Episode 259: Capture The Flag!

Summary

Podcast Summary: "What the Hack?" Episode 259: Capture The Flag!

Release Date: July 7, 2026
Host: Beau Friedlander
Guests: Nicholas Olson (Associate Security Engineer, DeleteMe), Ethan Merritt (Victim & Colleague), Unidentified OSINT Researcher

---

Overview

This episode dives into open source intelligence (OSINT) and digital privacy using a real-world hacking challenge called "Capture the Flag." The DeleteMe team, led by Nicholas Olson and an unnamed OSINT researcher, is tasked by their colleague Ethan Merritt to uncover four "flags"—personal facts hidden online about Ethan—to demonstrate just how much personal information is available through publicly accessible sources. The episode is both a hands-on hacking exercise and an exposé about how everyday digital traces put all of us at risk, especially through the actions of those around us.

---

Key Discussion Points & Insights

1. OSINT and Exposure: What Is OSINT? (00:47–04:22)

• OSINT is gathering publicly available information, not hacking into systems.
• Common sources: social media, court filings, public records, photo metadata, and more.
• Even if you think you’re "safe" online, your network—family, friends, neighbors—can inadvertently leak your data.

Notable Quote:

"OSINT is the Zen of surfing. The raw material of the surveillance economy."
— Unidentified OSINT Researcher (01:56)

---

2. The Capture the Flag Challenge: Setup and Stakes (05:35–08:51)

• Ethan volunteers to be "hacked" to demystify how attackers operate with public data.
• The Four Flags:
  1. Ethan's love interest
  2. His sister
  3. His sister's husband (brother-in-law)
  4. His current roommate

Notable Quote:

"Everyone we know gets hacked. Everyone we know gets us hacked."
— Beau Friedlander (06:41)

---

3. Identifying Weaknesses: Social Media and Oversharing (08:06–09:40)

• As a podcast host and public figure, Ethan's widened digital presence increases his vulnerability.
• The team stresses influencers and people building personal brands are more exposed.

Notable Quote:

"What a lot of social media influencers or people with a personal brand tend to do is they tend to overshare quite a bit."
— Nicholas Olson (08:21)

---

4. Hacking Techniques: The Power of Basic Tools (09:40–13:13)

• People Search Sites (Spokeo, White Pages, etc.) aggregate vast records with little effort.
• These services can quickly yield everything from addresses to the names of neighbors—potential leads for more significant hacks.
• Discussion on the dangers of voice cloning for public personas.

Memorable Segment:

• Concerns about voice phishing scams and the value of safewords for family protection.

"...You have a five second voicemail sounding like your kid saying 'Hey, I need help. Send me money.' ...How do you confirm that's them?"
— Nicholas Olson (12:35)

---

5. Flag by Flag: Step-by-Step OSINT (14:45–32:38)

Flag 1: Love Interest (14:45–17:12)

• Start with Google + social media posts, especially firsts and uncurated early content.
• Look for connections—likes, tags, comments—between potential matches.
• Found via pattern of mutual likes and prior interaction—even when not overtly linked.

Flag 2: Sister (17:12–22:28)

• Surname search on following/follower lists.
• Facebook proves especially leaky—family over-shares, old prom photos.
• Determined sister's identity through relationship clues, confirming via university and sports involvement.

Flag 3: Brother-in-law (24:08–26:47)

• Identified through photos with family and specific tagged events.
• Aggregated from several small clues—comments, group pictures, and name-drops.

Flag 4: Roommate (26:55–31:56)

• Used leaked email addresses and breached password aggregators ("Have I Been Pwned", "Snusbase") to unearth connections.
• Combined with property records and direct “social engineering” phone calls to buildings.
• Identified current living situation without disclosing address for privacy.

Notable Quote:

"He has quite a history of reuse. It was his sister’s cat followed by his date of birth. And it is something that he used constantly."
— Nicholas Olson on password reuse (28:32)

---

6. Lessons Learned: The Danger of “Leaky” Social Networks (34:41–42:26)

• Biggest takeaway: You are only as private as your least careful friend or family member.
• Unintentional details—photos of pet medication, group shots, Amazon reviews with home decor—are powerful in aggregate.
• Social engineering extends to direct outreach (e.g., posing as TV producers to confirm contacts).

Notable Quotes:

"Your folks are wide open privacy-wise on Facebook."
— Unidentified OSINT Researcher (35:21)
"A big portion of what this exposure came down to was not only responding to things that you knew were kind of fishy... but additionally it was posting things like your daughter being there for you could just say your daughter. You don’t need to say where she’s flying in from."
— Nicholas Olson (37:04)

---

7. Final Takeaways and Recommendations (43:32–46:51)

• Limit what you publicly share (draw a line between "public" and "private").
• Help family and friends lock down privacy settings; offer hands-on help if needed.
• Accept that the threat model changes for public figures/content creators—the more exposure, the more risk.
• The only way to be totally safe is to have no digital presence, but practical steps can help.
• Promote ongoing education with initiatives like DeleteMe’s "Going Ghost Invisibility Tour"—live sessions to teach teams real-world privacy controls.

Tinfoil Swan Paranoid Takeaway (47:12):

"Talk to your family members who overshare about their privacy settings... You are only as private as the people around you sharing about you."
— Unidentified OSINT Researcher (47:12)

---

Segment Timestamps

| Time | Segment/Content | |-----------|-----------------------------------------------------------------------| | 00:47 | Defining OSINT and its power in digital life | | 04:00 | Introduction to the Capture the Flag challenge | | 08:21 | Social media as a main vulnerability point | | 12:18 | Importance of family safewords, voice phishing risks | | 14:51 | Start of live OSINT: finding the love interest | | 17:12 | Pivots to finding Ethan’s sister | | 24:08 | Tracking down brother-in-law | | 26:55 | Roommate discovery via breach data and phone/social engineering | | 34:48 | Ethan’s reflections on his vulnerabilities | | 37:44 | Nicholas’s advice on oversharing and privacy | | 43:32 | Summary advice: what to share, family risk, memoirists’ perspective | | 45:30 | Announcing the Going Ghost Invisibility Tour for companies | | 47:12 | Tinfoil Swan: Takeaway action – lock down friends/family privacy |

---

Memorable Moments & Quotes

• "OSINT is the Zen of surfing." – how easy and effortless it can be (01:56)
• "You're only as private as the people around you." – core episode message (47:12)
• "Everyone we know gets us hacked." (06:41)
• "He has quite a history of reuse. It was his sister’s cat followed by his date of birth." – Password pitfalls (28:32)

---

Conclusion

This episode is both a cautionary tale and a practical lesson on the sheer scale of data exposure via OSINT—aimed at anyone with a digital life. The "Capture the Flag" challenge compellingly demonstrates that even informed, security-conscious individuals can’t escape the risks when friends and family are part of the equation. The hosts urge vigilance, proactive privacy setting management, and, crucially, ongoing education for yourself and your network.

