[SCARY] You knew about OSINT, but did you know about ADINT?

0f63fb2c-303f-44df-a18b-43764dea3c2dWIRED just published a scary (long) article. I am summarizing it here and highly recommend you read the whole thing.

In 2019, technologist Mike Yeagley warned US national security agencies that location data from apps like Grindr could reveal sensitive information about government employees.

Yeagley showed how he could use geofencing to identify devices likely belonging to Pentagon and intelligence agency staff by tracking their movements to and from sensitive facilities. This highlighted the massive privacy risks from vast troves of location data gathered by mobile advertising companies.

Yeagley was familiar with these risks because he had previously helped bring advertising location data into government use. While working for defense contractor PlanetRisk, Yeagley developed a tool called Locomotive in 2016 which allowed tracking of device locations worldwide using commercial data. Locomotive was later renamed VISR and provided to special forces for intelligence work. Other government agencies also began using advertising location data.

The key insight was that while device IDs are anonymized, the specificity of individual movement patterns means identities can be uncovered. Vast volumes of location data are gathered from bid requests made when mobile apps request ads. Companies like UberMedia sell this commercially, often with little oversight of buyers. Intelligence agencies realized they could simply purchase rich geospatial data rather than try to intercept it.

UberMedia and similar firms can track device locations over time with frequently updated data, in some cases nearing real-time. PlanetRisk found they could even identify phones likely belonging to Vladimir Putin's entourage by watching their coordinated movements with him. They also spotted US special forces gathering at a previously secret Syrian base.

Social Engineering Bonanza

Other governments’ intelligence agencies have access to this data as well. Several Israeli companies—Insanet, Patternz and Rayzone—have built similar tools and sell it to national security and public safety entities around the world, according to reports. Rayzone has even developed the capability to deliver malware through targeted ads, according to Israeli newspaper Haaretz. Think about the highly targeted social engineering risks here.

This availability of highly sensitive location data to anyone willing to pay is an immense privacy threat. Intelligence agencies globally make use of it for surveillance. But it also risks revealing personal information about private citizens, with almost no transparency or control over how that data is used. it makes you want to buy a Faraday Bag for your phone... :-(


Don’t get hacked by social media phishing attacks!

Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization's reputation, or gain access to your network.

KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.

SPT-monitorHere's how the Social Media Phishing Test works:

  • Immediately start your test with your choice of three social media phishing templates
  • Choose the corresponding landing page your users see after they click
  • Show users which red flags they missed or send them to a fake login page
  • Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews