Menu
  • Home
  • My Books
  • Courses
  • About Me
  • Contact
  • Home
  • My Books
  • Courses
  • About Me
  • Contact

Brett Shavers | forensics & things

Brett's Ramblings

Subscribe to blog
Unsubscribe from blog
Settings
Sign In
If you are new here, Register
  • Forget Username
  • Reset Password
Font size: + –
Subscribe to this blog post Unsubscribe
Report
Print
12 minutes reading time (2450 words)

TikTok is like a big, greasy cheeseburger. We know it is bad for us, but don't care.

Digital Forensics
Brett Shavers
Tuesday, 07 July 2020
24017 Hits
0 Comments

Short version: Any social media platform can be compared to the biggest, greasiest cheeseburger that you can find.  You know that the cheeseburger is unhealthy, but you choose to eat it anyway.

TikTok is worse for you than a cheeseburger

Many of us mis/use the Internet by installing apps that we know collect our data. We tweet, share, post, repost, reshare, retweet, and say little (if anything!) about the dangers of the platforms that we use.  It is a “risk worth taking to connect with friends and family online.” 

We partake in this ocean of data collection platforms because, like the cheeseburger, we are willing to willingly trade our personal data and intimate details of our Internet behavior to strangers for something that we want even though we know it is not good for us.  And like eating a cheeseburger yesterday, a new day begins today, and we are seemingly unharmed from yesterday’s use of these platforms, which encourages us to eat another cheeseburger (I mean, log into TikTok again).  We justify this unbalanced trade so that we can “connect” with friends and family online.

TikTok is like a triple stack, bacon cheeseburger.

Every person working in any aspect of “information security”, from the IT admin to the deep-diving forensicator, knows all about how social media platforms are purposely developed for the collection of data of its users. We know without doubt that the sole purpose of these platforms (ie, the code) is to collect personal data from users to specifically sell it. Yet, here we are using them, to connect to friends and family.  To be honest, we also know that one day, all of the unhealthy cheeseburgers will hit us hard one day. But we ignore that warning.

We are all breached

In defense of using “malicious” social media platforms, I hear the argument often that since the breaches have already happened, we have nothing left to lose.  It is true that our personal data has been breached, leaked, stolen, and sold multiple times. Our DOBs, SSNs, and mother’s maiden names have all been collected by hackers many times over and we used to treat our DOBs and SSNs as practically TOP SECRET information! But now, for less than five bucks, you can get anyone’s DOB and SSN in minutes.  For a little physical effort on a keyboard, you can probably find it for free.

The point that I stress is that our behavior is being collected. Our behavior speaks volumes more than our biological identity, especially when behavior is tied to an identified person.

Sure, when Facebook monitors your website visits, this is collecting your behavior, but even that is not what I am talking about. Facebook wants your browsing history and purchasing history so that it can make money from your Internet behavior. If Facebook informed every user in big, colorful letters that it is providing Facebook free in exchange for users’ Internet history and personally identifiable information, they would lose exactly no users. No one cares because the effect is almost unnoticeable. By the way, I am not defending Facebook in the least bit.

An entirely different level of ‘breached’

I consider every social media platform as malware even as I also use social media. How bad is that!?!  The most devasting impacts of social media platforms is not the selling and reselling of our phone number in order for a company to sell us something. It is not about being sent targeted ads. It is about the type of our information that is not being sold which is the worst kind of breached: our offline behavior.

Online dis/mis/information directly modifies our offline behavior, both intentionally and unintentionally by Internet platforms and other users. A person or persons in one country can cause a person in a different country to behave against their best interests or against the interests of their own country through misinformation, disinformation, and even with bullying online behavior. This can happen to corporations and even to governments, or more accurately, by corporations and governments.

We know it, but we ignore it, because we like cheeseburgers

TikTok is clearly malicious. Your PII and offline behavior are both being captured.  TikTok is malicious in the clear definition of being malicious. Data is collected surreptitiously for bad purposes, in the sense of marketing of “TikTok is totally free; we are not taking any personal information <wink wink>.”

