WEBVTT - This file was automatically generated by VIMEO 1 00:00:06.600 --> 00:00:09.700 Hi, everyone, and welcome to the section. Number seven, 2 00:00:09.800 --> 00:00:12.400 cold email, addresses user names and 3 00:00:12.400 --> 00:00:15.600 images. This is, of course, all to be taken 4 00:00:15.600 --> 00:00:18.800 in the open source, intelligence context. Now, 5 00:00:18.800 --> 00:00:21.800 let's do a quick overview of this section. Although 6 00:00:21.800 --> 00:00:24.600 it is pretty self-explanatory. And obvious. 7 00:00:24.600 --> 00:00:27.500 What are we going to do here? Now, we will discuss 8 00:00:27.500 --> 00:00:30.000 how to research, acquired data and information. 9 00:00:30.300 --> 00:00:33.700 With the tools to get email addresses, then to 10 00:00:33.700 --> 00:00:37.100 do username lookups and how to approach images 11 00:00:36.100 --> 00:00:39.600 with our open source, intelligence way of thinking. 12 00:00:39.900 --> 00:00:42.000 And with the appropriate tools to get the 13 00:00:42.300 --> 00:00:45.300 job done. As you can see. I have put all 14 00:00:45.300 --> 00:00:48.500 of these three resources in one video even 15 00:00:48.500 --> 00:00:51.900 with a short Hands-On demonstration about 16 00:00:51.900 --> 00:00:52.500 images. 17 00:00:53.900 --> 00:00:56.500 So its first I will start with 18 00:00:56.500 --> 00:00:59.200 the email addresses. Actually. The thing I 19 00:00:59.200 --> 00:01:02.500 will not do is to start with a statistic of how many 20 00:01:02.500 --> 00:01:05.500 email addresses there are in the world. Okay. 21 00:01:05.500 --> 00:01:08.700 An analogy for that kind of estimation would be 22 00:01:08.900 --> 00:01:11.600 an answer to a question. How many galaxies are 23 00:01:11.600 --> 00:01:14.700 there? One of the answers is a number between 24 00:01:14.700 --> 00:01:18.000 100 and 200 billion galaxies. Now. 25 00:01:17.300 --> 00:01:20.100 Let's see. What are we up against in? 26 00:01:20.100 --> 00:01:23.100 The off sent context of email addresses? 27 00:01:23.900 --> 00:01:26.800 As you know, when you look up for someone who 28 00:01:26.900 --> 00:01:30.300 someone's real name and really address that 29 00:01:30.300 --> 00:01:34.100 can get you easily feeling frustrated, 30 00:01:33.100 --> 00:01:36.600 especially few, your target has 31 00:01:36.600 --> 00:01:39.500 some commonly going to try it. Pick 32 00:01:39.500 --> 00:01:42.700 a common name in your country and Google it in 33 00:01:42.700 --> 00:01:45.600 my example, a comment creation name 34 00:01:45.300 --> 00:01:49.300 like even Horvath returns over 35 00:01:48.300 --> 00:01:51.600 4.5 million search 36 00:01:51.600 --> 00:01:52.300 results. 37 00:01:53.600 --> 00:01:56.700 I just wanted to show you how common it is. It was even 38 00:01:56.700 --> 00:01:59.200 in my country. Now when I put 39 00:01:59.200 --> 00:02:03.000 that common name even harlot in an email format 40 00:02:02.600 --> 00:02:06.100 even dot Horvat at 41 00:02:05.100 --> 00:02:08.200 gmail.com and search for 42 00:02:08.200 --> 00:02:14.200 it. I get about 171,000 of 43 00:02:13.200 --> 00:02:16.700 results, which is still too 44 00:02:16.700 --> 00:02:20.100 much. But when I put that search term 45 00:02:19.100 --> 00:02:22.400 in quotation marks, I 46 00:02:22.400 --> 00:02:23.500 get about 47 00:02:23.900 --> 00:02:26.500 190 results. And 48 00:02:26.500 --> 00:02:28.400 that is a good place to start from. 49 00:02:30.100 --> 00:02:34.000 Actually, my first stop, when looking for someone's email address 50 00:02:33.300 --> 00:02:36.200 is the search engine. Remember to 51 00:02:36.200 --> 00:02:39.600 check out multiple search engines like Bing start page 52 00:02:39.600 --> 00:02:43.900 DuckDuckGo in the country specific search 53 00:02:43.900 --> 00:02:46.300 engines, like Yandex or 54 00:02:46.300 --> 00:02:49.500 something. If your target is foreign also be 55 00:02:49.500 --> 00:02:52.400 free to make an assumption. You may know about 56 00:02:52.400 --> 00:02:55.800 one and rest but not for some other. It can be productive 57 00:02:55.800 --> 00:02:58.700 to make assumptions of possible, email addresses and 58 00:02:58.700 --> 00:02:59.700 use the verifiers. 