I’m thinking it is?

Nicholas: Yeah, and there’s a lot of photos between…

Beau: I’m not positive. Could be the wife of his brother.

Nicholas: So yeah, I’m curious, I’m curious who [BEEP] Merritt is, because she seems to have a lot of photos with dad. Couldn’t ask for a better dad, and so, I would assume that this is sister because they have the same parents. Yeah. So I found [BEEP] personal, but it’s private. Good on her. And so let’s see if we can Google and just see what pops up here. So University of [BEEP] is what I’m seeing here What did she study? Just out of curiosity. This is the same person for sure. She’s a swimmer, which is interesting ’cause I know Ethan was also a swimmer.

Beau: He’s not tagging anybody, so he doesn’t tag everybody.

Nicholas: That is true. I’m gonna put a pin in that for a minute because I believe-

Beau: Did we get this wrong? I think we did. Maybe they just broke up.

Nicholas: Because I see some other ones. Is she in [Beep]? ‘Cause I see the family pic photo.

Beau: Oh, it’s 100% his– That’s his love interest. There’s a subtle thing that just happened here that happens all the time when somebody is online trying to figure out your digital here and now. You rub over here, it shines over there. Pull this string, see what moves. It moves somewhere else. We learned more about Ethan’s love interest by looking for his sister. So the more time you spend researching a person, the more information you’re likely going to find about other people in their constellation.

Nicholas: I’m gonna pivot here a little bit. Knowing what we know about [BEEP], we have first, middle, last, and a general location, right? So I’m gonna end up searching mom’s profile to see if I can find anyone who has other profiles like Ethan’s or-

Beau: I found Ethan. Oh, that tricky mu– Okay. So Ethan’s name on Facebook is Ethan [BEEP].

Nicholas: Oh, it is, and he owns an LLC. So let’s see. I wanna know where that LLC was registered, so I’m gonna go ahead and look that up.

Beau: You’re just showing who you’re following. He’s not showing us. No, he’s careful.

Nicholas: He has an old wedding photo, which I assume is his ex-wife.

Beau: Oh, here he is getting married to somebody. Who’s that lady?

Nicholas: That’s a great question.

Beau: Can you PimEyes her? I don’t think she’ll show up, but I’m gonna PimEyes her. It doesn’t have to be PimEyes, right? There are many– There are tons, actually, of services, paid and free, mostly paid, that you can use online to identify a face, a random face.

Nicholas: Go for it. I’m also gonna… I didn’t take a look at Ethan’s Instagram tags from the very beginning ’cause yeah, he’s tagged in a lot, but I– Usually the older the tags get, the more interesting things that you find. That’s generally what I see a lot of the time.

Beau: I’m still…who is this lady?

Nicholas: Yeah, [BEEP] seems generally pretty private on social media.

Beau: Is that who you’re going for?

Nicholas: It really is, I think it’s sister because they share the same parents, and I think that is what constitutes a sibling. So [BEEP] Merritt is for sure sister. I’m pretty confident in that. But now it’s figuring out husband’s name because she hasn’t posted on this since, you know, 2014. And so I’m pretty confident that that’s sister.

Beau: I think I can get ex-wife’s name. I just don’t wanna pay for it. She pops up twice on PimEyes.

Nicholas: Well, I have her Instagram. She tagged in a, yep, tagged in a photo with Ethan.

Beau: Oh, cool. All right, great. All right, so we– she’s identified.

Nicholas: Yep. Went ahead and closed that out, and so let’s see what else.

Beau: We went on like this for a while.

Beau: For me, it was interesting to see the difference between the way that I would go after things and the way that Nicholas went after things. Now, the way that I went after it is very simple. I thought the love interest was probably gonna be the easiest one. Did you think the love interest was gonna be the easiest one?

Ethan: You know, I thought that that was actually gonna be a harder one for a couple reasons.