A guy on reddit reversed engineered #TikTok

Here’s what he found on the data it collects on you

It’s far worse than just stealing what’s on your clipboard: pic.twitter.com/oqaQyYDXT2

— Dan Okopnyi 🇺🇦 (@d1rtydan) June 28, 2020

This is an unstoppable train

The train has left the station: Offline behavior of geolocation data, smartphone contacts, IP addresses, personal photos, bank account information, connected apps, the places you regularly visit, the routes that you regularly use, and the dates and times of your travels and destinations. All of this is in the hands of the developers of the apps on your device.

With the right machine learning, the right artificial intelligence, and the right intuitive design of an effective operation, you could start riots, create race wars, bankrupt corporations, shutdown economies, sway elections, and even start kinetic wars between countries based on this information.

No, I am not overreacting

In 2013, in a book that I wrote, I stated that “…mobile devices are practically an attached GPS device on the user.”  I should have added “…without needing probable cause for a warrant.”  And could have added, “…and can be used as an effective behavior modification device.”

All of this is already happening. It’s not a new method of warfare. Psychological operations have employed for many wars for as long as humans have warred.  The only difference is that with the Internet, PsyOps is more effective, easier, and quicker to see results. Where a few decades ago, a PsyOps campaign may not see results for months or years, we can see results in mere days and hours. Push the right buttons on the right person and a riot is sparked.  Our devices not only give our location but also collecting the identity of those near us who also have connected devices. Think about it: a gathering of any social group can be completely identified in minutes by date, time, location, and the personal contacts between people based on the physical distances of each person's mobile device.  What could you do with that information if you wanted to modify the behavior of a group?

I am past preventing the misuse of PII or collection of offline behavior. I think all of us should move past that, including our government. For as long as people use the Internet, this information will be collected maliciously or with consent. The more effective measure is what to do about the effects of what we cannot control. How do we correct our misdirected behavior created by trolls and enemies? How do we separate what is fake from what is real? What is our countermeasure?

We can ban malicious apps today, but without question, others will come tomorrow. Apps that we assume to be non-malicious today can easily turn malicious with the change of a few lines of code at any time of use. If not the app itself, malicious insiders will always, and have always, stolen and sold information to adversaries. We can't blot out the sun but we can put on sunscreen.

A forensics-thinking approach

One thing about the digital forensics mindset is that everything in the electronic data world is questioned during an analysis. No competent forensic analyst will blindly accept the date of a file as being the actual date of the file without some corroborating data. One point of circumstantial evidence is just an opinion.  We need more than a single point of data to separate a fact from opinion.

The same holds true for every social media platform. We cannot blindly accept that our use of any platform is free from being used to harm others or ourselves by malicious actors or even the platform provider (sometimes they are the same!).  Bots, puppet accounts, and hijacked accounts are most always trusted at first glance, and many times, continue to be trusted until it is too late.

Question everything that makes you question questions

One of the traits that makes a good investigator is listening that little voice in your head that asks, “Why…”.  You have an ability that raises red flags and gives doubt, but you have to act upon that ability. Humans are too quick to accept what they see or hear, and thereby not question it.  Have you ever walked into a new restaurant, got a bad feeling, ate there anyway, and ended up regretting it? That's what I mean. Find the answers to the questions of the little voices* that you hear.

In a digital forensic case, acting on uncorroborated evidence can result in case dismissals, or worse, wrongful convictions. In the offline world, acting on uncorroborated information can result in personal and physical attacks on innocent people or worst, the complete breakdown of a society.

There are no coincidences

I did some time in military intelligence units and one of the things that I learned was that there is no such thing as a coincidence. Anything that happens, happens for a reason and someone was behind it happening. I carried that experience and training into undercover investigations in law enforcement by creating "coincidences' in my cases. It was a simple op to gather intel on criminals and 'coincidently' to bump into them to develop relationships without having to be introduced. These planned coincidences resulted in going from zero in a case to practically being #2 or #3 in an organization.