59 00:02:59.900 --> 00:03:02.500 See if they exist now. 60 00:03:02.600 --> 00:03:05.400 Now, I will mention a few tools that worked and 61 00:03:05.400 --> 00:03:08.100 still do for my investigations. But 62 00:03:08.100 --> 00:03:11.600 just before I mentioned these tools, I would like to point out, is 63 00:03:11.600 --> 00:03:14.500 that the searches for free based email 64 00:03:14.500 --> 00:03:18.100 addresses, like Gmail or Yahoo is very difficult. 65 00:03:17.100 --> 00:03:20.200 There are different. Technical limitations. Why is 66 00:03:20.200 --> 00:03:21.900 that take Gmail? 67 00:03:23.400 --> 00:03:26.300 Or Google Mail. Well, it is in their 68 00:03:26.300 --> 00:03:29.500 best interest to be secure and they are investing a lot 69 00:03:29.600 --> 00:03:32.600 in their cyber defense, the security of 70 00:03:32.600 --> 00:03:35.400 other business emails, only depends on 71 00:03:35.400 --> 00:03:38.600 the fact. How much are they investing in their cyber defense? 72 00:03:38.600 --> 00:03:41.200 And that is not that much in most cases. 73 00:03:43.200 --> 00:03:46.600 One of the facts about email addresses. Most 74 00:03:46.600 --> 00:03:49.600 of the email search services, do not work or 75 00:03:49.600 --> 00:03:52.300 give you incorrect results. Just for 76 00:03:52.300 --> 00:03:55.800 you to be aware, not to rely on just one tool. Always double 77 00:03:55.800 --> 00:03:58.700 triple check. Everything first, 78 00:03:58.700 --> 00:04:01.600 I would like to point out is true mail dot 79 00:04:01.600 --> 00:04:05.100 IO, it's spelled TR 80 00:04:04.100 --> 00:04:07.400 you Ma i 81 00:04:07.400 --> 00:04:10.200 l .i o as you can 82 00:04:10.200 --> 00:04:11.600 see on my example. 83 00:04:13.200 --> 00:04:17.100 I put down an email spam at do garden dotnet which 84 00:04:17.100 --> 00:04:21.400 is related to my business account. The results, displayed 85 00:04:20.200 --> 00:04:23.900 here. Indicate 86 00:04:23.900 --> 00:04:26.100 that the domain provided, the 87 00:04:26.100 --> 00:04:29.800 burden dotnet is configured for email and the server is 88 00:04:29.800 --> 00:04:30.400 active. 89 00:04:32.600 --> 00:04:36.000 It also identifies that the address is a catch-all which 90 00:04:35.100 --> 00:04:38.700 may indicate a burner account on the target domain. 91 00:04:38.200 --> 00:04:41.200 The results. Definitely confirmed it. We 92 00:04:41.200 --> 00:04:44.300 are not talking about a free Webmail account, and that 93 00:04:44.300 --> 00:04:48.100 this is not a disposable temporary email. The 94 00:04:47.100 --> 00:04:50.900 second service is called verify email 95 00:04:50.300 --> 00:04:53.600 located on the verify hyphen 96 00:04:53.600 --> 00:04:56.100 email, that or address. As 97 00:04:56.100 --> 00:04:59.400 you can see. On the same example, this service provides a 98 00:04:59.400 --> 00:05:02.300 lot less data, and it says about the same. 99 00:05:02.500 --> 00:05:05.700 Get email, we previously checked that it is bad. This 100 00:05:05.700 --> 00:05:08.900 is a perfect example. Why we need to double-check things. 101 00:05:08.800 --> 00:05:11.200 Actually. This is a correct an 102 00:05:11.200 --> 00:05:14.800 existing email address. The only thing we 103 00:05:14.800 --> 00:05:17.700 received here that is correct. Is 104 00:05:17.700 --> 00:05:20.700 that the email server is a catch-all 105 00:05:20.700 --> 00:05:23.800 server next, is a service called 106 00:05:23.800 --> 00:05:26.600 email hippo located on the tools. 