Actionable Takeaway:
Review your privacy settings and those of your family. Think before you (or anyone else) share innocent details—they can be clues for someone determined enough to connect the dots.

---

For more information or to book DeleteMe's Going Ghost Invisibility Tour:
Contact Ethan Merritt via LinkedIn.

Closing Thought:
"Neighborhood Watch doesn’t cut it anymore. Maybe you need a Neighborhood No-Data-Online zone."
— Paraphrased from closing Tinfoil Swan (47:12)

---

Transcript

[Beau Friedlander]

And we're live from the living room as Doug eyes up the match. Say spread. He's reaching for the buffalo wing. Perfect. Hang on. What's this? Oh, he's gone for a can of Pepsi too. Incredible. What a finish. Sensational combination. Look at the delight on his face. There's no doubt about it. It just tastes better. Match days deserve Pepsi. Food deserves Pepsi. Grab a pack of Pepsi. Zero sugar for today's match. It's poetry in motion. This.

[Nicholas Olson]

This person is interesting, but her profile is private. See your stories. So th. This person is from. I have somebody by the name of.

[Unidentified OSINT Researcher]

Yeah, I have her. Open source intelligence. You've heard me talk about this before. Probably. Probably. Ranting Open source intelligence. Osint. It's not hacking. Nobody's breaking into anything. It's. It's just looking at what you posted, at what your family posted, or your neighbor or your love interest, your boss, what you tagged, what they tagged. Hashtags. That's right. You don't even have to be on the platform. Someone can just hashtag your name. It could be what your phone timestamps in a photo's metadata. Maybe there's a court filing that should be sealed, but oops, it's not. Peace. Enough of that. Digital flotsam and jetsam. That's the debris and cargo from a wrecked ship to you non nautical types. And totally perfect. I'm sorry, I could say it's. That's the right. That's the right image together. Piece it together. That flotsam and jetsam. And you don't need a warrant, you don't need a badge, you don't need a camera on somebody's property. You just need some patience and imagination.

[Beau Friedlander]

Imagination.

[Unidentified OSINT Researcher]

I've spent years following the surveillance infrastructure that makes it possible for anyone to collect information about all of us without anyone asking permission. OSINT is the Zen of surfing. The raw material of the surveillance economy. Intelligence analysts use it, journalists use it, investigators use it. Even birds and the bees use it.

[Ethan Merritt]

No.

[Unidentified OSINT Researcher]

Anyway, so do scammers, stalkers, and the incel creep. Figuring out who you know to search for tagged pictures of you in a bathing suit and where you live from. Just a legible logo on a coffee cup. Maybe in the background of your Instagram story. That fleeting thing, the thing that makes OSINT so powerful, is that it can be fueled by people with many degrees of separation from you. A picture at a party. And you have no way to stop it from being out there. But the real power comes from putting it together. A geotag here, a username There. A property record, an old resume, a deleted tweet, someone archived years ago. One piece tells you almost nothing. 50 things can tell a stranger a lot of things, like where you work, who you know, where your kids go to school, and on and on. And three steps ahead.

[Nicholas Olson]

That would make sense. Dad posts quite a bit.

[Unidentified OSINT Researcher]

Boom. Got it.

[Nicholas Olson]

Did you?

[Unidentified OSINT Researcher]

It can be super invasive.

[Nicholas Olson]

We have first, metal, last in a general location. All right, so I'm gonna end up searching mom's profile to see if I can find anyone who has other profiles like Ethan's or.

[Unidentified OSINT Researcher]

I found Ethan. Oh, that tricky. Okay, Ethan's name on Facebook is Ethan, and.

[Nicholas Olson]

Oh, it is. And he owns an llc. So let's see. I want to know where that LLC was registered, so I'm gonna go ahead

[Unidentified OSINT Researcher]

and look that up real quick. And you find so much out by looking up other people connected to the person you're looking up. You being me being a person who does this. Which means no matter how safe you are or you think you are, you are. He's not tagging anybody, so he doesn't tag everybody.

[Nicholas Olson]

That is true. I'm gonna put a pin in that for a minute because I believe.

[Unidentified OSINT Researcher]

Did we get this wrong? I think we did. Maybe they just broke up.

[Nicholas Olson]

Cuz I see the family pic photo.

[Unidentified OSINT Researcher]

Oh, it's 100% his. That's his love interest. My colleague Nick and I are playing Capture the Flag. If you listen to the episode from last year's Social engineering village at defcon, you already know what that is. Capture the Flag. Okay, so basically, these are kind of hacking challenges. How far can you get into a system, an organization, a person's life? You met Ethan recently in the episode called the Bait Bites Back. Scammers were using his images from social media to catfish women all over the world and scam them out of money. And then he found them and, you know, scared them and. Well, it's a good episode. You should listen to it. He's also a colleague. We all love this stuff. So when Ethan asked Nick and I to hack him using osint, he. And capture four flags, four facts about his life hidden somewhere in the noise of the Internet or not so hidden. We were totally on board because the not so hidden was the first thought we had. Nicholas Olson is an associate security engineer at Deleteme. His OSINT skills are better than any I've come across in the wild. Are just as good, but better, I think, actually better when it comes to just looking through what's already out there online, hidden in the Everyday, the mundane Nick is very, very good. A few hours, a few phone calls, a leaked password with a cat's name in it, and a willing victim who'd already learned the hard way how exposed he could be. None of that's the lesson here. What you're going to walk away with is how everyone we know gets hacked. Everyone we know gets us hacked. If you don't send this episode to everyone you know for real, whatever you really should. I'm Beau Friedlander, and this is what the Hack, the podcast that asks. In a world where your data is everywhere, how do you stay safe online? Ethan Merritt, welcome back to what the Heck? How's it going, Ethan? You had a phenomenal idea. In the land of nerding out on data that's available online, open source intelligence means that we can find all kinds of stuff online about people. And I think, you know, the assignment that you gave me and Nicholas Olson was. Was really simple. Capture the flag, find four flags about you.