Beau: Okay, and for me, for the way that I do it, I was like, “Ah, I bet you I can go back a year.” ‘Cause OSINT is difficult. You’ve gotta do some– You have to have a good memory. It’s like playing minesweeper. So I went back a year and was like, “This woman has not been here the whole time.” And it was pretty simple. But you wanted us to find these flags, and the reason this is really unusual and the reason you should listen to this episode is because it’s very hard to find a willing victim. It’s super hard because it’s not even legal. And Ethan, you did the world a service by just being like, “Okay, go ahead”

Ethan: Yes. Yes, I did.

Beau: Okay.

Beau: Flag three, The brother-in-law.

Nicholas: Sister’s husband is somebody that he wants us to find and see if we can find, and so I think we can even find a little more than that too, right? Previous interests, things she is also interested in, and build this what I like to call the social profile of somebody. Being able to pretend to be someone so legitimately that other than social security number, you can be that person, right?

Beau: Oh, wait. Did I just not see it? I did see it. There we go.

Nicholas: Who is that gentleman tagged in…

Beau: LinkedIn is not being particularly helpful right now. That’s his dad right there. So open it up. Let’s see what we got. All right. You’re giving me a lot of them. I want one of them.

Nicholas: I am putting PimEyes. on this bald guy because he is in a lot of the photos with [BEEP] and the parents. And so I would bet that this guy is the husband of [BEEP]. I feel pretty confident in that.

Beau: The weird thing is, sister’s not showing up ’cause in every people search thing, [BEEP] and [BEEP] just have one kid. But there’s obviously a daughter in those photographs.

Nicholas: Okay, so nice to have [BEEP] and [BEEP] from this past week.

Beau: Oh, would you look at that?

Nicholas: I feel pretty confident in saying [BEEP] is her husband. That’s– I feel good about that. Yeah. “We are thrilled, enthralled with meeting your son-in-law. Thanks for sharing. He had to be impressed with his in-laws.” Feel good. I feel good about that.

Beau: Flag four, Ethan’s Roommate. Okay, so Nick, mostly Nick, but Nick and I in theory had gathered a lot of intel. We had his family members, we knew who they were. We figured out where his social media was being posted, even the one that didn’t have his name but we knew it was him. We had his email address. And you think, like, well of course you have his email address because you work with him, but no, we had his email address because it was online on a people search site. So absolutely everything, and of course we had the podcasts where he gives a ton of information that allowed us to figure out what we needed to figure out to capture all the flags, including the one we’re about to talk about.

Nicholas: So once I found all the phone numbers and things that I did on brokers, I had a general idea from his YouTube and social media profiles of emails. So that made it really easy to search him up on things like Have I Been Pwned? And then immediately pivoting to things like Snusbase, which gave me plain text passwords, and other emails that are associated with those passwords.

Beau: I did a Have I Been Pwned on him too and was like, “Oh, this is embarrassing. This is gonna be easy.” Where did you go with the information? People know they can go to Have I Been Pwned, they can find their email address. From there, they can find out where they’ve been breached, and they can find out what kind of information has been breached. What is Snusbase first?

Nicholas: So Snusbase is a leak aggregation platform, anytime that there’s a leak or a breach that appears on things like Have I Been Pwned, all of those credentials are in plain text on Snusbace. And so you pay a monthly fee to get access to these things. You could search people up by their emails, their usernames, passwords, anything and everything under the sun down to an IP address.

Beau: And is it legal?

Nicholas: So it’s a bit of a gray area, right? And so for this example, one of the things that was in scope for us was that Ethan wanted us to be an attacker, and attackers aren’t gonna play fair, right? By no metric of the imagination are they gonna be ethical with the information and sources that they use. And so in order to portray that, we used Snusbase to find a lot of this information, especially those things like passwords and things that are a little more confidential for Ethan. So we wanted to make sure that we were really being an adversary to Ethan.

Beau: Now, from what I could tell, he was somewhat daisy-chained on those passwords.

Nicholas: Yeah, he has quite a history of reuse. It was his sister’s cat [BEEP], followed by his date of birth. And it is something that he used constantly, and we even see an example of a password that he used here. So very similar to how people use exclamation points at the end of passwords and whatnot, he just had an at symbol at the beginning and then a number at the end. So he’s still hitting that special character number word mark. It’s just that’s publicly accessible now. And so if he has password reuse anywhere else, this is a very similar one.