107 00:05:26.600 --> 00:05:30.000 That verify email address, that I/O address 108 00:05:29.700 --> 00:05:32.300 this service also gave me 109 00:05:32.400 --> 00:05:35.700 A questionable answer, but at least it was with more 110 00:05:35.700 --> 00:05:38.700 info. The target address is labeled 111 00:05:38.800 --> 00:05:42.500 as unverifiable, but we but 112 00:05:42.900 --> 00:05:45.800 I went to the more info Tab and 113 00:05:45.800 --> 00:05:48.400 I found out more details, like who is the service 114 00:05:48.400 --> 00:05:51.300 provider? Is it a catch-all server? And so 115 00:05:51.300 --> 00:05:54.100 forth. In fact, this email address that I 116 00:05:54.100 --> 00:05:57.800 tested is an alias address and only one service 117 00:05:57.800 --> 00:06:00.200 gave me a more complete answer to the question, is 118 00:06:00.200 --> 00:06:02.000 the email address even valid. 119 00:06:02.700 --> 00:06:06.300 And now next is the email format question. Besides 120 00:06:05.300 --> 00:06:08.800 the assumptions you can do like 121 00:06:08.800 --> 00:06:11.800 is it named surname just 122 00:06:11.800 --> 00:06:14.100 name at the Domain or the 123 00:06:14.100 --> 00:06:17.300 first letter of the targets name and then 124 00:06:17.300 --> 00:06:20.500 their surname? There are a lot of combinations you could try 125 00:06:20.500 --> 00:06:23.400 for that email format. A 126 00:06:23.400 --> 00:06:26.700 good starting point is if you have the targets username 127 00:06:26.100 --> 00:06:29.500 from some social network, people 128 00:06:29.500 --> 00:06:32.200 tend to have the same user names for every 129 00:06:33.800 --> 00:06:36.500 If the Assumption strategy did not work 130 00:06:36.500 --> 00:06:39.200 or it was an oracle for your needs. You may 131 00:06:39.200 --> 00:06:42.800 want to consider a service like email format. You 132 00:06:42.800 --> 00:06:46.200 can get to it by visiting email Hyphen 133 00:06:45.200 --> 00:06:48.900 for mat.com. When 134 00:06:48.900 --> 00:06:51.300 you put down the target domain, you will get 135 00:06:51.300 --> 00:06:54.300 a list of potential email formats. Actually, it 136 00:06:54.300 --> 00:06:57.200 will give you a confidence level value is the 137 00:06:57.200 --> 00:06:58.900 format right? Or not. 138 00:06:59.900 --> 00:07:03.200 There's another service. I think it's worth mentioning 139 00:07:02.600 --> 00:07:05.900 in the email formats realm and 140 00:07:05.900 --> 00:07:09.100 that is Hunter that I owe service. It 141 00:07:09.100 --> 00:07:12.700 is a paid service, but it has a free limit. You can use. 142 00:07:12.800 --> 00:07:15.900 I like the thing that it mentions, 143 00:07:15.900 --> 00:07:18.500 a source where it found the target email 144 00:07:18.500 --> 00:07:21.900 format. And now, the last approach 145 00:07:21.900 --> 00:07:25.000 to get or verify emails is the compromised 146 00:07:24.200 --> 00:07:28.600 approach. As I stated in the slide. You're 147 00:07:28.600 --> 00:07:29.600 probably aware that. 148 00:07:29.800 --> 00:07:32.300 Emails are compromised regularly in 149 00:07:32.300 --> 00:07:35.500 various data breaches. And data leaks malicious 150 00:07:35.500 --> 00:07:38.400 hacker groups, often publish email 151 00:07:38.400 --> 00:07:42.100 databases for public, use and their corresponding passwords. 152 00:07:41.600 --> 00:07:44.700 This is usually done on a service called 153 00:07:44.700 --> 00:07:47.400 pastebin that we covered earlier. I 154 00:07:47.400 --> 00:07:50.900 will mention two websites that provide this information, but 155 00:07:50.900 --> 00:07:53.800 there is more of them like this out there. They 156 00:07:53.800 --> 00:07:56.500 get often, they are they get often. 157 00:07:56.500 --> 00:07:59.500 Get they often get shut down. 158 00:07:59.700 --> 00:08:02.700 Because this is not completely legal or ethical 159 00:08:02.700 --> 00:08:05.100 in a way. There are two reasons why you 160 00:08:05.100 --> 00:08:09.100 should look here. First. If 161 00:08:08.100 --> 00:08:11.600 you learn that the email address 162 00:08:11.600 --> 00:08:14.600 of your interest has been a part of some breach, then 163 00:08:14.600 --> 00:08:17.300 it is obviously valid and the 164 00:08:17.300 --> 00:08:20.600 second reason that usually this service gives 165 00:08:20.600 --> 00:08:23.200 you in what data breach has. The 166 