[Ethan Merritt]

I wanted to show this real vulnerable experience. I've already been targeted in the past, so I wanted to see what you guys could find that was real about me, for one, and what you might find that might be extracurricular, things that were not actually me, which there was probably a lot of that as well, since I was already previously targeted before.

[Unidentified OSINT Researcher]

So let's go through the flags. Ethan.

[Ethan Merritt]

Number one, seeing if you can find the love interest that I have.

[Unidentified OSINT Researcher]

All right. And what's flag number two?

[Ethan Merritt]

Seeing if you could find who my sister is.

[Unidentified OSINT Researcher]

Okay. And flag three?

[Ethan Merritt]

Finding out if you can find my sister's husband, who's even more elusive. And the fourth flag would be my current roommate.

[Unidentified OSINT Researcher]

All right, so Ethan Merritt, I think that he is not going to be a very difficult person to crack open. What do you think is his most obvious vulnerability?

[Nicholas Olson]

Social media.

[Unidentified OSINT Researcher]

That's Nick again.

[Nicholas Olson]

He's also a podcast host. And so I think what a lot of social media influencers or people with a personal brand tend to do is they tend to overshare quite a bit. Right.

[Unidentified OSINT Researcher]

So they're not oversharing. That's not fair, Nick. He's not oversharing. He's sharing as much as he needs to become an influencer.

[Nicholas Olson]

Exactly. And connecting with your audience is a really important thing.

[Unidentified OSINT Researcher]

Nicholas, as you know, is. Is a ridiculously good open source intelligence researcher. Now, Ethan, why don't you tell us why you thought they were good flags?

[Ethan Merritt]

Yeah, So a few of the flags were specific that I knew would be challenging. Some of them are pretty normal that somebody would want to look at. Right. So I started with understanding the fact that there's some people in my life that are fairly easy to find, that might be my family members. And fairly easy is kind of relative. And then, like, finding a love interest is somebody that actually is not that. That. That I have not promoted anywhere, that we have not been seen together anywhere at all yet. So I thought that those would be two interesting flags to kind of go with.

[Unidentified OSINT Researcher]

Yeah.

[Nicholas Olson]

Ethan has also been a target of pretty advanced catfishing in terms of he is being used as the catfish. Right. And so.

[Unidentified OSINT Researcher]

Right.

[Nicholas Olson]

Because of that, a lot of his digital footprint, he needs to be very careful about what he portrays online and portrays in media.

[Unidentified OSINT Researcher]

Well, he hasn't been. And so here's the deal. I was going to take a page out of your notebook to do something with basic people search. You know, people search sites, the white pages, the spokios, the bin verifieds of the world, all these sites, they crawl public records, they scrape them old leases, voter rolls, whatever they can scrape. And they just lay it out there for anyone who types in a name and has whatever they're charging to get that information. I didn't do anything clever here. I. I didn't need any advanced tools, actually. I didn't need a leaked database. I just searched Ethan's name and it handed me his neighbors by name, nine of them right on the screen. So I have, right in front of me, 1, 2, 3, 4, 5, 6, 7, 8, 9. I have nine neighbors of Ethan Merritt here. Every one of those neighbors are potential sources of information about Ethan. If I were trying to capture a more serious flag, one that has maybe. Maybe one that's worth some money. The people I find on people search sites present potential leads, but that's just the tip of the iceberg when it comes to the current CTF challenge. Now, Ethan's problem here is I can also use his podcast to clone his voice, and I can. I can hack him through his neighbors and a cloned voice.

[Nicholas Olson]

Absolutely. Absolutely. And I think that's. That's another big part of being an influencer, right. Is especially having your voice very publicly accessible. People can clone my voice off of what we're talking about right now. And so it makes it really, really tricky. And especially, like I said, since Ethan has been that victim of catfishing, now we have voice cloning and video cloning, and we can sound, look and be like Ethan. It's going to make him a pretty easy target for these types of things.

[Unidentified OSINT Researcher]

He's toast. No, I mean, so I I'll just tell you something very funny before we go on to exactly how we're going to toast this marshmallow. For years, I would answer scam calls like this. Because I would think, like, they're gonna spoof my voice and I'm gonna get hacked. And meanwhile, there's 350 episodes of what the hack with my voice. That's how bright I am. And this is, and this kind of is what it boils down to at the end of the day is if you do what I do and what Ethan does for a living, your attack vector is really wide open. This seems like a good time to talk about safewords to me anyway.

[Nicholas Olson]

Absolutely. And that's something I always, especially to students and young people. Right. Is in an age especially where older people are phish voice fish a lot of scams, kind of with that fear element of, hey, you need to send me money or else.

[Unidentified OSINT Researcher]

Right.

[Nicholas Olson]

Your, your son, your daughter is a victim of kidnapping. Send me money or else. And then especially using those advanced voice cloning techniques now, you know you have a five second voicemail sounding like your kid saying, hey, I need help. Send me money. I'm in so and so place. How do you confirm that's them?

[Lee C Camp]

Right.

[Nicholas Olson]

And, and always setting up that safe word in some capacity. Butterfly, Avocado, Any of these. Right. Just where you choose a random arbitrary word that people can't guess. If you say, tell me your safe word and you're on a phone call with a scammer, it's a pretty good way to tell them like you're, you're bluffing. I know you're bluffing and here's how I know.

[Unidentified OSINT Researcher]

Right. Okay, time to review.

[Nicholas Olson]

In the digital media space, like the last name is a key to a lot. If people know your legal government last name, not only is it populating on data brokers, but it's also, hey, I'm going to look this person's face family up on their social media profiles. I'm going to see if anyone related to them knows what they do, who they are. And so even with Nicholas O. Creating these identities. Right. Where Nicholas O. My last name does start with an O.

[Unidentified OSINT Researcher]

Right.