Beau: And social media, I imagine, was just a big leaky arena of tell me what I need to know to get what I want.

Nicholas: A big part of it, and one of the things that he mentioned when I was talking to him was that some of these usernames weren’t him. And so you did a podcast with Ethan where you talked about previous interactions with catfishing and other things along those lines.

Beau: People using his image and pretending to be him, specifically.

Nicholas: Absolutely. And so one of the things that I really laughed at on these leak sites was the username SexyDiveEthan. And I thought that this was hilarious because I thought this was him maybe in his college days when he was a diver, but he said, “That one isn’t me at all. That one is not me. That’s somebody who probably was trying to catfish me.” And so he has another username based on things like leak sites that he didn’t understand before. And so one of the leak sites had a IP address for a university in New York, and that was where SexyDiveEthan came from. And so some sort of VPN connection, something where he was tunneling in in some way, and then that was just conveniently leaked eventually. And so it’s just another potential username that an attacker might use for him. So we both looked. There was quite a bit that I found, and there’s about two hours of recording extra on top of the stuff that you and I did together, all of this was originally in a notepad but to start, we have his full name, his education fully posted on his Facebook profile, DOB, phone. I had two potential addresses. One of them came up when I was…

Beau: So, Ethan, after talking with Nicholas, I actually called a few buildings where I suspected you lived and did the following hack. You play the building and participate a little bit. Ring, ring.

Ethan: Hey, how’s it going?

Beau: “Hey, man, I’m so sorry to bother you, but my roommate is being… Can you just tell me who’s on our lease? We’re in apartment blank.

Ethan: Ooh, I don’t know if I can give you that information.

Beau: “‘Cause he’s saying he’s not, he’s saying he’s not on the lease, and he’s 100% on the lease, and he’s not willing to pay his rent this month. It’s serious, like I gotta get this done right now. Like it’s the end of the month.”

Ethan: So is this what you tried, huh?

Beau: Yeah. And they were like, “But you didn’t live in those buildings.” So they were just like, “Get off my phone.” So anyway, and then we narrowed it down. That was actually kind of harder to figure out ’cause you’ve lived a few different places, to see which one… And then I saw, like, I went in Google Maps and was like, “Hmm, I don’t think this is where he lives. I think he would live somewhere cooler.” And we found the cool place where you live, which we’re not gonna disclose here. So did we get all the flags?

Nicholas: So far, yep.

Beau: Now, I had a hard time with the love interest. It was very easy to find the person that he told us that we should not reach out to. That was easy and should’ve been. Like, I get it. And the love interest though, there were a couple I thought it could have been. But what did you… How did you do it? I’m just curious.

Nicholas: So based on the likes from Ethan’s Instagram, his most recent post-

Beau: That’s exactly what I thought.

Nicholas: He had a bunch of likes from a bunch of different people, and one of them that really stood out was this girl named [BEEP] and the reason she stood out is because they previously worked at the same company, and she was a supervisor of his department. And additionally, she was in [BEEP], which he flies out pretty consistently to [BEEP]. The first time that we ever met in person, he mentioned, “Hey, I’m here to see somebody.” And so I had a pretty good idea this was her. And they don’t do the casual thing of liking posts and following people yet, but she matched Ethan pretty well. And so what I mean by that is she’s also a podcaster. She’s very into fitness. She’s an entrepreneur. She does all of these things that Ethan is also very involved with, and previously working at the same company, I had at least an established link. And so looking into her a little bit more, I found a last name, personal cell, address. After confirming with Ethan this was the correct person, and we essentially immediately found it based off of one singular connection and one previous example. And so they both like each other’s posts. Ethan doesn’t do that with any of the other girls who liked his post first. I went through about 15 to 20 other people who liked his post, didn’t like a single other person. It was just hers that he was liking. And so I at least had some sort of established background knowledge in that, but it’s also the things that we give away in person. That’s what that highlights too, right? Is Ethan wasn’t private in person, therefore it caused a leak just directly through me.