00:08:23.200 --> 00:08:26.100 email being found is LinkedIn or 167 00:08:26.100 --> 00:08:29.400 Dropbox or some other third service data leak. 168 00:08:29.700 --> 00:08:32.400 We will talk later in the course in more detail 169 00:08:32.400 --> 00:08:35.500 about data, breaches and leaks and how can they be relevant 170 00:08:35.500 --> 00:08:38.100 to your investigations sites? I 171 00:08:38.100 --> 00:08:41.600 have listed here are have I been pawned. Diet.com, 172 00:08:41.400 --> 00:08:45.500 and the hashed.com., I 173 00:08:45.500 --> 00:08:48.600 encourage you to check them out, but with caution 174 00:08:48.500 --> 00:08:51.400 and I will move on to the 175 00:08:51.400 --> 00:08:54.300 user names. When it comes to usernames. They 176 00:08:54.300 --> 00:08:57.500 can be really super easy to find or really 177 00:08:57.500 --> 00:08:59.500 super hard to find Hope. 178 00:08:59.700 --> 00:09:01.800 You will have the first scenario in most cases. 179 00:09:02.500 --> 00:09:05.500 As in the previous searches for email, 180 00:09:05.500 --> 00:09:08.500 addresses here with user names. I would also suggest 181 00:09:08.500 --> 00:09:11.600 search engine approach on finding that username of 182 00:09:11.600 --> 00:09:14.700 your interest. A good starting point is, if 183 00:09:14.700 --> 00:09:17.700 you already have the targets email address because people 184 00:09:17.700 --> 00:09:20.300 have the tendency to use the same username on 185 00:09:20.300 --> 00:09:23.900 many different places. I would suggest to 186 00:09:23.900 --> 00:09:27.100 visit Google, big bing Yandex or 187 00:09:27.100 --> 00:09:30.400 even other search engines because you never know which search 188 00:09:30.400 --> 00:09:31.900 engine will provide you with needles. 189 00:09:32.100 --> 00:09:35.700 The information concerning the online, username 190 00:09:35.700 --> 00:09:38.200 search engines. I will mention a few of 191 00:09:38.200 --> 00:09:39.800 them actually five. 192 00:09:41.500 --> 00:09:44.800 First is the check usernames.com website, which 193 00:09:44.800 --> 00:09:47.900 is not my first big when doing the stations, but 194 00:09:47.900 --> 00:09:50.300 I have listed it as the first one 195 00:09:50.300 --> 00:09:53.500 here because then you will understand the 196 00:09:53.500 --> 00:09:56.300 second better as I'm aware the 197 00:09:56.300 --> 00:09:59.100 chick usernames.com service. Relies on 198 00:09:59.100 --> 00:10:02.800 the service. No. MM. But it links directly 199 00:10:02.800 --> 00:10:06.300 to the Turkish profile. When one is identified. As 200 00:10:06.300 --> 00:10:09.500 you can see, I'm searching for 201 00:10:09.500 --> 00:10:10.100 the username. 202 00:10:10.200 --> 00:10:13.400 We know, which is not that good to search for because this 203 00:10:13.400 --> 00:10:17.300 username is definitely more popular in use than 204 00:10:17.300 --> 00:10:20.500 the name dot. Last name, model. 205 00:10:20.000 --> 00:10:23.400 Next 206 00:10:23.400 --> 00:10:26.500 is no one.com, which is usually my 207 00:10:26.500 --> 00:10:29.800 first stop. When I go investigating usernames, gnome 208 00:10:29.800 --> 00:10:32.700 is one of the comprehensive search websites for 209 00:10:32.700 --> 00:10:35.600 user names and many sites rely on 210 00:10:35.600 --> 00:10:38.900 their searches just like previously mentioned service. 211 00:10:38.100 --> 00:10:40.100 Check user names that come 212 00:10:40.900 --> 00:10:43.200 As you can see, I have selected to 213 00:10:43.200 --> 00:10:47.000 find Tino on the most popular online services. 214 00:10:48.700 --> 00:10:51.900 It shows, 25, it shows cut. 215 00:10:51.300 --> 00:10:54.200 It shows, 25 of them, with 216 00:10:54.200 --> 00:10:57.500 knowing, you can spend some time on finding the best solution that 217 00:10:57.500 --> 00:11:00.600 username that might use be used. Cut 218 00:11:00.300 --> 00:11:03.400 with. No, MM. You can spend some 219 00:11:03.400 --> 00:11:06.600 time on finding the best username. That might 220 00:11:06.600 --> 00:11:08.500 be used by your target. 