The Internet is no different. There are no coincidences on the Internet. Everything has a purpose and plan. Whether individuals create dissent, or they are useful idiots in a bigger operation by organizations or nations, consider that there is something behind everything if it is on the Internet. More so with the "free" social media platforms.  You are not the product in these scenarios. You are the pawn.

The hard way of surveillance

At a federal task force, my group needed to come up with a plan to install listening devices in a house. The house was irregularly occupied and of course, always locked. The team that actually installed the devices had a plan. We created a 'power-line down' ruse in the neighborhood to stop all incoming traffic, the install team broke into the house through the garage, cut a hole in the wall to access a room, installed the devices and software, repaired the hole that they cut out, and left undetected. That was a major operation and the occupants didn't have a clue until they read the affidavit...

In another case, I needed to install a hardwired-GPS on a vehicle that was extremely difficult to catch at a place for the installation. The only way feasible was to get a search warrant to steal the car, order a key from the manufacturer, install the GPS after 'stealing' it, and then "report" the stolen car to local PD as a stolen recovery.  Again, lots of work just to install a GPS.

Today, if I were a spy and wanted to do these things, I would walk down the hall to the computer team and request development of a free, social media app. Then I would market it like crazy to the country/countries of choice.  And monitor it and wait until my targets, or the children of my targets, or the friends of my targets installed the app. Then I would be in their home, quite literally in the sense of being able to hear and see anything. And potentially influence them. Or I could influence the populace slightly by pushing a few key users into a pre-planned direction of disruption. Not that this could be happening now.........I wonder if I could get law enforcement officers, political figures, movie stars, and their children to use my app?

A step in the right direction

Be prepared to address what is coming. Be prepared with solutions to the problems when people start complaining. When your government wants to implement an overreaction to a perceived problem, be prepared to have a better-measured response. 

Consider the current encryption debate. The government can’t break encryption, so their solution is banning encryption altogether (a backdoor is an encryption ban, fight me if you want). Any person in information security knows that this is not only an over-reaction, but it will be the biggest detriment to security in the history of security. There are better solutions. One would be for investigators to do better jobs in their investigations rather than outright ban encryption.

We are all smart enough to know what is happening with the breaches, the leaks, and the malicious social media platforms. If the data is not being sold for profit, it is being caressed into a format useful for warfare (cyber or otherwise).

As a side note, every country is doing this to their own countries in the search of potential dissidents and criminals. Remember that what you do today may be illegal or unacceptable tomorrow. Some governments may allow for the past to go unpunished, which other governments may (will) retroactively punish past behavior that was legal at the time but subsequently made illegal.

You Should Already be in Condition Yellow

Anyone working in the infosec field should be in Situational Awareness Condition Yellow. Being aware of threats now decreases the time between identification and action which thereby increases your odds of success to handle threats.

Of course, we are aware of the threats that the Internet holds for society. From cyberbullies pushing victims toward suicide through nation-states creating internal turmoil in their enemy’s countries using online PsyOps. But being aware is only one step. We should be thinking of countermeasures and remedies.

Be ready for when those in Condition White begin to overreact, you can bring them down to Yellow when they go straight to Red without a plan. No one wants to hear from complainers without solutions, and by being ready with something, you will be further ahead and maybe we can get this right the first time.

Until then, cut back on the cheeseburgers because the day to pay up for those burgers will be here soon enough.

 

 

 

 

 

 

 

*by little voices in your head, I mean "gut feeling", "intuition", "bad feeling", "paranoia", or anything else describing the feeling that something not quite right.

