[HN Gopher] The importance of favicons in website OSINT research
___________________________________________________________________
The importance of favicons in website OSINT research
Author : osintme
Score : 74 points
Date : 2025-01-20 23:13 UTC (3 days ago)
(HTM) web link (www.osintme.com)
(TXT) w3m dump (www.osintme.com)
| seethishat wrote:
| This is a pretty neat idea. I like it. However, the inaccuracy of
| IP geolocation services causes some Amazon AWS IPv6 addresses to
| appear to be located outside the US when they are not.
|
| I continue to believe that half (or more) of all security
| reports/warnings are false positives due to inaccuracies such as
| this.
| soheil wrote:
| Why would anyone think favicons are worth writing a pseudo-
| security article about.
| 1970-01-01 wrote:
| It's not the icon, it's the hash value. If it doesn't match a
| known hash, you have an imposter. Full stop.
| praash wrote:
| No - the point is to quickly detect random websites that
| simply duplicate known favicons! Matching hashes can only
| occur in these cases:
|
| - the site is a careless impostor
|
| - the site is the real deal
|
| - a hash collision
| 1970-01-01 wrote:
| We agree here. The point is to detect imposters via
| favicon. Case 1 is easy, simple, and a legitimate concern.
| Case 2 is the inverse of case 1. A host is misconfigured or
| something. Much harder to detect, but no more important.
| Case 3 should not exist.
| toast0 wrote:
| > Case 3 should not exist.
|
| Case 3 must exist by the pigeonhole principle given that
| the hashes are smaller than most favicons. Otoh, if it
| does show up, you can exclude it by doing a full
| comparison.
| HeatrayEnjoyer wrote:
| If it does show up you go play the lottery where the odds
| are far less long.
| likeabatterycar wrote:
| If that was true, we could finally abandon PKI and just use
| favicons...
| 1970-01-01 wrote:
| Marry the favicon sha256 hash with a list of hostnames and
| put the values into trusted database..
| gs17 wrote:
| The "practical example" in the article is the exact opposite
| of that, it searches for the hash of a known favicon and
| filters to sites that shouldn't match it but do. It would
| require a particularly incompetent attacker (or a very
| contrived case) to not match the favicon of a public website.
| nunobrito wrote:
| Quite a mediocre article. Suspicious that it got upvoted but
| the person posting it doesn't seem to have done with malicious
| intent.
|
| So, just a waste of time for anyone hoping to see an exploit
| based on favicons.
| grajaganDev wrote:
| OSINT is not about exploits.
|
| Favicons are very useful for spotting phishing sites and
| finding forgotten servers.
| kevin_thibedeau wrote:
| This is mostly showing IoT devices that are exposed to the
| internet.
| maxmorlocke wrote:
| We review the web presence of a business as our core product
| offering for payment processors, etc. as they look to onboard
| ecomm merchants. This (and techniques like it) make a great way
| to find scummy actors and have a proveable piece of evidence as
| opposed to a 'yea, this looks off' or 'this doesn't fit the
| profile of what an established business looks like'. We
| leverage a lot of subtle signals like this.
| 1970-01-01 wrote:
| Not just websites, but anything hosting a favicon. I've used
| runZero to find vulnerable internal assets that companies swore
| were no longer an issue.
| grajaganDev wrote:
| Yes, Shodan searches for favicon hashes are a great way to find
| forgotten and vulnerable assests.
| achillean wrote:
| We released a tool to calculate the favicon hash called
| "favscan": https://blog.shodan.io/deep-dive-http-favicon/
|
| And here's a map of favicons that Shodan has seen across the
| Internet: https://faviconmap.shodan.io/
| lexicality wrote:
| I opened the map and immediately saw the (not very big) erect
| penis in the top right. The curse of having a dirty mind...
| LordDragonfang wrote:
| I'm coming to the realization that I don't really understand what
| OSINT is or is not. ("Open Source Intelligence", obviously, but
| beyond that)
|
| The first time I encountered it was in the context of civilians
| collecting actionable military intel in the Russia-Ukraine
| conflict by trolling social media. But now I see people talking
| about it like it's a career, and see what I would have standard
| IT security posted under it.
|
| Do people just use it to refer to any sort of civilian
| information gathering these days? Has IT security just rebranded
| as OSINT?
| nine_k wrote:
| I'd say it's collecting intelligence-worthy data from publicly
| available sources. That is, connecting the dots that everyone
| could connect, were they able to notice them. It does not
| involve anything but sifting peacefully through public sources.
|
| This is opposed to acquiring data by other means, like breaking
| into protected systems, stealing classified materials, planting
| moles, extortion and blackmailing, etc.
| jakub_g wrote:
| Reminds me of Google Safe Browsing capturing color profiles of
| websites and matching against known phishing websites:
|
| https://blog.chromium.org/2021/07/m92-faster-and-more-effici...
| econ wrote:
| I imagine downscaling and reducing the number of colors in steps
| could gradually increase the false positives. You would have to
| noticably change the icon to avoid it.
___________________________________________________________________
(page generated 2025-01-24 23:01 UTC)