Receive First: What You Can Learn Without Sending a Packet

Quick answer: There is a category of security that never touches the target. It only listens. Radio traffic passing through the air, certificates written into public logs, GPS coordinates baked into photos, author names buried in documents: all of it is emitted by its owner and can be read by anyone, without sending a single packet back. Because nothing is transmitted, there is nothing to log, no rate limit to trip, no credential to present, and no alert to raise. The information was published. It only had to be received. And the defence, in every case, is not a product but a habit: find out what you are broadcasting by default, and turn off the parts you did not choose.

Most people picture security as a contest of sending. An attacker sends probes, scans ports, guesses passwords, fires exploits. A defender watches for those packets and blocks them. It is an accurate picture of a lot of security, and it has a blind spot the size of a building.

The blind spot is everything that leaks without anyone sending anything. Before an investigator transmits one byte at a target, that target is already talking: over the air, into public logs, and inside every file it hands out. Learning to read that exhaust is a discipline of its own, and it has a defining property that makes it worth understanding whether you attack or defend. It is invisible from the other side.

Why "receive first" is a real advantage

Active reconnaissance leaves evidence. A port scan appears in a firewall log. A login attempt against an account is recorded and, past a threshold, blocked. A query against an API burns a key that can be revoked and traced. Every one of those is a packet you sent, which is a fact about you that now exists on someone else's machine.

Passive collection produces none of that. Tuning a receiver to a frequency does not tell the transmitter you are listening. Reading a public certificate log does not touch the company the certificate belongs to. Opening a file someone emailed you and inspecting its metadata sends nothing back to the author. The asymmetry is total: you learn about them, and they learn nothing about you, because you never spoke.

That is why the honest first question in this field is not "what can I send," but "what is already arriving." A great deal is. Here are the four channels it arrives on.

Channel one: the air

Radio does not respect walls, and a lot of it is unencrypted because encryption was inconvenient, expensive, or simply not imagined when the standard was written. A thirty dollar receiver pulls aircraft position reports, ship identifiers, home weather sensors, and the tyre pressure monitors in passing cars out of the air, all in the clear, all continuously.

The remarkable part is not that these signals exist. It is that reading them requires no cooperation from anything transmitting. The aircraft does not know you decoded it. The car does not know its tyres announced themselves to your laptop. This is the purest form of receive-first collection, and it is the subject of its own deep dive: reading codes out of the air with software defined radio, including the crucial matter of which traffic is lawful to receive and which is not, because in the US receiving and divulging are two different lines and both matter.

Channel two: public logs

Some systems are designed to publish, in the open, a record of things their users would be startled to learn were public. The best example is Certificate Transparency. Every time a website gets an HTTPS certificate, that certificate, including the exact hostname it was issued for, is written into a public, append-only, permanently searchable log. The logs exist for a good reason: to catch fraudulent certificates. A side effect is that every subdomain a company ever requested a certificate for is now a matter of public record.

That means internal-sounding hostnames, staging servers, VPN gateways, and the names of unreleased products can appear in a public log the moment someone requests a certificate, often before anything is announced. No scan is involved. You are reading a ledger the company's own certificate authority was required to publish. I pointed this technique at my own domains to see what I had been broadcasting, and wrote up exactly what came back in what a certificate transparency log reveals.

Channel three: files

A file is not just its contents. It is its contents plus a hidden record of its own making, and that record travels with it.

A photo carries an EXIF block: the camera, the lens, the timestamp to the second, the camera body's serial number, and, by default on phones, the GPS coordinates where it was taken. A stranger who receives the original file reads all of it in seconds, and the coordinates are a pin, not a city. The mechanics, and the counterintuitive fact that a screenshot strips all of it, are in what EXIF data reveals.

A document goes further. A Word file is a zip archive that stores the author, the last editor, the revision count, the editing time, and sometimes internal comments, all in plain XML. And a PDF "redacted" by drawing a black box over text usually keeps the text fully readable underneath, which is the most common document leak there is. That is its own piece: the hidden data in documents people send you.

