帝企鹅日记focat rainingen.pptx

FOCA 2.5.5Chema AlonsoWhat’s a FOCA?FOCA on Linux?FOCA + WinePreviously on FOCA….FOCA 0.XA document isWhat you see…And what you don′tTemplate pathsUsers worked in it.Departments.File Printing ServersVersion HistoryEmbedded files…Metadata:Information stored to give information about the document.For example: Creator, Organization, etc..Hidden information:Information internally stored by programs and not editable.For example: Template paths, Printers, db structure, etc…Lost data:Information which is in documents due to human mistakes or negligence, because it was not intended to be there.For example: Links to internal servers, data hidden by format, etc…What kind of data can be found?MetadataWrong managementBad format conversionUnsecure optionsWrong managementBad format conversionUnsecure optionsNew appsor program versionsSearch enginesSpidersDatabasesEmbeddedfilesHidden infoLost DataEmbeddedfilesMetadata LifecycleMetadata Risks“Secret” relationshipsGovernment companiesCompanies providersPiracy discoveryReputationSocial engineering attacksTargeting Malware2003 – MS Word bytes Tony BlairTargeting MalwareTargeting MalwareElecting the entry pointWhy you should be using FSLinux installation guideSocial Engineering AttackMetadata created by GoogleLost DataLost data everywhereMetadata in Search EnginesPictures with GPS info..EXIFREADERhttp://www.takenet.or.jp/~ryuuji/Even Videos with users…/2422-14075_11-207247.html/2422-14075_11-207247.html And of course, printed txtOLE StreamsIn MS Office binary format filesStore information about the OSAre not cleaned with these ToolsFOCA finds this infoOffice documents:Open Office documents.MS Office documents.PDF Documents.XMP.EPS Documents.Graphic documents.EXIFF.XMP.Adobe Indesign, SVG, SVGZ (NEW)FOCA: File types supportedUsers:Creators.Modifiers .Users in paths.C:\Documents and settings\jfoo\myfile/home/johnnyfOperating systems.Printers.Local and remote.Paths.Local and remote.Network info.Shared Printers.Shared Folders.ACLS.Inter