[Nicholas Olson]

But I never give that out anywhere. And even with that certain bit of information, it's much harder to get Nicholas O. Because it's a very broad spectrum of last names that begin with O. But then you start to create identities around this where I know that Nicholas Austin, right. That was an identity that I used at a jump zone or wherever I went with with nephews that I had or people that I was with. Right. Regardless of what that is, I know that that exact identity was used in this one place. And because they're calling me from this number, I know that they're doing something else with that information. And so it kind of adds to that element of just protecting your identity and. And who you are. And so Ethan, being who he is, has his full last name on display, which I. I feel like we're going to be able to use in a lot of nefarious ways.

[Unidentified OSINT Researcher]

Now it's time for the main attraction. Capture the flag. Flag 1. Find a love interest.

[Nicholas Olson]

The first thing I always like to start with is just some sort of generic Google search, right? Searching up name. And for Ethan, the first thing that pops up is a social media account that contains his name and all of these posts and all of these other things that he does. There's two places that I like to go here. One of them is tags, especially the earlier tags, if that is public in photos. And the other place I like to

[Unidentified OSINT Researcher]

go in his tags right now.

[Nicholas Olson]

And the other place I like to go is the very first post.

[Unidentified OSINT Researcher]

Why the first post? Because that's the one nobody curates. By the time you've got a following or maybe just a few hundred friends or more, you start thinking about what you post. You crop things. You skip the photo with your mom's address in the background. But that very first post, before anyone's watching, or not many people are watching, before there's anything to really protect, chances are it's just a raw sample of life. Your life, family, hometown, license plates, people in your life who actually matter. It's something people forget about. It's still sitting there because why would you delete it? There's probably some nostalgia anyway. It's still there. All right, what do we got here? This is what I'm looking for. No. So

[Nicholas Olson]

this person is interesting, but her profile's private. See your stories.

[Lee C Camp]

Hmm.

[Nicholas Olson]

So this person is from. I have somebody by the name of.

[Unidentified OSINT Researcher]

Yeah, I have her.

[Nicholas Olson]

Yeah, she looks. She looks interesting because she's definitely from this. Seems like somebody that he would be interested in. And he also was in the last time that I saw him. And so she has a tag in her story feed with her puppy from I believe. So I would assume this is probably the correct person.

[Unidentified OSINT Researcher]

All right, well, you got it faster than me. I had her in my list, but you got it faster than I did. I think that is who it is. What's her full. Her full handle the first time that

[Nicholas Olson]

they met was in know about two months ago. And so I believe love interest would be her. But nothing official as of quite yet. I know she also visited him. And so if there's some sort of confirmation there that we can find, I bet this would be the person.

[Unidentified OSINT Researcher]

Flag number two. Find the sister.

[Nicholas Olson]

So first place I'm going to go. Merit. I'm just looking in his following list for anyone with the last name of Merit.

[Unidentified OSINT Researcher]

Searching for Merit gives us a few things. It's faster with people search. Sure. Using the first data broker that pops up. That's what we did. We narrowed it down to some likely merits. Family members are a real source of online exposure. We got, we got. We got definitely mom.

[Nicholas Olson]

I'm also gonna pivot a little bit to Facebook now because people tend to overshare on Facebook more so than Instagram. And so.

[Unidentified OSINT Researcher]

Oh, here's the whole family. I already got it.

[Nicholas Olson]

Oh, I have an old prom photo of Ethan from 2010.

[Unidentified OSINT Researcher]

There's some funny pictures of him. Yeah. And there's the one his mom posted. One that he probably doesn't love either. Okay.

[Nicholas Olson]

So is someone that I'm seeing come up. Merit

[Unidentified OSINT Researcher]

is sister.

[Nicholas Olson]

That would make sense. Dad posts quite a bit.

[Unidentified OSINT Researcher]

Boom. Got it.

[Nicholas Olson]

Did you.

[Unidentified OSINT Researcher]

Who's Merit? Is that who I'm thinking it is?

[Nicholas Olson]

Yeah. And there's a lot of photos between.

[Unidentified OSINT Researcher]

No, I'm not. I'm not positive. Could be the wife of his brother.

[Nicholas Olson]

So. Yeah, I'm curious. I'm curious who Merit is because she seems to have a lot of photos with dad. Couldn't ask for a better dad. And so I would assume that this is sister because they have the same parents.

[Beau Friedlander]

Yeah.

[Nicholas Olson]

So I found personal, but it's private. Good on her. And so let's see if we can Google and just see what pops up here. So university is what I'm seeing here. What did she study?

[Unidentified OSINT Researcher]

Just out of curiosity.

[Nicholas Olson]

This is the same person for sure. She's a swimmer. Which is interesting because I know Ethan was also a swimmer.

[Unidentified OSINT Researcher]

He's not tagging anybody. So he doesn't tag everybody.

[Nicholas Olson]

That is true. I'm gonna put a pin in that for a minute because I believe.

[Unidentified OSINT Researcher]

Did we get this wrong? I think we did.

[Nicholas Olson]

Maybe they just broke up because I. I see some. I see some other ones. Is she in? Cause I see the family pic photo.

[Unidentified OSINT Researcher]

Oh, it's 100% his. That's his love interest. There's a subtle thing that just happened here that happens all the time when somebody is online trying to figure out your Digital here and now. You rub over here, shines over there. Pull this string, see what moves, it moves somewhere else. We learned more about Ethan's love interest by looking for his sister. So the more time you spend researching a person, the more information you're likely going to find about other people in their constellation.

[Nicholas Olson]

I'm going to pivot here a little bit. Knowing what we know about, we have first, middle, last, and then general location.

[Unidentified OSINT Researcher]

Right.

[Nicholas Olson]

So I'm going to end up searching mom's profile to see if I can find anyone who has other profiles like Ethan's or.

[Unidentified OSINT Researcher]

I found Ethan. Oh, that tricky. Okay, Ethan's name on Facebook is Ethan, and.

[Nicholas Olson]

Oh, it is. And he owns an llc. So let's see. I want to know where that LLC was registered, so I'm gonna go ahead and look that up.

[Unidentified OSINT Researcher]

You're just showing who you're following. He's not showing us. No, he's careful.