In both cases the sender saw a clean surface and trusted it. The data layer underneath was never as clean as the picture on top.

Channel four: timing and pattern

The subtlest channel sends no content at all, only rhythm. You do not need to decrypt traffic to learn from it. When bursts happen, how long they last, how often they repeat, and how big they are can distinguish a nightly backup from a video stream from a device checking in, without a single payload being read.

This is harder to demonstrate on a laptop and easier to abuse than to defend against, so it stays a concept here rather than a how-to. But it belongs in the map, because it completes the point: even a channel that reveals nothing about what is being said can reveal a great deal about what is happening.

The line you do not cross

Receive-first is powerful precisely because it is quiet, and that quietness is not the same as permission. Three lines are worth stating plainly.

Receiving is not always legal, and divulging is a separate act. In the United States, receiving many radio signals is lawful, but specific classes, cellular traffic among them, are not, and telling someone else what you intercepted can be an offence even when hearing it was not. Reading a public log or a file you were given is different ground again. Know which you are on.

Passive on the wire is not passive on a person. Reading a document you were sent is fair. Assembling a dossier on an individual from scattered public fragments is a different activity with a different weight, even when each fragment was public. The technique being quiet does not make the outcome harmless.

The demonstrations in this series are run on my own assets, deliberately. The certificate audit points at my own domains. The EXIF and document examples use invented data. The intent throughout is to show what leaks so it can be shut, not to hand anyone a targeting guide. That is the difference between security education and its opposite, and it is a line held on purpose.

The defence is always the same shape

Every leak in this series has one cure, and it is not a firewall. It is knowing what you emit.

• Turn off the camera's location access, and the photos stop carrying your coordinates.
• Run "Inspect Document" before sending a file, and the author trail and hidden comments go with it.
• Know that a certificate you request is public the moment it is issued, and name your internal hosts accordingly.
• Understand which of your radios are shouting in the clear, and accept or mitigate it knowingly.

None of that costs money. All of it costs attention, which is the actual scarce resource. The people who leak the most are not careless in some moral sense. They simply never learned what their defaults were saying, and a default nobody changed is the loudest transmitter of all.

The rest of the series

If this is your kind of thing, the deep dives each take one channel apart:

• Reading codes out of the air, the radio channel, with the legal lines drawn.
• What a certificate transparency log reveals, the public-log channel, audited against my own domains.
• What EXIF data reveals, the photo-metadata channel, and the screenshot trick.
• The hidden data in documents, the file-metadata channel, and why black boxes fail.

And if you came for the culture as much as the technique, the same appetite for reading a system rather than trusting it runs through how authenticator codes actually work, a field guide to IRC, and the craft of ASCII art.

Frequently Asked Questions

What is passive reconnaissance?

It is gathering information about a target without interacting with it: no scanning, no login attempts, no packets sent to the target's systems. Instead you read what the target already emits, such as radio signals in the clear, entries in public logs, or metadata inside files it has published. Because nothing is transmitted at the target, passive collection leaves no trace on its side, which is what distinguishes it from active reconnaissance.

Is passive collection legal?

It depends on the channel. Reading a public certificate log or inspecting a file you were given is generally fine. Receiving radio is lawful for many bands in the US but prohibited for others, such as cellular, and divulging intercepted communications can be a separate offence from receiving them. Compiling detailed profiles of individuals from public fragments raises its own legal and ethical questions. The technique being quiet does not settle the question of whether a given use is allowed.

How do I defend against it?

Reduce what you emit. Turn off location metadata in your camera, strip document metadata with the built-in inspector before sharing, name internal systems on the assumption that certificate hostnames are public, and know which of your wireless devices transmit in the clear. The common thread is that these are leaks of things you broadcast by default, so the fix is changing the default rather than blocking an attacker.

Why is "receive first" considered an advantage?

Because it is invisible to the target and consumes none of your own exposable resources. Sending probes leaves log entries, trips rate limits, and can burn credentials or reveal your address. Listening does none of that. So the efficient first move is always to exhaust what can be learned passively before sending anything, since passive collection carries almost no risk to the collector.