Doxing, sometimes spelled doxxing or d0xing, is a malicious practice of disclosing an individual’s personal information without their consent.
The data targeted is typically physical addresses, telephone numbers, email addresses, employment and job titles, financial information such as credit card numbers, and social security numbers. The term is a contraction of “droping” (disclose) and “docx” (documents).
This practice is initially used for the purposes of cyberbullying and/or cyberstalking, extortion or retaliation against targeted victims because of their opinions. The term became popular in the 1990s, when malicious actors began using doxing to remove the anonymity of their rivals, exposing them to peers and authorities alike.
Doxing generally takes place in two stages. The first is to collect as much information as possible about the target. The second aims to disseminate this data on anonymous platforms or on social networks, often using fake profiles.
Some sites have specialized in this practice, such as Doxbin, a Pastebin-type platform allowing the anonymous publication of personal data and descriptions. Internet users can also contribute by adding other information. The only way for a victim to have their name removed from the site is to pay.
Doxing as a reconnaissance tactic
Doxing is part of the first stage of the Cyber Kill Chain, as well as the recognition phase of the MITER ATT&CK framework, referenced TA0043. Both of these models highlight the importance of gathering information as a prerequisite for pursuing a cyberattack.
Doxing is therefore no longer limited to internal conflicts between isolated actors. It is now used as an offensive intelligence tool, making it a real threat to businesses.
Several recent cyberattacks show attackers exploiting leaked data in an attempt to compromise businesses or spread a political message internationally.
This was particularly the case when attackers from the Handala group, believed to be linked to Iran, compromised the personal messaging of Kash Patel, director of the American Federal Police (FBI). They then published documents and photos recovered from this messaging online.
If the incident did not result in a major security impact, it is nevertheless part of a logic of symbolic reprisals against the United States, in a context of strong tensions also involving Israel and Iran.
As part of cybersecurity analysis activities, it is common to have to alert clients to cases of doxing targeting their employees. This concerns in particular the disclosure of information relating to security agents of large groups, or the sharing of valid identifiers belonging to employees.
How to reduce your digital footprint?
To protect yourself from doxing, the main prevention measure is to limit the distribution of personal information online, particularly on social networks. It is also recommended to restrict access to this data to trusted contacts only.
When possible, it is recommended to avoid using your first and last name on the Internet, including in email addresses, and to favor the use of pseudonyms. It is also necessary to limit the use of automatic registration or connection mechanisms offered by large platforms, such as Google or Facebook, in order to reduce the volume of personal data shared with these services.
Social media privacy settings should be configured strictly to limit access to posts. Using a third-party account can also verify the public visibility of a profile. It is also useful to regularly search your name on search engines in order to identify the information accessible online.
Finally, multi-factor authentication must be activated as soon as possible, in addition to strong, unique and confidential passwords, composed of at least 12 characters mixing letters, numbers and special characters. The use of a VPN can also be relevant, particularly on unreliable networks, in order to secure connections and limit the exposure of exchanges.
