Solving a REAL investigation using OSINT

hey welcome back to the channel my name is Gary I'm a cyber security professional by day one day maybe I'll tell you what I do by Night earlier this year a private investigator that I know reached out to me to give him a hand geolocating an image this is a real case that had real implications in the real world so it's not some theoretical ocean Challenge from popular hacking type websites so if you want to see how I did it in under an hour let's check it out alright so as you can see this video was uploaded to Instagram at 11 minutes past six on November 29th 2022 there it is there's a little football icon and there's also a TV screen with this massive purple and yellow circle on the floor I imagine that's some sort of paint or sheet or maybe it's CGI I don't know but there's clearly some sort of football match going on here and if we just look at the date November 29th 2022 see what we find what was on FIFA World Cup 2022 highlights okay so it looks like the World Cup was on which football match is on Netherlands versus Qatar ah Wales versus England that would be pretty suspect for me um a little bit of background here we don't know uh where this is obviously that's what I'm trying to locate it but we know that the person who wants it to be found their postcode is a Leeds postcode Leeds is a city in the UK If I just open up Leeds UK Maps here it is so it's sort of in the middle of the UK outside of Manchester outside of Sheffield pretty big area but it isn't too far to go to Manchester or Sheffield or York or Harrogate or any of the Little places around Leeds and in fact many people on nights out clubbing partying Etc would have no problem traveling for one hour down to Manchester Sheffield whatever to find friends and go to a bar to watch the World Cup so we're making an assumption that this is more likely to be in leads because the person requesting it is in leads and hopefully those two things connect and that's really all we have to go on so what we can do is um we can take this image and put it into Google image search and if I just take a little screenshot and then images.google.com and just drag that on there we don't get much this isn't a great set of results now we can crop the image a little bit to just sort of show the TV and the wall to see if that helps and you can see there there's some pink lines on this wall but again it's not the result that we're looking for the TV is way too big for a start so just scrolling through these I'm not seeing any great results and to be honest I wouldn't expect to find any great results it's such a low quality image you know if this was a picture of a nice building from the outside or something then yeah maybe you could maybe that would work in Google Images but we're just getting the general Vibe of places here and the same goes for Yandex and Bing probably if we come back here take this image go to Yandex drag it in yep same deal nothing popping out it just sort of sees the TV and the green so it recognizes that it's football but that's it so let's just give up on trying to do reverse image search so here's leads on a map and let's just pop back here and do some basic image analysis and we break the image down into chunks when we do this you look at the foreground the middle ground and the background the foreground here for me and this is a bit subjective you can make the foreground whatever you want but it's the stuff that's closest to the camera it's this table so there is a rounded Edge probably black glass table here which is reflecting the TV the middle ground I'm going to call the rest of the image the building and the background is this stuff where my mouse is here that's actually outside outside a window this TV is mounted into a big window frame or a door frame potentially and we'll come to that in a second if I just move myself up here and grab the ellipse stroke we're gonna make uh thicker fill let's kill the fill this thing right here what is that I spent some time in the Middle East but you can get this stuff everywhere these days that is a shisha or a hookah so on the top you got these little Embers glowing coal sort of Embers on top of some tin foil and then a tube and then you get this little ashtray to catch it and then underneath the table with the reflection of the table the reflection on top shows uh the inverted image of the top of the shisha pipe but underneath that probably all the way down to the floor would be the rest of this shisha so let's just jump over here and I'll show you that hooker pipe here we go there it is so that is that for sure without a doubt looks exactly like it so we know we're in a shisha bar a hookah bar maybe some sort of middle eastern restaurant type place so that gives us some more clues so we could search for leads Middle Eastern restaurants Leeds Shisha bars shisha cafes we could even try and go through Twitter and try and do some clever searches to find images that were taken and uploaded at locations like that on the World Cup days but that that's a bit more tricky so let's just do the simple stuff first so we got this hook a pipe here we've also got the TV which we've identified as the World Cup probably England v Wales we could go and watch the match on YouTube and figure that out but we're pretty happy you got these wall panel things here these lights and then these black bars and if you look the black bars here are thinner than the black bars over here and that would imply to me that they are they're not painted strips they're actually like wooden beams or plastic beams stuck onto the wall and they appear to curve near the top so if you look up here at the top you can see it starts to sort of curve out as noticeable on that light as we're over here you can't see it because it's more head-on with the camera so some sort of curvy roof with lights probably going along it and you can see that here in the glass you see the pink lines here that's on the roof that's a reflection of these pink bars going along the roof so we're starting to picture in our mind what this might look like walls with these three black bars and then these neon type lights going up along the roof I would also imagine that these lights can change color and be multi-colored and things like that probably normally with like the lights that I have here in the studio you either get a plain light which just is white