[Nicholas Olson]

He has an old wedding photo, which I assume is his ex wife.

[Unidentified OSINT Researcher]

Oh, here he is getting married to somebody. Who's that lady?

[Nicholas Olson]

It's a great question.

[Unidentified OSINT Researcher]

Can you pimize her? I don't think she'll show up, but I'm going to pimize her. It doesn't have to be pimized. Right. There are many. There are tons, actually, of services paid and free, mostly paid, that you can use online to identify a face, a random face.

[Nicholas Olson]

Go for it. I'm also. I'm going to. I didn't take a look at Ethan's Instagram tags from the very beginning. Because, yeah, he's tagged in a lot, but I usually the older the tags get, the more interesting things that you find. That's generally what I see. A lot of the time I'm still.

[Unidentified OSINT Researcher]

Who is this lady? All right.

[Nicholas Olson]

Yeah. Seems generally pretty private on social media.

[Unidentified OSINT Researcher]

Is that who you're going for?

[Nicholas Olson]

It really is. I think it's Sister because they share the same parents, and I think that is what constitutes a sibling. So merit is for sure. Sister. I'm pretty confident in that. But now it's figuring out husband's name because she hasn't posted on this since, you know, 2014. And so I'm pretty confident that that's Sister.

[Unidentified OSINT Researcher]

I think I can get ex wife's name. I just don't want to pay for it. She pops up twice on Pim Eyes.

[Nicholas Olson]

Well, I have her Instagram. She was tagged in it.

[Unidentified OSINT Researcher]

Yep.

[Nicholas Olson]

Tagged in a photo with Ethan.

[Unidentified OSINT Researcher]

Oh, cool. All right, so she's identified.

[Nicholas Olson]

Went ahead and close that out. And so let's see what else.

[Unidentified OSINT Researcher]

We went on like this for a while. For me, it was interesting to see the difference between the way that I would go after things and the way that Nicholas went after things. Now the way that I went after it is very simple. I thought the love interest was probably going to be the easiest one.

[Ethan Merritt]

Yeah.

[Unidentified OSINT Researcher]

Did you think the love interest was going to be the easiest one?

[Ethan Merritt]

You know, I thought that that would actually going to be a harder one for a couple reasons.

[Unidentified OSINT Researcher]

Okay. I. And for me, for the way that I do it, I was like, ah, I bet you I can go back a year. Because oint is difficult. You've got to do some. You have to have a good memory. It's like playing Minesweeper. So I went back a year and was like, this woman has not been here the whole time.

[Ethan Merritt]

Yeah.

[Unidentified OSINT Researcher]

And it was pretty simple. But you, you wanted us to find these flags. And the reason this is really unusual and the reason you should listen to this episode is because it's very hard to find a willing victim. It's super hard because it's not even legal. And Ethan, you did it. So you did the world of service by just being like, okay, go ahead.

[Ethan Merritt]

Yes. Yes, I did.

[Unidentified OSINT Researcher]

Okay, Flag 3. The brother in law, sister's husband is

[Nicholas Olson]

somebody that he wants us to find and see if we can find. And so I think we can even find a little more than that too.

[Lee C Camp]

Right.

[Nicholas Olson]

Previous interests, things that she's also interested in and build this what, what I like to call the social profile of somebody being able to pretend to be someone so legitimately that other than Social Security number you can be that person. Right.

[Unidentified OSINT Researcher]

Oh, wait, did I just not see it?

[Nicholas Olson]

I did just not see it.

[Unidentified OSINT Researcher]

There we go. Who is that gentleman tagged in? LinkedIn is not being particularly helpful right now. That's his dad right there. So open it up, let's see what we got. All right. You're giving me a lot of them. I want one of them.

[Nicholas Olson]

I am putting pim eyes on this bald guy because he is in a lot of the the photos with and the parents. And so I would bet that this guy is the husband of. I feel pretty confident in that.

[Unidentified OSINT Researcher]

The weird thing is sister's not showing up because in every people search thing just have one K. But there's obviously a daughter in those photographs.

[Nicholas Olson]

Okay. So nice to have from a for this past week.

[Unidentified OSINT Researcher]

Oh, would you look at that.

[Nicholas Olson]

I feel pretty confident in saying her husband.

[Ethan Merritt]

That's.

[Nicholas Olson]

I feel good about that. Yeah. We are thrilled enthralled with meeting Your son in law. Thanks for sharing. He had to be impressed with his in laws. I feel good. I feel good about that.

[Unidentified OSINT Researcher]

Flag 4 Ethan's roommate. Okay, so Nick, mostly Nick. But Nick and I in theory had gathered a lot of intel. We had his family members, we knew who they were. We had, we figured out where his social media was being posted, even the one that didn't have his name, but we knew it was him. We had his email address. And you think like, well of course you have his email address cause you work with him. But no, no, no, we had his email address because it was online on a people search site. So every. Absolutely everything. And of course we had the podcasts where he gives a ton of information that allowed us to figure out what we needed to figure out to capture all the, you know, the flags, including the one we're about to talk about.

[Nicholas Olson]

So once I found all the phone numbers and things that I did on Brokers, I had a general idea from his YouTube and social media profiles of emails. So that made it really easy to search him up on things like have I been pwned? And then immediately pivoting to things like Snuff Face, which gave me plain text passwords and other emails that are associated with those passwords.

[Unidentified OSINT Researcher]

I did a have I been pwned on him too? And was like, oh, this is, this is embarrassing. This is gonna be easy. Where did you go with the information? People know they can go to have I', they can find their email address from there. They can find out where they've been breached and they can find out what kind of information has been breached.

[Nicholas Olson]

Yes.

[Unidentified OSINT Researcher]

What is snuff space first?

[Nicholas Olson]

So snusbase is a leak aggregation platform which anytime that there's a leak or a breach that appears on things like have I been pwned? All of those credentials are in plain text on snuff space. And so you pay a monthly fee to get access to these things. You can search people up by their emails, their usernames, passwords, anything and everything under the sun, down to an IP address.

[Unidentified OSINT Researcher]

And is it legal?

