Passive Information Leakage: Capturing My Own Activity as an Example
Let’s take the process of Passive Information Leakage down to a specific example—me visiting a competitor’s website. As chief scientist for Ntrepid, I have a number of responsibilities, but three of the most important are planning the technological course for our next products, communicating with the world about our existing capabilities and the security space in which they operate, and working with the executive team to evaluate potential acquisitions.
What about that activity might be visible to the competitor?
First off, without using Ntrepid products, it would be easy to identify my visits. After all, my IP address is easy to discover by simply sending emails to me with a remotely loaded graphic in the signature line. When the email is displayed, my IP address would be revealed. Social engineering, or even purchased IP lists, could also expose my address quite easily. Once competitors have my IP, they can also attach cookies, which would track me even when I am not at the office IP.
Given the IP, it is trivial to track my activity on the website including when I got there, what I look at, how long I linger, and more. If I am wearing my public communications hat, I would be visiting the security blog on the website to keep current and for ideas to use in my own writing. I might also keep an eye on their PR and research papers for good general information.
This is quite different than the activity I would display when I am focused on product strategy and design. In that case, I would be looking at existing product specifications, and white papers discussing the particular threats and solutions in detail. If there’s PR on patents, I would be spending more time on those pages and generally following the links to actually read the patent. My pattern of research would also tend to move from the general product groups to the specific subcomponents of certain solutions. As we came closer to product launch, I would also be spending time looking at the marketing messaging used by the competitor.
Finally, when considering a company as an acquisition target, I would be looking at any financial disclosures, press releases with specific sales or other metrics, as well as the profiles of each of the company leaders.
Of course, I don’t work in a vacuum here at Ntrepid, so others in the appropriate teams would also be conducting similar patterns of activity, which would also be easily visible. By simply tracking my activity, and probably the activity of my coworkers, the competitor can tell if I am thinking about them, and they know what mode I am in.
They can tell what stories I might write about.
They know which kinds of products I am developing.
They know if I am contemplating some kind of M&A activity aimed at them.
They could probably even tell when I have gone on vacation, or am traveling to a conference, which might expose me to different kinds of attacks from hackers rather than competitors.
Passive Information Leakage – Part 4
Passive Information Leakage – Part 2