221 00:11:11.100 --> 00:11:14.400 Then I have listed the site user search 222 00:11:14.400 --> 00:11:17.400 dot-org. This site has the potential to 223 00:11:17.400 --> 00:11:20.300 give. You may be the most accurate results, because it's 224 00:11:20.300 --> 00:11:23.500 returns a list of identified profiles matching the 225 00:11:23.500 --> 00:11:26.600 target, the basic basic search gives 226 00:11:26.600 --> 00:11:29.500 you. The results of 45 most popular 227 00:11:29.500 --> 00:11:30.300 websites. 228 00:11:34.400 --> 00:11:37.700 Next is the site and username search, engine called 229 00:11:37.700 --> 00:11:40.400 name wine.com. That's knee 230 00:11:40.800 --> 00:11:44.100 and am e VI 231 00:11:43.100 --> 00:11:46.300 n e.com. It 232 00:11:46.300 --> 00:11:50.000 allows you to begin typing, any partial username 233 00:11:49.200 --> 00:11:53.100 and immediately identify registered 234 00:11:52.100 --> 00:11:55.400 accounts with the, in the top 10 235 00:11:55.400 --> 00:11:58.200 social networks. You can have a good use of 236 00:11:58.200 --> 00:12:01.100 this search. When you are not sure about the correct spelling of 237 00:12:01.100 --> 00:12:04.000 the username, you simply add or remove a character. 238 00:12:04.200 --> 00:12:06.400 And you get immediate results. 239 00:12:09.900 --> 00:12:12.400 And last on my list is 240 00:12:12.400 --> 00:12:15.500 social hyphen Searcher. That come this 241 00:12:15.500 --> 00:12:18.600 username search service besides its Core Business of 242 00:12:18.600 --> 00:12:21.200 providing providing various. The 243 00:12:21.200 --> 00:12:24.400 targets username being used has a possibility to 244 00:12:24.400 --> 00:12:27.800 Monitor and alert you when the username of your interests 245 00:12:27.800 --> 00:12:30.700 changes or comes up on some social platform. 246 00:12:30.300 --> 00:12:32.100 That's a cool feature. 247 00:12:36.100 --> 00:12:39.100 And as before the last approach, I would like to mention is the 248 00:12:39.100 --> 00:12:42.400 compromised one. Actually for you 249 00:12:42.400 --> 00:12:45.800 to identify targets, username through a publicly available 250 00:12:45.800 --> 00:12:48.300 breach. You're probably aware that, 251 00:12:48.300 --> 00:12:52.400 as with emails, usernames are also compromised regularly 252 00:12:51.400 --> 00:12:54.500 in various data breaches. And data leaks 253 00:12:54.100 --> 00:12:57.500 usernames are accompanied along with 254 00:12:57.500 --> 00:13:00.700 their passwords hashed or in clear text. 255 00:13:00.300 --> 00:13:04.400 I will mention have I been pain.com again 256 00:13:03.500 --> 00:13:05.700 and the hash that? 257 00:13:06.800 --> 00:13:09.500 I had better luck with the hashed. The 258 00:13:09.500 --> 00:13:13.000 process is simple. Similar to the previous instructions. Enter 259 00:13:12.200 --> 00:13:15.400 your targets. Username with the intent to 260 00:13:15.400 --> 00:13:18.800 discover any data breaches, quick Bridges queries 261 00:13:18.300 --> 00:13:21.200 here. You can also make assumptions of the 262 00:13:21.200 --> 00:13:25.100 user names as you investigate. For example, let's 263 00:13:24.100 --> 00:13:27.500 say you have an email name 264 00:13:27.600 --> 00:13:30.300 at example.com. You can also 265 00:13:30.300 --> 00:13:33.600 try first name dot last name, then 266 00:13:33.600 --> 00:13:35.500 last name DOT. First name? 267 00:13:35.800 --> 00:13:38.500 On the first letters of them and so forth. 268 00:13:38.500 --> 00:13:41.100 You get the idea, we will talk later in the 269 00:13:41.100 --> 00:13:44.200 course in more detail about data, breaches and leaks. So 270 00:13:44.200 --> 00:13:47.400 I won't bother you much with them in detail. And 271 00:13:47.400 --> 00:13:50.900 now let's move on to the images part. As 272 00:13:50.900 --> 00:13:53.400 you know, images are all around us. 273 00:13:53.400 --> 00:13:56.200 Almost every device has a camera, actually. I 274 00:13:56.200 --> 00:13:59.600 don't know how have you noticed but when they are diverted the 275 00:13:59.700 --> 00:14:02.200 advertising mobile phones, they put 276 00:14:02.200 --> 00:14:05.700 a lot of effort on the camera part today's phones. 