[Nicholas Olson]

So it's a bit of a gray area, right. And so for this example, one of the things that was in scope for us was that Ethan wanted us to be an attacker. And attackers aren't going to play fair. Right. By no metric of the imagination are they going to be ethical with the information and sources that they use. And so in order to portray that, we used snuff space to find a lot of this information, especially those things like passwords and things that are a little more confidential for Ethan. So we wanted to make sure that we were really being an adversary to Ethan.

[Unidentified OSINT Researcher]

Now, from what I could tell, he was somewhat daisy chained on those passwords.

[Nicholas Olson]

Yeah, he. He has quite a history of reuse. It was his sister's cat followed by his date of birth. And it is something that he used constantly. And we even see an example of a password that he used here. So very similar to how people use exclamation points at the end of passwords and whatnot. He just had an at symbol at the beginning and then a number at the end. So he's still hitting that special character number, word mark. It's just that's publicly accessible now. And so if he has password reuse anywhere else is a very similar one.

[Unidentified OSINT Researcher]

And social media, I imagine, was just a big leaky arena of tell me what I need to know to get what I want.

[Nicholas Olson]

A big part of it. And one of the things that he mentioned when I was talking to him was that some of these usernames were in him. And so you did a podcast with Ethan where you talked about previous interactions with catfishing and other things along those lines.

[Unidentified OSINT Researcher]

People using his image and pretending to be him specifically.

[Nicholas Olson]

Absolutely. And so one of the things that I really laughed at on these leak sites was the username Sexy Dive Ethan. And I thought that this was hilarious because I thought this was him maybe in his college days when he was a diver. But he said, that one isn't me at all. That one is not me. That's somebody who probably was trying to catfish me. And so he has another username based on things like leak sites that he didn't understand before. And so one of the leak sites had a IP address for a university in New York, and that was where Sexy Dive Ethan came from. And so some sort of VPN connection, something where he was tunneling in in some way, and then that was just conveniently leaked eventually. And so it's just another potential username that an attacker might use for him. So we both looked. There was quite a bit that I found, and there's about two hours of recording extra on top of the stuff that you and I did together. All of this was originally in a notepad, but to start, we have his full name, his education, fully posted on his Facebook profile DOB phone. I had two potential addresses. One of them came up Ethan.

[Unidentified OSINT Researcher]

After talking with Nicholas, I actually called a few buildings where I suspected you lived and did the following hack. You play the building and participate a little bit. Ring, ring.

[Ethan Merritt]

Hey, how's it going?

[Unidentified OSINT Researcher]

Hey, man, I'm so sorry to bother you, but my roommate is being. Can you just tell me who's on our lease? We're in apartment blank.

[Ethan Merritt]

Ooh, I don't know if I can give you.

[Unidentified OSINT Researcher]

Because he's saying he's not. He's saying he's not on the lease, and he's 100% on the lease, and he's not willing to pay his rent this month. It's serious. Like, I gotta get this done right now. Like, it's the end of the month.

[Ethan Merritt]

So is this what you tried? Huh?

[Unidentified OSINT Researcher]

Yeah. Yeah. And they were like, but you didn't live in those buildings. So they were just like, get off my phone. So anyway, and then we narrowed it down. That was actually kind of harder to figure out because you've lived a few different places to see which one. And then I saw, like, I went in Google Maps and was like, mm, I don't think this is where he lives. I think he would live somewhere cooler. And we found the cool place where you live, which we're not going to disclose here. So did we get all the flags so far?

[Nicholas Olson]

Yep.

[Unidentified OSINT Researcher]

Now, I had a hard time with the love interest. It was very easy to find the person that he told us that we should not reach out to. Yes, that was. That was easy. And should have been like, I get it. And the love interest, though, there were a couple I thought it could have been. But what. What did you. How did you do it? I'm just curious.

[Nicholas Olson]

So, based on the likes from Ethan's Instagram, his most recent post, that's exactly what I thought. He had a bunch of likes from a bunch of different people.

[Unidentified OSINT Researcher]

Yeah.

[Nicholas Olson]

And one of them that really stood out was this girl named. And the reason she stood out is because they previously worked at the same company and she was a supervisor of his department. And additionally, she was. In which he flies out pretty consistently. The first time that we ever met in person, he mentioned, hey, I'm here to see somebody. And so I had a pretty good idea this was her. And they don't do the casual thing of liking posts and following people yet, but she matched Ethan pretty well. And so what I mean by that is she's also a podcaster, she's very into fitness, she's an entrepreneur. She does all of these things that Ethan is also very involved with. And previously working at the same company, I had at least an established link. And so looking into her a little bit more, I found a last name, personal cell Address. After confirming with Ethan this was the correct person. And we essentially immediately found it based off of one singular connection and one previous example. And so they both like each other's posts. Ethan doesn't do that with any of the other girls who liked his post. First. I went through about 15 to 20 other people who liked his post. Didn't like a single other person. It was just hers that he was liking. And so I at least had some sort of established background knowledge in that. But it's also the things that we give away in person. That's what that highlights too, right? Is Ethan wasn't private in person, therefore it caused a leak just directly through me.

[Unidentified OSINT Researcher]

Nick is terrifying, I think you would agree.

[Ethan Merritt]

Yes. Yeah, Nick is very good at what he does. I watched his process and it is, it's thorough, but it is, it's a level of creative thinking that you don't fully grasp until you see it.

[Unidentified OSINT Researcher]

It's phenomenal. Now, opinion time. Ethan, do you think there are. Do you think Nick is unique or do you think there's some of those Nicks out there in criminal land?

[Ethan Merritt]

There are probably a ton of Knicks out there in criminal land.

[Unidentified OSINT Researcher]

I think there's bouquets after bouquets of Nicks out there in criminal land.

[Ethan Merritt]

Yeah.

[Unidentified OSINT Researcher]

Yes, the battle's done and we have won.

[Ethan Merritt]

Yes, you have.

[Unidentified OSINT Researcher]

Yes, you have. All the flags were captured. What did you learn about your vulnerability through the capture of these flags?

[Ethan Merritt]

The capture of finding my sister? I think what I learned was how dedicated somebody can look and dig through your family members outside of that. So to capture that flag, finding different links of relatives and stringing it together to figure out who she is, you know, was important. So it wasn't necessarily about my safety and what I do, but it was about other people around me. Well, what do my parents do? Right. That was a big one. What do some of my other parts of my relatives do? And that is really the entry point that was easy for you guys to capture.

