In this video we're going to talk about sock puppets.
So sock puppets are extraordinarily important when it comes to things like open source intelligence
investigations, uh, pen testing and whatnot.
So sock puppets are also sometimes referred to as a burner account.
This is alternative account.
It's a alternative email username, fake identity, etc..
This is no way associated with this.
And we also don't want anything tying this back to us.
So if we have a sock puppet we typically have a again a email address.
We want to make sure that email address the name does not associate with any anything about us doesn't
it's not the same username or same or similar username as our real email address.
The name of the person we have.
The username and actual name that you register your account on.
Don't use your real name.
Uh.
Don't put your real location down or anything like that.
Uh, same with phone numbers, social media accounts.
Uh, your social media accounts do not add people that, you know, don't add yourself.
Uh, don't add your real job.
Don't add to where you really went to school, things like that.
So typically we use alternative name location again username, email address, physical address, phone
number, fake profile pictures, job titles, employer, etc..
Uh, you shouldn't use.
Also, you shouldn't use any password that you use with your real accounts because things like data
breaches and we'll look into data breaches and whatnot.
You don't want someone going, hey, this unique password matches this other person that I can't find
information on.
Well, that's interesting.
You don't want that to happen.
Sockpuppets are there to protect us.
And how complex a sockpuppet is will depend on how complex we need it to be.
So certain sock puppets I have are just an email address, a username, etc. others are far more detailed.
I have profile pictures, I have fake addresses, fake social security numbers, fake phone numbers,
fake jobs, uh, and so forth.
Uh, as much detail as a real person.
Now, you don't always need that in every case.
But certain situations, you do want to have a more complex sock puppet.
So why would we need a sock puppet anyways?
Well, again, if we're doing an investigation, we're investigating a criminal.
We're going into a dark web form, a clear web form, etc. that is someone that's potentially dangerous.
We don't want that.
And while we're investigating this dangerous person, we don't want that person be able to and to do
the same back to us and find out who we really are.
Because, again, we might be dealing with some dangerous people.
And, um, we really don't want something to happen that where they go, hey, this person was investigating
me.
Hey, I know who they really are.
Let's go do something back to them.
Either, uh, hacking, doxing or, um, in some cases, actually coming and actually hurting you,
hurting your friends, hurting your family, things like that.
And things like adversary Simulation.
The bad guy or bad girl?
Um, will also use, uh, sock puppets.
So sock puppet creation example.
So again, just to recap, sock puppets can help protect our, uh, protect us and our real identity.
Sock puppets can be made to appeal to a certain target also.
So if I'm if I'm looking into, say, a Russian criminal forum, I may pose as a Russian person.
Russian name.
I register under a location in Russia, things like that.
Or.
Locations that are friendly to Russians.
Uh, Russia rather.
Um, again, never, ever use any real information that ties back to you.
That includes names, addresses, phone numbers, passwords, friends, families, workplace, etc..
So this was about sock puppets.
Thank you for watching.
I'll see you next video.