Beau: Nick is terrifying. I think you would agree.

Ethan: Yes. Yeah, Nick is very good at what he does. I watched his process and it is thorough, but it is a level of creative thinking that you don’t fully grasp until you see it.

Beau: It’s phenomenal. Now, opinion time. Ethan, do you think Nick is unique, or do you think there are some of those Nicks out there in criminal land?

Ethan: There are probably a ton of Nicks out there in criminal land.

Beau: I think there’s bouquets after bouquets of Nicks out there in criminal land.

Ethan: Yes

Beau: The battle’s done and we have won.

Ethan: Yes, you have.

Beau: All flags, all the flags were captured. What did you learn about your vulnerability through the capture of these flags?

Ethan: To capture of finding my sister, I think what I learned was how dedicated somebody can look and dig through your family members outside of that. So to capture that flag, finding different links of relatives and stringing it together to figure out who she is, you know, was important. So it wasn’t necessarily about my safety and what I do, but it was about other people around me. Well, what do my parents do, right? That was a big one. What do some of my other parts of my relatives do? And that is really the entry point that was easy for you guys to capture.

Beau: Ethan, I have to tell you, your folks are wide open privacy-wise on Facebook, and that was a big problem for you in terms of this flag. Would you suggest to them to maybe tighten that up?

Ethan: Yes, I already have. They took the information mixed, I’ll put it that way.

Beau: Well, I was surprised ’cause I couldn’t find you on Facebook until I found them and your sister, and then I was like, “Oh, that’s why I can’t find him,” ’cause you don’t use… It’s not actually your name, and a page out of my playbook actually because my name, as you know me, isn’t my name.

Ethan: Correct, yep.

Beau: Which you know… So we have something on each other. All right, your brother-in-law. How did you feel about the way that was outed? Was it in the same, in the same category of oops, or was it different?

Ethan: Yeah, I think it was in the same category of oops, right? So I don’t wanna give too much detail about him here, but yeah, he doesn’t have a presence online almost at all. And even what my first thought was, even my sister hasn’t really shared a lot of photos of him, if any, on her Instagram. So I thought if you are able to find her, I don’t necessarily know if you’ll able to find him, but-

Beau: So like when I saw it, and I think that we, if I remember correctly, the way that we identified him was because someone in the comments said it was super nice to meet blank.

Ethan: Yes.

Beau: Terrible, right? And you’re like, “Oh, curses.”

Ethan: Yeah. I didn’t think about the entry point of my parents for him. I thought about it for my sister possibly, but not for him. But I’m not on Facebook as much, so maybe hadn’t crossed my mind, I guess.

Nicholas: My biggest piece of advice, stop oversharing. I would suggest thinking about every post you make from the perspective that other people will be publicly viewing it. A big portion of what this exposure came down to was not only responding to things that you knew were kind of fishy, right? But additionally, it was posting things like your daughter being there from [BEEP]. You could just say your daughter. You don’t need to say where she’s flying in from. Even from Ethan’s perspective, you don’t need to mention what your first job was in a podcast unless it’s absolutely necessary.

Beau: And another piece of advice, check on the other people in your life. You’ve got to be diplomatic about it, but you’re probably not the weakest link in your own privacy.

Nicholas: His parents have the worst social media presence I think I’ve ever seen.

Beau: No, it’s great. It’s just wide open.

Nicholas: Yeah, it’s just wide open. And I explained this to him and one of the things that was really interesting that they did that just shows everyday compromise was they posted a picture where it was their dog’s medication, and they had like a red circle around like, “Don’t operate heavy machinery.” Like, “Ha ha, why would my dog have to do that?” And they posted it for one Facebook laugh, right?

Beau: I saw that. But it also had their address and their phone number.

Nicholas: Yep, it had everything on it. And so part of that is it shows a leak in some capacity. And so I figured there were gonna be other things.

Beau: There’s a tendency to leak.