277 00:14:06.300 --> 00:14:09.300 At least have two or three cameras as 278 00:14:09.300 --> 00:14:12.300 you can presume digital photography. Has created a whole 279 00:14:12.300 --> 00:14:16.000 new element for the open source intelligence analysis. Will 280 00:14:15.200 --> 00:14:18.700 go through where to look for photos. What 281 00:14:18.700 --> 00:14:21.500 tools to use to do a reverse image 282 00:14:21.500 --> 00:14:24.600 look up. Actually, do the mystify. What a reverse image 283 00:14:24.600 --> 00:14:27.300 lookup is then we will cover 284 00:14:31.200 --> 00:14:34.500 Then we will cover the images made a data because almost 285 00:14:34.500 --> 00:14:37.800 every image has additional technical data about itself 286 00:14:37.100 --> 00:14:40.200 and for last how to approach an image from in 287 00:14:40.200 --> 00:14:42.000 forensic perspective. 288 00:14:44.600 --> 00:14:48.200 As always search 289 00:14:47.200 --> 00:14:50.600 engines, are, are my and 290 00:14:50.600 --> 00:14:54.100 your, and everyone's first up, maybe almost 291 00:14:53.100 --> 00:14:56.100 every search engine has an 292 00:14:56.100 --> 00:14:59.500 option to search for images that they have indexed. 293 00:14:59.500 --> 00:15:02.600 I will mention Google Images which are located on 294 00:15:02.600 --> 00:15:05.500 the images.google.com address. The 295 00:15:05.500 --> 00:15:08.800 second best source for images in my opinion is 296 00:15:08.800 --> 00:15:12.200 bing.com / images. Being 297 00:15:11.200 --> 00:15:14.300 may not be as good as Google, but it 298 00:15:14.600 --> 00:15:17.900 No, but it should never be overlooked and 299 00:15:17.900 --> 00:15:20.400 those to search engines in 300 00:15:20.400 --> 00:15:23.200 the image. Search context. Are often my go to 301 00:15:23.200 --> 00:15:26.200 places. Actually, I think it is better to do 302 00:15:26.200 --> 00:15:29.200 searches via the search engines. Then to 303 00:15:29.200 --> 00:15:32.700 go directly to some site with, with images, 304 00:15:32.700 --> 00:15:35.500 like Picasso the key. The 305 00:15:35.500 --> 00:15:38.600 key Point here. Is that a good search engine will keep track 306 00:15:38.600 --> 00:15:40.700 of anything published to the internet. 307 00:15:44.200 --> 00:15:47.400 And concerning the reverse image searches and 308 00:15:47.400 --> 00:15:50.200 the images metadata or exit data. Allow me 309 00:15:50.200 --> 00:15:53.200 to show you. What is it all about? They say, 310 00:15:53.200 --> 00:15:56.100 an image is worth a thousand words, but if 311 00:15:56.100 --> 00:15:59.400 the same image shows up all over the Internet, many 312 00:15:59.400 --> 00:16:03.200 times, is that number of words multiplied. Okay. 313 00:16:03.200 --> 00:16:06.300 I'm just kidding there. Reverse image, search is 314 00:16:06.300 --> 00:16:09.500 a search engine technology that takes an image file, as 315 00:16:09.500 --> 00:16:12.600 input query and Returns. The results are related 316 00:16:12.600 --> 00:16:13.400 to the image of 317 00:16:14.500 --> 00:16:17.800 One of the engines and tools like that is a service called 318 00:16:17.800 --> 00:16:18.400 teen eye. 319 00:16:22.200 --> 00:16:25.600 Okay, here we are in our favorite privacy. Aware 320 00:16:25.600 --> 00:16:28.900 web browser, Firefox and we will visit 321 00:16:28.900 --> 00:16:31.700 deny.com. That's 322 00:16:31.700 --> 00:16:36.200 t.i. N. E.y.e. Rune. 323 00:16:41.900 --> 00:16:44.500 And the. And as you can see, it is pretty much 324 00:16:44.500 --> 00:16:47.500 straightforward process. This reverse image 325 00:16:47.500 --> 00:16:50.800 search tool will show you where is your image found elsewhere 326 00:16:50.800 --> 00:16:53.600 online. The exact duplicate you 327 00:16:53.600 --> 00:16:56.300 can upload or enter an image URL. 328 00:16:58.200 --> 00:17:00.200 I will take an image URL. 329 00:17:02.200 --> 00:17:03.200 From the search box. 330 00:17:11.600 --> 00:17:13.600 I will use the Notre Dame. 331 00:17:15.100 --> 00:17:17.400 Fire picture from Wikipedia. 