Tweet
Share on Pinterest
0
Should you improve your DFIR skills on your person...
Jessica Hyde and I talk about forensic stuff

About the author

Brett Shavers

Brett Shavers

 

Comments

No comments made yet. Be the first to submit a comment
Guest
Saturday, 23 January 2021

Captcha Image

By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/

direct link

Brett's blog

Posts List

Tag Cloud

tor browser 4cast winfe X-Ways Forensics North korea book case studies training expert Placing the Suspect Behind the Keyboard University of Washington Bitcoin Forensics phishing X-Ways Forensics Practitioner's Guide investigations privacy investigation Hiding Behind the Keyboard windows fe Registry Forensics bitcoin wiretap forensics bitcoin forensics writing presentations Virtualization email gmail dfir imaging windows forensic environment Windows Forensic Environment surveillance Volume Shadow Copy Jimmy Weg RegRipper Hacker

Search Blog

Most popular posts

Brett Shavers
Brett Shavers
06 December 2015
RegRipper
RegRipper
Digital Forensics
The short story-if you want RegRipper, get it from GitHub (don't download it from anywhere else)http://github.com/keydet89What is RegRipper?RegRipper was created and maintained by Harlan Carvey. ...
0
38743 Hits
3 comments
Read More
Brett Shavers
Brett Shavers
25 April 2019
Game of Thrones, DFIR Style
Game of Thrones, DFIR Style
Digital Forensics
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little deeper. Actually, I didn’t have to dig far at all to find trul...
0
37228 Hits
0 comments
Read More
Brett Shavers
Brett Shavers
10 September 2019
The Five Stages of the DFIR Career Grief Cycle
The Five Stages of the DFIR Career Grief Cycle
Digital Forensics
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig, that I was honored that he agreed to write the foreword of a book that Eric Zimmerma...
1
36763 Hits
0 comments
Read More

Magnet Forensics Conversation

DFIR Training

Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.


Even better, support DFIR Training by subscribing at https://www.dfir.training/subscribe-3 and get access to multiple online courses in digital forensics with included ebooks!

More posts

Date
Date
  • When OSINT is turned into the Baseball Bat of Internet Mob Justice

    When OSINT is turned into…

    When OSINT is turned into the Baseball Bat of Internet Mob Justice

    We are of a curious mind, we the forensic examiners, private investigators, OSINT professionals, and journalists. Our work is for the public good, and we…

    Thursday January 14

    by Brett Shavers

    5555 hits / 0 comments

  • I took a look at Instagram's Terms of Service so that you won't have to.

    I took a look at…

    I took a look at Instagram's Terms of Service so that you won't have to.

    Who really reads the Terms of Service anyway?Are EULAs and TOSs intentionally designed as multi-page, single-spaced, 4 font, legalized writing to confuse users or simply…

    Saturday December 26

    by Brett Shavers

    8534 hits / 0 comments

  • White Paper: The Susceptibility of Interconnected Devices in a Global Concept as Surveillance Affects the Consumer-user

    White Paper: The Susceptibility of…

    White Paper: The Susceptibility of Interconnected Devices in a Global Concept as Surveillance Affects the Consumer-user

    I read an article that China used technology to spy on users via their phones (https://www.theguardian.com/us-news/2020/dec/15/revealed-china-suspected-of-spying-on-americans-via-caribbean-phone-networks). Here is my white paper analysis.#1 - If...

    Wednesday December 16

    by Brett Shavers

    4651 hits / 0 comments

  • How long does it take to get into the DFIR field?

    How long does it take…

    How long does it take to get into the DFIR field?

    Question I received: How long does it take before I can expect to get into a DFIR career?Answer: It depends!It depends on your available resources +…

    Thursday November 12

    by Brett Shavers

    14893 hits / 0 comments

  • An expert is just one page in a book ahead of you

    An expert is just one…

    An expert is just one page in a book ahead of you

    Let me dispel your notion of what an “expert” is. An expert is someone who has more information than you. That’s it. Imagine being stranded…

    Friday October 30

    by Brett Shavers

    5825 hits / 0 comments

  • Should you improve your DFIR skills on your personal time?