and you can change the tint to be slightly more yellow or not or you get an RGB light which can be any color and if it's pink it's probably an RGB light no one just buys a pink light generally so I'm gonna guess that when we're looking online we can expect to find more than just pink um so that's an idea as to what the room might look like and then this is the outside world here all of this here if I just turn that here that is looking into the outside world because we know that's a glass panel and you can also see oh if I just delete these and zoom in here she lets put one of them back and make it a bit smaller you see this and it's got a little friend over here to me those look like sliding door handles you put your hand in there and you slide the door open or you slide the window open they're at the same height and they match there's two of them so I think some sort of window or door that slides if it's to the outside world it could be both a window or a door I mean that'd be a very big window if it's going to have a big TV like that but it could be a window especially if it's a business which I'm pretty sure that it is not someone's house um so yeah that is clearly some sort of sliding apparatus likely a black frame now what we can do is we can click on that image layer and I can hit uh command M and it brings up this curves adjustments normally in photography you would darken the dark bits and lighten the light bits and it gives it a contrast boost but here we could do the invert we could lighten the dark bits and just see if we can see more things see that look into the background what can we see does anything pop out at us do we get any more information just by boosting that up not a wild amount this this interests me though these little white dots with lines coming off them in this horizontal line that could be a useful thing to try and find later down the line so let's just turn that off again Okay so we've got a TV mounted in a window frame doorway we got this room that has these three black beams that curves along the roof and then there's neon lights breaking all that up it is a shisha Cafe a hookah lounge maybe in leads okay so let's take a look jump back over here and you can see I've already got this Halo Lounge thing up I didn't want to waste anybody's time I was also afraid that they might delete the Instagram channel for some reason if times are tough the channel might disappear so I've kept that here let's do a search shisha and what do we get quite a few and bear in mind this is just in the leads area quite a few and this is what I did I scrolled down this list to see if anything jumped out and as you scroll down the page you see this so you know that that's a pretty bad photograph because it's at a weird angle um it's not at the angle that we saw previously you know straight vertical lines but because we thought through everything it's not pink for a star it's blue but we already talked about it's pink so it's maybe an RGB light so we could maybe expect other colors that's what we've got we've also got a few black bars in between those lights we're going to count them in a second in the top left is that maybe a TV there already from this one image alone we're pretty sure that this is a strong Contender and click on that button links you off to the Instagram profile so here it is Halo Lounge and if we scroll through this we get some nice food coffee photography but at the bottom here back in the day when they launched they put some of these photographs up and one of them is a video so let's take a look here we go boom we got a bay window or a door we got this brick wall behind us that's quite interesting I wonder if we go back to this photograph we zoom in maybe turn that curves adjustment back on that might be some of this pattern that we're seeing here on the wall that might be that brick wall reflecting behind us potentially um let's click play got the curve on the roof oh there is our slidey window door type thing but there's no TV in front of that one but there is a TV here in front of this one there it is same day low same black frame with some sort of window door panels inside of it so I reckon that TV there is this TV here not bad pretty strong contender and if we look the photographer has uh table there's there's the TV and there seems to be some sort of seats over underneath the TV there but then there's also this seating in between our table and the TV and its table underneath it so I think we're on the far side with our back right against the wall so maybe over here on this side there's the the two chairs and the table there's the two chairs on the table and then our TV make sense cool and it goes all the colors under the sun there's the pink oh it does those are nice so Halo launch how do we move forward to maybe get some sort of confirmation Let's uh zoom in on it and have a look at the area so drag street view onto here and here we go so there is Halo lunge and these shutters cover glass that's what shutters generally do entryways into buildings are covered by glass sorry covered by shutters so the doors here on the left and the right and then I guess these are all just window based not sliding door base sliding window base and if we spin around we can see Grove Cafe and we get to see this wonky 20 miles per hour sign and if we go back here and we just zoom in do you see this little bit here you've got if I just move myself again just there outside does that look like a wonky 20 miles an hour sign to you because it does to me it's at an angle and it's got this curvature on it what are the chances that that is that sign pretty strong I think pretty strong so I think that could be where we're at so there you have it those are the exact steps that I took to figure out where that image was taken in under an hour now my buddy had to go there physically and confirmed that is actually the right location and it is the right location case closed but as you can see it was a pretty manual process to get there sometimes you gotta get some search results and then just go through them manually which can be time consuming but that's the nature of the ocean game so keep practicing I'll see you next time foreign

Channel: Gary Ruddell

Views: 107,917

Keywords: cyber, cyber-security, hacking, learning, productivity, command line

Id: Lij0cpFl9Bw

Length: 19min 3sec (1143 seconds)

Published: Mon Jun 26 2023