332 00:17:40.300 --> 00:17:42.600 And paste and search. 333 00:17:44.700 --> 00:17:47.500 Now, Dean I will do his thing. And 334 00:17:47.500 --> 00:17:50.700 here it is. As you can see, immediately. We got over 335 00:17:50.700 --> 00:17:53.400 30 results, actually 36 to 336 00:17:53.400 --> 00:17:56.600 be exact eversource is linked and 337 00:17:56.600 --> 00:17:57.300 listed here. 338 00:18:00.700 --> 00:18:04.300 This is also a great fat of for fact-checking methods. 339 00:18:03.900 --> 00:18:06.800 Maybe someone is faking something 340 00:18:06.100 --> 00:18:09.300 which you suspect and you can use this method to 341 00:18:09.300 --> 00:18:12.500 find out that their picture has been used, maybe 10 342 00:18:12.500 --> 00:18:15.100 times the on all over the internet somewhere. 343 00:18:20.700 --> 00:18:23.500 The second thing I would like to show you actually first 344 00:18:23.500 --> 00:18:26.300 to talk about it, is how 345 00:18:26.300 --> 00:18:30.300 much additional information can an image contain that 346 00:18:30.300 --> 00:18:33.600 information is called the exif data. The metadata of 347 00:18:33.600 --> 00:18:37.200 an image exif stands for exchangeable image 348 00:18:36.200 --> 00:18:39.100 file format. When you take a 349 00:18:39.100 --> 00:18:42.200 photo with your mobile phone camera that that 350 00:18:42.200 --> 00:18:45.100 picture is usually stored in the jpeg format on 351 00:18:45.100 --> 00:18:48.500 your phone and besides the information about how the picture looks 352 00:18:48.500 --> 00:18:50.400 like additional data is also 353 00:18:50.500 --> 00:18:54.000 Stored data may or may not contain 354 00:18:53.500 --> 00:18:56.100 when the picture was taken with? What 355 00:18:56.100 --> 00:18:59.500 kind of camera, what were the technical settings? Like color file, 356 00:18:59.500 --> 00:19:02.400 size, encoding process and so forth, but 357 00:19:02.400 --> 00:19:06.400 there's one very important thing and 358 00:19:05.400 --> 00:19:08.100 data about it. And that's the 359 00:19:08.100 --> 00:19:12.300 geolocation data or the exact GPS coordinates where 360 00:19:12.300 --> 00:19:13.500 the picture was taken. 361 00:19:14.500 --> 00:19:18.000 Here is a great tool called Jeffrey's image 362 00:19:17.500 --> 00:19:20.300 metadata viewer, which was developed by 363 00:19:20.300 --> 00:19:21.700 mr. Jeffrey friedel. 364 00:19:23.400 --> 00:19:27.200 You can find it on the address. Exif dot regex, 365 00:19:26.600 --> 00:19:29.800 that info / exif 366 00:19:29.800 --> 00:19:32.100 that CGI. Okay, it's not the 367 00:19:32.100 --> 00:19:35.300 friendliest URL, but believe me, that is 368 00:19:35.300 --> 00:19:39.600 pretty irrelevant. When you do your investigations, and 369 00:19:39.600 --> 00:19:41.000 when you need some data, 370 00:19:43.800 --> 00:19:45.000 So let's check it out. 371 00:19:48.100 --> 00:19:52.100 Okay. Again, here we are in our browser and let's close this. 372 00:19:53.600 --> 00:19:56.700 And visit the exit tool from mr. Jeffrey friedel 373 00:19:56.400 --> 00:19:59.500 on the address. We previously 374 00:19:59.500 --> 00:20:00.200 mentioned. 375 00:20:01.500 --> 00:20:03.300 I'm sick that right Jax. 376 00:20:15.700 --> 00:20:18.300 Okay, and as you can see, it's simple, you 377 00:20:18.300 --> 00:20:21.400 can upload or enter the image URL. 378 00:20:24.300 --> 00:20:27.200 I've prepared a picture so I will copy paste the 379 00:20:27.200 --> 00:20:27.900 URL. 380 00:20:34.300 --> 00:20:36.100 Prove that. I'm not a robot. 381 00:20:44.600 --> 00:20:46.000 Given your bicycles. 382 00:20:55.100 --> 00:20:57.800 And you image data? 383 00:21:13.700 --> 00:21:16.500 Okay. Now, as you can see, we 384 00:21:16.500 --> 00:21:19.700 got a lot of data here and I love the most 385 00:21:19.800 --> 00:21:21.400 and one of the most important. 