54:45This recording is not available yet.
I will look for you and I will find you: OSINT on publicly shared pictures
Download resourcesCategories
About this session
Patricia Gagnon-Renaud, a security analyst on GoSecure's ethical hacking team, demonstrates how open-source intelligence can pinpoint where a photo was taken from the image alone, no metadata involved. Through five escalating examples she matches a statue to a Las Vegas hotel lobby via a reverse image search, geolocates a downtown Montreal building using two landmark towers and a satellite 3D view, finds a company's new commercial building from a partial civic number seen in a YouTube video combined with Canada Post's Address Complete tool, walks through the LinkedIn, social media and floor-plan reconnaissance she performs before a physical penetration test at GoSecure, and describes decoding and cutting a working store key from a blurry television news clip. She closes with why this matters, covering doxing, stalking and identity theft, and urges the audience to keep addresses, birthdates and key photos off the internet and to strip metadata before publishing images. A short Q&A follows on the GeoGuessr game and her choice of QR code.
Liam Neeson is coming for you. But how will he find you? Come to this talk to learn how the picture of a firetruck you took in front of your house and shared on Instagram two years ago will be the source of your demise.
In this talk, I will share how I developed this compulsive habit, in which I need to find where a picture was taken. We will cover how to perform open-source intelligence (OSINT) on publicly shared pictures and videos, which tools and techniques to use, accompanied with real step-by-step examples.
I believe that understanding how OSINT works is key to better protect ourselves online. I'm aiming to give you the tools and knowledge to be better cybersecurity professionals, and learn to be more careful and diligent online, all in a (hopefully) fun and engaging way.
Not convinced yet? This talk will also cover the following topics: metadata (d'oh!), physical keys (who doesn't like keys?), data in public registries, and conclude with Do's and Don'ts for everyone.
Key takeaways
- Treat your own social media photos as location data: recognizable landmarks, statues or interior lighting can be reverse-image-searched to reveal exactly where you were standing.
- Combine a partial civic number seen in a video or photo with a partial postal code in a tool like Canada Post's Address Complete to narrow a location to a specific building fast.
- Before a physical penetration test, mine the target's LinkedIn, social media and any landlord or realtor listings for floor plans, badge designs and employee names to plan an entry route and cover story.
- Never post pictures of keys, house exteriors or full addresses online, and strip metadata before publishing any photo you host yourself.
- Download video at the highest resolution available, not the embedded playback quality, before trying to read small details like text, badges or key bittings.
Speakers
Patricia Gagnon-Renaud
Patricia Gagnon-Renaud is a Cybersecurity Analyst in the Ethical Hacking team at GoSecure. She has a bachelor's degrees in IT engineering, is a licensed engineer, and more recently, has become a Certified Information Systems Security Professional… Read moreRead less
Patricia Gagnon-Renaud is a Cybersecurity Analyst in the Ethical Hacking team at GoSecure. She has a bachelor's degrees in IT engineering, is a licensed engineer, and more recently, has become a Certified Information Systems Security Professional (CISSP). Her interests include social engineering, physical security, lockpicking and urbanism.