Nicholas: There’s a tendency to leak. And so with the sister, one of the really interesting things about [BEEP] was that she is very close with the parents. And so she goes on trips with them, she flies out, and there were two posts that really highlighted something interesting to me. One of them was she mentioned, “Hey, my daughter flew down from [BEEP] so I’m seeing her from there.” And so that confirmed she was in some sort of [BEEP] time zone address. But she also had another post, her mom, where it said, I’m so glad that my son-in-law [BEEP] and my daughter [BEEP] came down, to come and visit us with their cat [BEEP], and I thought that was cute and it was a cute post, but from here I took it a different direction. I’m gonna show you my text to Ethan’s sister. So I went ahead went ahead-

Beau: Oh, you rat bastard, did you?

Nicholas: I went ahead and texted so hi there. Is this [BEEP]? She said, “Who is this?” And I found this number using public data brokers. And so I said, “Hey, my name is Max Foley,” who’s a real ITV director. And I said, “I’m reaching out on behalf of ITV America. We’re doing a reality TV dating show. Ethan applied, and you were put down as a reference. Feel free to give me a call or text back when you can. I’d love to chat.” She says, “Sorry, I’m at work in the moment, and I’m in [BEEP] time zone. Can I call tomorrow morning?” Now, this was great. I was very excited at this point, and I said, “This is amazing.” Right here, she called Ethan and said, “What the hell is going on? Why did this person text me?” She had to confirm with Ethan that he applied, in which Ethan immediately snitched me out, and so I tried my best to backtrack. But even with just this one text alone, I confirmed two things. I confirmed his sister’s number, and I already knew she was in [BEEP] based on her address. So I found two key bits of information from one text without ever having to interact with her via the phone call, period.

Beau: So again, what you did here was the yeoman’s work of real open source intelligence. You looked at all the posts. And this is where everybody gets it wrong. Everybody gets it wrong here. Unless they don’t have social media, unless they never have been on a podcast, unless they’ve never-there’s this kind of information out there and there are people like Nick who know how to drill down into it and will take the time. In this case, it’s Nick’s job. But I promise you, there are people who make a lot more money than Nick who do this for their job, and they have all day.

Nicholas: And so it was a hop, skip, and a jump. That phone number, once I confirmed that it was her, also led me to her home address, which home addresses are really hard because you can’t necessarily confirm. But conveniently enough, she had a full Amazon affiliate link where she shows different angles of her house. And one of the things that was extremely interesting was she did a full review of a cat tree with her cat, in one of these videos, and showed the background of her house, which directly matched the Google Street View of her home. And so the further you scroll down, the more stuff and the more angles you get. But even things like the wood flooring, the tile, the door, all of them are the exact same with not only the Zillow listing, but the Google Maps listing as well. And so you can tell that this was the correct place, and I had the correct address. So little leaks like these, right? The things that we don’t think about, the background that we have in our video.

Beau: That’s not so little. And you found the address through people search or through the Amazon affiliate?

Nicholas: Just directly through her phone number. The Amazon affiliate was used to find just and confirm. That was it. It was just a piece of confirmation for me. There was a couple things that I left out for just intentionality reasons, like Ethan’s license plate and the car he drives. Yes, it’s important. Yes, it would scare him, but for continuity and brevity, I left those out.

Beau: Well, good job, Nick. I was really looking forward to all of these revelations that I knew you were going to find. And it was fun to see exactly how you wended your way into capturing all four flags. Did you have any thoughts as you were doing this regarding kind of a basic overarching directive that you would give the Merritt family?

Nicholas: You have to draw the line of what is shareable with the public and what shouldn’t be shareable. What should just be private for you? And Ethan has a really hard time distinguishing that. Even in the fun facts section here, right? I have his earliest memory out of, like, from his life.

Beau: I’m giving him a pass on that. As a person who writes memoir, I’m giving him a pass on that. Listen, you know, if you are a person who actually can use that information as content that is transformative, I think that’s okay. But if you’re doing that, then you have to take a threat stance that is completely, you’re completely exposed. Your exposure is complete. And if you’re doing that, and you have family members who use social media and their privacy settings are wide open, you might ask them to… You might even just offer to set their privacy settings, ’cause that was my thing, Nick, is if the parents wanna say so-and-so’s coming from [beep] that’s their business. But they should be sharing their business on a private channel.