[Unidentified OSINT Researcher]

Ethan, I have to, I have to tell you, your folks are wide open privacy wise on Facebook. And that was a, that was a big problem for you in terms of this flag. Would you suggest to them to maybe tighten that up?

[Ethan Merritt]

Yes, I already have. They took the information mixed, I'll put it that way.

[Unidentified OSINT Researcher]

Well, I was surprised because I couldn't find you on Facebook until I found them and your sister. And then I was like, oh, that's why I can't find him. Because you don't use. You don't. It's not actually your name And a page out of my playbook actually because my name, as you know me, isn't my name.

[Ethan Merritt]

Correct. Yep.

[Unidentified OSINT Researcher]

Which you know. Which is, you know. So we have something on each other. All right, your brother in law, how did you feel about the way that was outed? Was it in the same. In the same category of oops or was it different?

[Ethan Merritt]

Yeah, I think it was in the same category of oops. Right. So what I don't want to give too much detail about him here, but yeah, he, he doesn't have a presence online almost at all. And even what my first thought was, even my sister hasn't really shared a lot of photos of him, if any, on her Instagram. So I thought if you are able to find her. I don't necessarily know if you'll be able to find him.

[Unidentified OSINT Researcher]

But so like when I saw it and I think that we, if I remember correctly, the way that we identified him was because someone in the comments said it was super nice to meet. Blank.

[Ethan Merritt]

Yes.

[Unidentified OSINT Researcher]

Terrible, right? And you're like, oh, curses.

[Ethan Merritt]

Yeah. I didn't think about the entry point of my parents for him. I thought about it for my sister possibly, but not for him. But I'm not on on Facebook as much, so maybe hadn't crossed my mind.

[Nicholas Olson]

I guess my biggest piece of advice, stop over sharing. I would suggest thinking about every post you make from the perspective that other people will be publicly viewing it. A big portion of what this exposure came down to was not only responding to things that you knew were kind of fishy. Right. But additionally it was posting things like your daughter being there for you could just say your daughter. You don't need to say where she's flying in from. Even from Ethan's perspective, you don't need to mention what your first job was in a podcast unless it's absolutely necessary.

[Unidentified OSINT Researcher]

And another piece of advice, check on the people in your life. You gotta be diplomatic about it, but you're probably not the weakest link in your own privacy.

[Nicholas Olson]

His parents have the worst social media presence I think I've ever seen. No, it's great.

[Unidentified OSINT Researcher]

It's just wide open.

[Nicholas Olson]

Yeah, it's just wide open. And I explained this to him and one of the things that was really interesting that they did that just shows everyday compromise was they posted a picture where it was their dog's medication and they had like a red circle around, like don't operate heavy machinery. Like haha, why would my dog have to do that? And they posted it for one Facebook laugh. Right.

[Unidentified OSINT Researcher]

I saw that. I saw that, but it also had their address and their phone number and

[Nicholas Olson]

yep, yep, it had everything on it. And so part of that is it shows a leak in some capacity. And so I figured there were going to be other things.

[Unidentified OSINT Researcher]

And so it has a tendency to leak.

[Nicholas Olson]

There's a tendency to leak. And so with the sister, one of the really interesting things about was that she is very close with the parents and so she goes on trips with them, she flies out. And there were two posts that really highlighted something interesting to me. One of them was she mentioned, hey, my daughter flew down from. So I'm seeing her from there. And so that confirmed she was in some sort of time zone address. But she also had another post, her mom, where it said, I'm so glad that my son in law and my daughter came down to come and visit us with their cat. And I thought that was cute. And it was a cute post. But from here I took it a different direction. I'm gonna show you my text to Ethan's sister.

[Unidentified OSINT Researcher]

So I went ahead, you rat bastard. Did you.

[Nicholas Olson]

I went ahead and texted, so hi, there is the. She said, who is this? And I found this number using public data brokers. And so I said, hey, my name is Max Foley, who's a real ITV director. And I said, I'm reaching out on behalf of ITV America. We're doing a reality TV dating show. Ethan applied and you're. You were put down as a reference. Feel free to give me a call or text back when you can. I'd love to chat. She says, sorry, I'm at work in the moment and I'm in time zone. Can I call tomorrow morning now? This was great. I was very excited at this point and I said, this is amazing right here. She called Ethan and said, what the hell is going on? Why did this person text me? She had to confirm with Ethan that he applied, in which Ethan immediately snitched me out. And so I tried my best to backtrack. But even with just this one text alone, I confirmed two things. I confirmed his sister's number and I already knew she was in a based on her address. So I found two key bits of information from one text without ever having to interact with her via the phone call period.

[Unidentified OSINT Researcher]

So again, what you did here was the yeoman's work of real open source intelligence. You looked at all the posts and, and, and this is where everybody gets it wrong. Everybody gets it wrong here unless they don't have social media, unless they never have been on a podcast, unless they've. There's this kind of information out there. And, and there are people like Nick who know how to drill down into it and will take the time. In this case, it's Nick's job. But I promise you, there are people who make a lot more money than Nick who do this for their job, and they have all day.

[Nicholas Olson]

And so it was a hop, skip, and a jump. That phone number, once I confirmed that it was her, also led me to her home address, which home addresses are really hard because you can't necessarily confirm. But conveniently enough, she had a full Amazon affiliate link where she shows different angles of her house. And one of the things that was extremely interesting was she did a full review of a cat tree with her cat in one of these videos and showed the background of her house, which directly matched the Google street view of her home. And so the further you scroll down, the more stuff and the more angles you get. But even things like the wood flooring, the tile, the door, all of them are the exact same with not only the Zillow listing, but the Google Maps listing as well. And so you can tell that this was the correct place and I had the correct address. And so little leaks like these. Right. The things that we don't think about, the background that we have in our video, it's not so.

[Unidentified OSINT Researcher]

But, but, so, so that's not so little. But you, so you, you. And you found the address through people search or through the Amazon affiliate, just

[Nicholas Olson]

directly through her phone number. The Amazon affiliate was used to find just and confirm. That was it. It was just a piece of confirmation for me. There was a couple things that I left out for. For just intentionality reasons, like Ethan's license plate and the car he drives. Yes, it's important. Yes, it would scare him. But for continuity and brevity, I left those out.