    Should you improve your DFIR…

    Should you improve your DFIR skills on your personal time?

    Almost two years ago, I wrote about burning out in DFIR (“Only race cars should burn out"). I still stand by what I wrote at…

    Friday September 04

    by Brett Shavers

    28344 hits / 0 comments

  • TikTok is like a big, greasy cheeseburger. We know it is bad for us, but don't care.

    TikTok is like a big,…

    TikTok is like a big, greasy cheeseburger. We know it is bad for us, but don't care.

    Short version: Any social media platform can be compared to the biggest, greasiest cheeseburger that you can find.  You know that the cheeseburger is unhealthy,…

    Tuesday July 07

    by Brett Shavers

    24018 hits / 0 comments

  • Jessica Hyde and I talk about forensic stuff

    Jessica Hyde and I talk…

    Jessica Hyde and I talk about forensic stuff

    Jessica Hyde of Magnet Forensics sat down together (virtually...) to talk about forensics.  In case you missed it, here it is!

    Thursday June 11

    by Brett Shavers

    10735 hits / 0 comments

  • Facebook Spoofing: Your Reputation, Investigations, and Massive Data Collection

    Facebook Spoofing: Your Reputation, Investigations,…

    Facebook Spoofing: Your Reputation, Investigations, and Massive Data Collection

    A “new” article on imposter Facebook accounts was published today in the Philippines.  I put “new” in quotes because this is not a new issue,…

    Sunday June 07

    by Brett Shavers

    2662 hits / 0 comments

  • You do not want to work in DFIR.

    You do not want to…

    You do not want to work in DFIR.

     The fantasySo many people ask how they can start a career in the DF/IR field, which is completely understandable. The glamour is there. Hollywood shows…

    Thursday June 04

    by Brett Shavers

    3278 hits / 0 comments

  • COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.

    COVID-19’s Investigative Impacts on Digital…

    COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.

    The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…

    Saturday April 25

    by Brett Shavers

    16858 hits / 0 comments

  • Mini-WinFE 10 and WinFE 10 Updated

    Mini-WinFE 10 and WinFE 10…

    Mini-WinFE 10 and WinFE 10 Updated

    The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded.  I update WinFE developments (including the downloads for…

    Sunday April 05

    by Brett Shavers

    10816 hits / 2 comments

  • Eat your broccoli first

    Eat your broccoli first

    Eat your broccoli first

    Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…

    Saturday January 18

    by Brett Shavers

    30970 hits / 0 comments

  • The Second Decade of the 2000s is almost over!

    The Second Decade of the…

    The Second Decade of the 2000s is almost over!

    We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…

    Thursday December 26

    by Brett Shavers

    10720 hits / 0 comments

  • Public Records

    Public Records

    Public Records

    I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…

    Thursday December 12

    by Brett Shavers

    5221 hits / 0 comments

  • The Five Stages of the DFIR Career Grief Cycle

    The Five Stages of the…

    The Five Stages of the DFIR Career Grief Cycle

    I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…

    Tuesday September 10

    by Brett Shavers

    36763 hits / 0 comments

  • Our World is Going to Turn Upside Down with DeepFakes

    Our World is Going to…

    Our World is Going to Turn Upside Down with DeepFakes

    The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…

    Sunday September 01

    by Brett Shavers

    4455 hits / 0 comments

  • If you are comfortable in DFIR, you might be doing it wrong

    If you are comfortable in…

    If you are comfortable in DFIR, you might be doing it wrong

    I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…

    Thursday August 29

    by Brett Shavers

    4803 hits / 0 comments

  • Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp

    Everything I Needed to Know…

    Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp

    You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits.  In fact, you can probably enjoy the…

    Saturday August 17

    by Brett Shavers

    6431 hits / 0 comments

  • Personality of a computer

    Personality of a computer

    Personality of a computer

    From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…

    Wednesday July 31

    by Brett Shavers

    5082 hits / 0 comments

© 2021 Brett Shavers