Ethan: I think just ways of understanding stories like this are really gonna be helpful. That really showcasing this type of story in the context of saying that, like, you’re not gonna be the only one that’s ever gonna be attacked. You’re not ever just gonna be able to be scot-free either. And, you know, that’s why we have the tour that we worked on that we’re gonna be promoting, right? Because we’re gonna be showcasing the fact that there are stories and entry points that real-world examples are gonna be the best way to show this because some people are never gonna fully understand something until they watch it happen right in front of them, until it happens to them, and you don’t– you never wanna expose people to that side of it. It’s not worth it for them. So showing this story today is gonna be one of the most helpful hand points to be able to promote out there.

Beau: Okay, so what is the tour called and how can people get it in front of their staff?

Ethan: Right now at DeleteMe, we’re doing the Invisibility Tour, and it’s the Going Ghost Invisibility Tour that we have. And we are trying to book this for small executive teams together at large enterprise size down to small businesses, and we’ll be able to present a two-hour learning experience start to finish with really good examples, really good experience on exposure, and a lot of education for you to walk away and toolsets that you can bring back to your team.

Beau: And if somebody wants to get this Invisibility Tour to their company and they don’t want to do open-source intelligence to find you, what is the best wetter for them to open the door to getting that conversation started?

Ethan: Yeah, if you actually go to my LinkedIn, linkedin.com\ put my name Ethan Merritt, you can actually reach out to me and we can talk more about the Invisibility Tour and what we can do for your team, bringing in some SMEs and some professionals to be able to speak to your companies in small groups so you can learn how to be safer.

Beau: And if you don’t know what an SME is, it’s a subject matter expert, but it doesn’t matter ’cause you probably don’t need him. But the fact is, yes, you wanna reach out to Ethan, and Ethan’s last name is spelled M-E-R-R-I-T-T. So go check it out. I think we’ve done our job here, Ethan. Thank you so much.

Ethan: Thank you very much.

Beau: All right. Well, it’s been another wonderful adventure with Nicholas Olson, OSINT researcher extraordinaire. Thank you, Nick.

Nicholas: Absolutely. Thanks, Beau.

Beau: All right, now it’s time for the Tinfoil Swan, our paranoid takeaway to keep you safe on and offline. This week’s… I don’t know how to tell you this. This week’s Tinfoil Swan is talk to your family members who overshare about their privacy settings, and if you need to, ask them to give you their device, and if you need to, ask them to hand you their device logged into whatever it is they’re over-posting on, oversharing on, and set their privacy tight yourself. That’s this week’s Tinfoil Swan. You are only as private as the people around you sharing about you, and it’s your right and duty to yourself, which is, I don’t know, you get the point, to fix that, and I encourage you to do it nicely. And extra points if you get absolutely everyone in your network a subscription to DeleteMe, because then it’s gonna be a lot harder to figure out who your neighbors are. You could do your whole street. You could do your whole town if you want. But they used to have these neighborhood watch areas. Well, maybe we need to have these neighborhood no data online areas because that would really solve a lot of the problems. Okay. That’s it for this week. I hope you stay safe out there, and can’t wait to have you back next week. Thanks for listening. What the Hack is produced by Beau Friedlander (that’s me) and Andrew Steven who also edits the show. What the Hack is brought to you by DeleteMe. DeleteMe makes it quick and easy and safe to remove your personal data online and was recently named the #1 pick by New York Times’ Wirecutter for personal information removal. You can learn more about DeleteMe if you go to joindeleteme.com/wth. That’s joindeleteme.com/wth and if you sign up there on that landing page, you will get a 20% discount. I kid you not, a 20% discount. So yes, color me phishing, but it’s worth it.

Learn More:

• Discover the origins of OSINT and why it’s dangerous
• Read up on how cybercriminals use open-source intelligence against organizations.
• Listen to the previous episode with Ethan Merritt on military romance scams