[Unidentified OSINT Researcher]

Well, good job, Nick. I, I was, I was really looking forward to all of these revelations that I knew you were going to find. And it was fun to see exactly how you, you, you wended your way into capturing all four flags. Did you, did you have any thoughts as you were doing this regarding kind of a basic overarching directive that you would give the Merritt family?

[Nicholas Olson]

You have to draw the line of what is shareable with the public and what shouldn't be shareable, what should just be private for you. And Ethan has a really hard time distinguishing that, even in the fun facts section here. Right. I have his earliest memory out of, like, from his life.

[Unidentified OSINT Researcher]

I'm giving him a pass on that. As a person who writes memoir I'm giving him a pass on that. Listen, you know, if you are a person who actually can use that information as content that is transformative, I think that's okay. But if you're doing that then you have to take a threat stance that is completely, you're completely exposed, there's responsibility, your exposure is complete. And then, and if you're doing that and you, and you have family members who use social media and their privacy settings are wide open, you might ask them to, you know, you might even just offer to set their privacy settings. Because that was my thing. Nick is like, if the parents want to say so and so is coming from, that's their business. But they should be sharing their business on a private channel.

[Ethan Merritt]

I think just ways of understanding stories like this are really going to be helpful. That really showcasing this type of story in the context of saying that like you're not going to be the only one that's ever going to be attacked. You're not ever just going to be able to be scot free either. And that's why we have the tour that we worked on that we're going to be promoting. Right? Because we're going to be showcasing the fact that there are stories and entry points that real world examples are going to be the best way to show this. Because some people are never going to fully understand something until they watch it happen right in front of them until it happens to them. And you never want to expose people to that side of it. It's not worth it for them. So showing this story today is going to be one of the most helpful hand points to be able to promote out there.

[Unidentified OSINT Researcher]

Okay, so what is the tour called and how can people get it in front of their staff?

[Ethan Merritt]

So right now at Delimi we're doing the Invisibility tour and it's the going Ghost Invisibility tour that we have. And we are trying to book this for small executive teams together at large enterprise size down to small businesses. And we'll be able to present a two hour learning experience, start to finish with really good examples, really good experience on exposure and a lot of education for you to walk away in tool sets that you can bring back to your team.

[Unidentified OSINT Researcher]

And if somebody wants to get this invisibility tour to their company, um, and they don't want to do open source intelligence to find you, what is the best way for them to open the door to getting that conversation started.

[Ethan Merritt]

Yeah, if you actually go to my LinkedIn, LinkedIn.com backslash put my name Ethan Merritt, you can Actually, reach out to me and we can talk more about the invisibility tour and what we can do for your team, bringing in some SMEs and some professionals to be able to speak to your companies in small groups so you can learn how to be safer.

[Unidentified OSINT Researcher]

And if you don't know what an SME is, it's a subject matter matter expert. But it doesn't matter because you probably don't need him. But the fact is, yes, you want to reach out to Ethan. And Ethan's last name is spelled M E R R I T T. So go check it out. I think we've done our job here, Ethan. Thank you so much.

[Ethan Merritt]

Thank you very much.

[Unidentified OSINT Researcher]

All right, well, it's been another wonderful adventure with Nicholas Olson, OSINT researcher. Extraordinary air. Thank you, Nick.

[Nicholas Olson]

Absolutely. Thanks, Bo.

[Unidentified OSINT Researcher]

All right. Now it's time for the Tinfoil Swan, our paranoid takeaway to keep you safe on and offline. This week's I don't know how to tell you this. This week's Tin Foil Swan is talk to your family members who overshare about their privacy settings. And if you need to pick up their ask them to give them give you your their device. And if you need to ask them to hand you their device logged into whatever it is they're over posting on, over sharing on and set their privacy tight yourself, that's this week's Tinfoil Swan. You are only as private as the people around you sharing about you. And it's your right and self duty, duty to yourself, which is, I don't know, you get the point to fix that and I encourage you to do it nicely and you know, extra points if you get absolutely everyone in your network subscription to delete me because then, you know, then it's going to be a lot harder to figure out who your neighbors are. You could do your whole street, you could do, you know, your whole town if you want. But you know, they used to have these neighborhood watch areas. Well, maybe we need to have these neighborhood no data online areas because that would really solve a lot of the problems. Okay, that's it for this week. I hope you stay safe out there and can't wait to have you back next week. Thanks for listening. What the hack is produced by Beau Friedlander. That's me and Andrew Stephen, who also edits the show. What the hack is brought to you by Deleteme. Deleteme makes it quick and easy and safe to remove your personal data online and was recently named the number one pick by a New York Times wirecutter for personal information removal. You can learn more about Deleteme if you go to joindeleteme.com wth that's joindeleteme.com WTH and if you sign up there on that landing page, you will get a 20% discount. I kid you not, a 20% discount. So yes, color me fishing. But it's worth it.

[Lee C Camp]

Lee C Camp here. If you've been enjoying this show, I think you might enjoy my podcast no Small Endeavor. Produced by Great Feeling Studios and prx, no Small Endeavor explores what it means to live a good life. We sit down with courageous, impassioned people like actor Martin Sheen or civil rights hero James Lawson to ask what it means to live a life worth living. Follow no Small Endeavor wherever you get your podcasts. Living a good life is no Small Endeavor and we would love to help.

[Christina Quinn]

There are a bunch of ways to prevent crime that no one is talking about, like how wind direction can make your community more violent or peaceful and how GLP1 meds could reduce felonies. This is fighting crime where we ask the big questions. What if we've been having the wrong conversations about crime?

[Nicholas Olson]

Two policies, ban the box and clean

[Christina Quinn]

slate, don't seem to be helping, even

[Nicholas Olson]

though they sounded like they should or they would.

[Christina Quinn]

I'm your host, Christina Quinn. I'm going across the country from prisons to universities, police chiefs to inmates to look at the evidence and question everything we think we know about how to make America safer. Economists think a lot about how people respond to incentives. If we want to reduce crime and change behavior, we need to increase the costs or reduce the benefit. Join us as we figure out new ways to fight crime and be prepared to think differently. Fighting crime Listen or watch on Apple Podcasts, YouTube and Spotify.