386 00:21:23.900 --> 00:21:26.600 Information is the location. 387 00:21:28.400 --> 00:21:29.900 Where was this picture taken? 388 00:21:34.200 --> 00:21:37.100 We even have an option to go directly to Google maps with the 389 00:21:37.100 --> 00:21:38.200 provided coordinates. 390 00:21:40.100 --> 00:21:43.600 I also have to say that this metadata can be stripped down with 391 00:21:43.700 --> 00:21:46.500 ease. There are a lot of online tools 392 00:21:46.500 --> 00:21:50.400 out there that will remove the additional images data. And 393 00:21:50.400 --> 00:21:53.400 okay. I have a task for you. Try to see the 394 00:21:53.400 --> 00:21:56.900 exif data of images on your mobile applications, like 395 00:21:56.900 --> 00:22:00.000 WhatsApp, or Viber or even Facebook. Just 396 00:21:59.100 --> 00:22:01.700 give it a try. Will this work? 397 00:22:06.200 --> 00:22:09.500 And back to our slides. And lastly, considering images. 398 00:22:09.500 --> 00:22:12.200 I would like to mention a real formalistic approach to 399 00:22:12.200 --> 00:22:15.800 images. One of the tools is called 400 00:22:15.800 --> 00:22:17.100 photo forensic. 401 00:22:18.800 --> 00:22:22.000 Be addressing where the tool is located is 29. 402 00:22:21.100 --> 00:22:25.300 A DOT CH that's 29 A.C. 403 00:22:24.100 --> 00:22:27.500 H. 404 00:22:27.500 --> 00:22:31.900 / photo hyphen forensics. This 405 00:22:31.900 --> 00:22:34.500 site allows you to upload a digital image and 406 00:22:34.500 --> 00:22:37.200 then with a set of tools, it allows you to investigate the 407 00:22:37.200 --> 00:22:40.100 uploaded photo. I will only mention a few of 408 00:22:40.100 --> 00:22:44.500 the tools. That's there are cut. 409 00:22:46.200 --> 00:22:49.700 I will only mention a few of the tools that are included. First 410 00:22:49.700 --> 00:22:52.600 you have the magnifier that is a tool with 411 00:22:52.600 --> 00:22:55.500 which, you can see Small hidden details on 412 00:22:55.500 --> 00:22:58.200 an image. It simply magnifies the picture to 413 00:22:58.200 --> 00:23:01.200 the smallest pixel size, so you can better see 414 00:23:01.200 --> 00:23:04.500 if something is odd looking with the image. You 415 00:23:04.500 --> 00:23:07.100 can also apply different contrasts while looking at the 416 00:23:07.100 --> 00:23:10.900 pixels. Then you have a tool called clone detector. 417 00:23:10.900 --> 00:23:13.500 That highlights copied regions inside the 418 00:23:13.500 --> 00:23:15.400 uploaded image this 419 00:23:16.100 --> 00:23:20.300 Can be a good indicator that a picture has been manipulated minimal 420 00:23:19.300 --> 00:23:22.800 similarity, determines how similar the 421 00:23:22.800 --> 00:23:25.200 Clone pixels need to be to 422 00:23:25.200 --> 00:23:26.400 the original picture? 423 00:23:27.800 --> 00:23:30.500 Then the tool error level analysis compares. The 424 00:23:30.500 --> 00:23:34.100 original uploaded image to a recompressed image. 425 00:23:33.500 --> 00:23:36.800 With this method, you can potentially notice 426 00:23:36.800 --> 00:23:40.000 a difference in the image in is 427 00:23:39.400 --> 00:23:42.300 some section darker or brighter. 428 00:23:43.400 --> 00:23:46.400 There are more tools inside the school forensic, image tool and 429 00:23:46.400 --> 00:23:49.100 I really encourage you to go through the help section of the 430 00:23:49.100 --> 00:23:52.200 photo forensic site to learn about it better. 431 00:23:57.300 --> 00:24:00.900 And now we are ready for my personal favorite section 432 00:24:00.500 --> 00:24:03.900 hosting. The it systems. And 433 00:24:03.900 --> 00:24:06.300 the reason to that is because basically I'm an 434 00:24:06.300 --> 00:24:09.400 IT guy or better to say a cyber security professional who 435 00:24:09.400 --> 00:24:13.000 derived from the system engineering field. So 436 00:24:12.200 --> 00:24:15.100 see you in the next session and see you in 437 00:24:15.100 --> 00:24:16.500 the next video. Bye.