Cypherpunk Underground Chapter 10- Introduction to IMINT -> Geolocating images
Welcome back Cypherpunks. It's been a while since our last chapter. It's been a busy couple of weeks between attending/ speaking at DEFCON and going on a much needed vacation. CPU founder K1ng_Cr4b spoke at DEFCON's "off-the-record" track called Skytalks. The talk was titled "Basic Blockchain Forensics" and explained how blockchain forensic investigators can use open source and commercial forensic tools to follow cryptocurrency and acquire information that assists victims and law enforcement catch criminals and recover funds. The talk concluded with a walkthrough of K1ng_Cr4b's favorite case in which he was able to PWN a crook by correlating Ethereum Naming Service addresses with other OSINT. Included in that OSINT was a geolocated photo of the suspect.
Skytalks "Informer" Badge given to K1ng_Cr4b
Skytalks is Off the Record. This allowed K1ng_Cr4b to speak freely about some of the cybercriminals he has pursued.
Enough About that! Lets get to our lesson about IMINT. Image Intelligence (IMINT) is simply the act of gathering intelligence from photos or images. This discipline can be extensive, but for this lesson we will look at some open source tools and techniques you can use to Geolocate a photo.
Together we are going to find out as much as we can from this photo. This photo is an original photo taken by K1ng_Cr4b while on vacation. Let's see what we find.
Step One: Image Search Engines
This is the first obvious step when looking for an image online. The results are often hit or miss. Lets start with Google Image Search. A downside to Google Image Search is that it is not available on mobile. Often times I do not find Google Images helpful, but none the less its always my first step.
Google Images:
To my surprise google images came back with A LOT of similar images from the exact location this photo was taken. Often you will not be this lucky.
A lesser known but more powerful open source image search is Yandex. Yandex is somewhat the Russian equivalent of Google... for reasons I do not understand I find their image search to be EXTREMELY helpful.
Yandex Image Search
You may need to brush up on your Cyrillic... Yandex has a few bad leads, but also contains quite a few similar images taken in the same spot. Also look how Yandex attempts to geolocate the photo on its own.
EXIF Viewer
EXIF is a format of data that specifies the info about a picture or other media files produced with a digital camera. In some cases, it can reveal information about when and where a shooter took a picture and with what gear. Often times you will need the raw photo as most social media sites scrub EXIF data before they host it. I used a raw copy of the beach photo and ran it through an online exif viewer as well as a command line exif viewer.
Metadata2go
Metadata2go is a free online exif viewer. I have used it quite a few times when doing CTFs. Here are the results of our uploaded image:
No smoking guns unfortunately. All we really learn is that it was taken with an iPhone.