OSINT Social Media Intelligence 3 — Questions and Answers
Question 1: What is a 'dark pattern' in the context of social media data harvesting?
- A method for accessing the dark web through social platforms
- A deceptive UI design that tricks users into sharing more data than intended (Correct answer)
- An encrypted channel used by intelligence agencies
- A type of malware that steals social media credentials
Correct answer: A deceptive UI design that tricks users into sharing more data than intended
Dark patterns are manipulative user interface designs that deceive users into consenting to data collection or sharing more information than they realize.
Question 2: Which tool is specifically designed for bulk harvesting and archiving of Twitter/X data for OSINT purposes?
- Maltego
- Twint (Correct answer)
- Shodan
- SpiderFoot
Correct answer: Twint
Twint is an open-source Twitter intelligence tool that scrapes tweets without using the API, bypassing rate limits for bulk data collection.
Question 3: In OSINT, what is 'astroturfing' on social media?
- Hiding content behind location-based geofences
- Creating artificial grassroots support using fake or paid accounts (Correct answer)
- Scraping social media data from mobile applications
- Bypassing two-factor authentication on social platforms
Correct answer: Creating artificial grassroots support using fake or paid accounts
Astroturfing is the practice of creating a false impression of organic public support using coordinated fake accounts or paid participants.
Question 4: Which technique is used to extract location data from a social media user's photo without accessing the image's EXIF data directly?
- Reverse geolocation via background landmarks (Correct answer)
- DNS lookup of the media server
- SSL certificate analysis
- Analyzing the platform's CDN routing
Correct answer: Reverse geolocation via background landmarks
Analyzing visible landmarks, skylines, signs, or environmental clues in a photo's background can reveal a location even when EXIF data has been stripped.
Question 5: What does 'account takeover' mean in the context of social media threat intelligence?
- When an OSINT analyst creates a duplicate of a target's profile
- When a malicious actor gains unauthorized access to a legitimate social media account (Correct answer)
- When a platform acquires another social media company
- When a brand repurposes an inactive username for marketing
Correct answer: When a malicious actor gains unauthorized access to a legitimate social media account
Account takeover occurs when a threat actor compromises a legitimate account's credentials to use it for malicious purposes such as spreading disinformation.
Question 6: Which analytical framework is commonly used to map influence operations discovered through social media OSINT?
- STRIDE
- PASTA
- DISARM (Correct answer)
- DREAD
Correct answer: DISARM
The DISARM framework (Disinformation Analysis and Risk Management) is specifically designed to categorize and analyze influence operations and information warfare tactics.
Question 7: When analyzing a Facebook group for OSINT, which feature provides the most historical data about group activity and membership changes?
- The group's About section
- Member list sorted by join date (Correct answer)
- The group's Media tab
- Pinned posts from administrators
Correct answer: Member list sorted by join date
Sorting the member list by join date reveals when members joined the group, which can indicate recruitment waves or coordinated activity spikes.
OSINT Social Media Intelligence 3
What is a 'dark pattern' in the context of social media data harvesting?