FOCA: What it is and why it matters for security

FOCA, which stands for Fingerprinting Organizations with Collected Archives, is a free tool that helps security professionals find hidden information in documents and files. It's designed to expose metadata that can reveal sensitive details about an organization's infrastructure and employees.

Key takeaways:

• FOCA analyzes metadata from various file types, including DOCX, XLSX, and PDF.
• It can extract usernames, software versions, server names, and network paths.
• The tool is primarily used for security auditing and penetration testing.
• It's free and developed by ElevenPaths, Telefónica's cybersecurity unit.

What exactly is FOCA and what does it do?

FOCA is a security tool developed by ElevenPaths, Telefónica's cybersecurity unit. Its core function is to analyze metadata from files, often publicly available ones, to "fingerprint" an organization. This means it collects data that might seem harmless individually but, when combined, can paint a detailed picture of an organization's internal structure, software, and even employee names. It works by scanning files like PDFs, Word documents (.docx), Excel spreadsheets (.xlsx), and even image files (.jpg) for embedded information. For example, a Word document might contain the author's username, the company name, and the specific version of Microsoft Office used to create it. FOCA aggregates all this.

What kind of sensitive information can FOCA uncover?

The range of information FOCA can uncover is surprisingly broad and often highly sensitive. It can extract usernames, which are often the first part of an employee's email address or network login. It also finds the specific software versions used (e.g., Microsoft Office 2016, Adobe Acrobat Pro DC), which can point to known vulnerabilities.

Beyond that, FOCA can reveal:

• Server names and network paths: This might include internal server names like "FILESERVER01" or network shares like "\company.local\marketing\reports".
• Email addresses: Often found in document properties or hidden comments.
• IP addresses: Sometimes embedded in specific file types or document histories.
• Creation and modification dates: Giving clues about project timelines or employee activity.
• Printer names and models: Revealing network devices.
• Operating system details: Such as Windows 10 or macOS versions.

Imagine finding a document created by "jsmith" on "SRV-FINANCE" using "Office 2013". That's three pieces of reconnaissance data right there.

How does FOCA work its magic?

FOCA operates in a few distinct phases. First, it gathers documents from public sources. This often involves searching websites, using search engines like Google or Bing with specific queries (like "filetype:pdf site:example.com"), or even scanning local directories. Second, once it has a collection of files, it begins the metadata extraction process. It parses each file type differently, knowing where to look for embedded information. For instance, in a PDF, it might check the document properties. In a Word document, it examines the XML structure.

Third, FOCA organizes this extracted data. It correlates usernames with document types, maps server names, and builds a comprehensive report. This report is then presented to the user, highlighting potential vulnerabilities and offering a consolidated view of the digital footprint. It's essentially an automated, efficient way to do what a manual security analyst would do, but on a much larger scale, processing hundreds or thousands of files in minutes.

Who typically uses FOCA and why?

FOCA is primarily a tool for security professionals. This includes:

• Penetration testers: They use FOCA during the reconnaissance phase of a penetration test to gather intelligence before attempting to exploit systems. Knowing usernames or internal server names gives them targets.
• Security auditors: They employ FOCA to assess an organization's digital exposure and identify potential data leakage points. It helps them show clients where their information might be unintentionally public.
• IT administrators: Some use it to proactively scan their own public-facing documents to ensure no sensitive data is leaking.
• Ethical hackers: Similar to penetration testers, they use it to understand an organization's attack surface.

The "why" is simple: information is power in cybersecurity. The more an attacker knows about a target, the easier it is to find a weakness. FOCA helps defenders see what attackers see.

Is FOCA legal and ethical to use?

Using FOCA is absolutely legal when you are scanning your own organization's public files or have explicit permission from the owner of the files or systems you are analyzing. For example, a penetration testing company hired by a client will use FOCA as part of their authorized assessment.

However, using FOCA to scan and collect information from organizations without their explicit consent is generally considered unethical and could be illegal, depending on local laws and the specific actions taken. It falls into a gray area similar to port scanning or other forms of reconnaissance. The tool itself is neutral; its legality and ethics depend entirely on how it's wielded. Always get permission before pointing it at someone else's assets.

What are the main alternatives to FOCA?

While FOCA is quite comprehensive for document metadata, there are other tools that offer similar or complementary functionalities.

ExifTool, for instance, is excellent for image and video metadata, showing camera models, GPS coordinates, and dates. Metagoofil is another popular choice, specifically designed to query Google for document types and then extract their metadata. For broader open-source intelligence, Maltego can visualize connections between entities, which might include FOCA-extracted data. Commercial DLP solutions are more about preventing leaks proactively rather than discovering existing ones.

How can organizations protect themselves from FOCA-like analysis?

Protecting against FOCA-like analysis primarily involves managing your metadata. It's about being aware of what information your public documents contain and taking steps to remove or sanitize it.

Here are key strategies:

1. Metadata Removal Tools: Use automated tools or features within document software to strip metadata before publishing. Most modern office suites have a "Document Inspector" feature (e.g., in Microsoft Word under File > Info > Check for Issues).
2. Strict Publishing Policies: Implement clear guidelines for employees on what can be shared publicly and how documents should be prepared.
3. Data Loss Prevention (DLP): Deploy DLP solutions that can scan outbound files and block or warn about sensitive metadata.
4. PDF Sanitization: When converting documents to PDF, ensure all metadata, comments, and hidden layers are removed. Many PDF creation tools offer this option.
5. Regular Audits: Periodically use FOCA or similar tools yourself to scan your own public-facing websites and documents. This "eat your own dog food" approach helps identify leaks before attackers do.
6. Employee Training: Educate employees about the risks of metadata and the importance of following document handling procedures. A single well-meaning employee can accidentally reveal a lot.

The goal is to minimize your digital footprint. Every piece of metadata is a potential clue for someone trying to understand or exploit your organization. By taking these steps, you reduce the amount of "free intelligence" available to adversaries.