@iamTiresias@BenDoBrown Collect enough data you can identify people based on sensitive locations
Then you pull up all their activities and more often than not you then identify their home address
Home/Work are two of the main places people do activities to and from
Example
https://t.co/Zr5VZBEdPy
[#OSINT|#SOCMINT|#OPSEC] If you collect enough location/fitness data and create some simple tooling around it, you are able to create a very powerful reverse lookup tool.
Restricted locations are more vulnerable to this technique.
1/5
@GBPolitcs A few years ago I scraped all the activity data from Strava, then built custom tooling to search all activities against any location in the world.
Here is the Nuclear Naval Base in Scotland, Faslane. I could then identify many of their home addresses.
https://t.co/gsFFW4q3Kq
@Richard_AHolmes A few years ago I scraped all the activity data from Strava, then built custom tooling to search all activities against any location in the world.
Here is the Nuclear Naval Base in Scotland, Faslane. I could then identify many of their home addresses.
https://t.co/gsFFW4q3Kq
@EthicalHoopz@PolitlcsGlobal@lemondefr All you have to do is scrape the activities on a regular basis and you can do this all day long, despite even the pentagon telling it staff to stop using strava they still do, along with lot of other sensitive locations.
Ive posted a few times about it
https://t.co/Zr5VZBEdPy
[#OSINT|#SOCMINT|#OPSEC] If you collect enough location/fitness data and create some simple tooling around it, you are able to create a very powerful reverse lookup tool.
Restricted locations are more vulnerable to this technique.
1/5
@LifeInGen6@TechloreInc What’s more wild is how this method is very very rarely protected with rate limiting. Facebook, WhatsApp, Apple, Strava, all of them have fallen fowl of this.
@nbacyberguy@CraigHRowland Exactly. However that would take a level of integrity he clearly lacks. Instead of admitting he’s wrong, he doubles down. Even his Tor comment is nonsense.
@CraigHRowland Ask any survivor how they feel about their abuse being called “porn.” They don’t. That’s why professionals use CSAM, it’s about respect and accuracy.
You work in security, you know precision matters. Calling CSAM “porn” is like calling a malware payload “software.”
@CraigHRowland The acronym isn’t about “hiding it” , it’s about accuracy. “Kiddie porn” implies consent or legality. CSAM makes it clear it’s child sexual abuse, not “pornography.” The wording matters because the harm is real.
@CraigHRowland People love to claim Tor is full of CSAM, but the reality is far darker, most abuse material surfaces on the clear web, social platforms, and messaging apps. Tor isn’t the source of the problem; the open internet is. 2/2
@CraigHRowland The term “kiddie porn” trivializes real child abuse. The correct term is CSAM (Child Sexual Abuse Material) it’s evidence of a crime, not “pornography.” Words matter. 1/2
@FWOsint@UKOSINT@unusual_whales I was working on something a couple of months ago with the same dataset which could predict with extremely high accuracy people who worked at these locations and other so long as they did activities within 1-2 miles. And was close to more than 3-4 of these locations. 3/3
@FWOsint@UKOSINT@unusual_whales I was able to then identify people who worked at sensitive locations like the Pentagon/CIA/NSA and then their home addresses. Even Putins Palace. It’s not just Americans but even Russians using the app at sensitive bases/locations. 2/3
[9/9] I might write a full article on this once the run and research are complete.
In the meantime, if you’re interested in the details like methods, performance, tooling, or results, feel free to DM me.
[1/9] Working on a new and extremely ambitious project.
Generating 208 Trillion Gmail addresses to brute force a hash table of 80M MD5s.
Trying to reverse anonymised emails at scale. Here's how it works and why it matters.
#osint#infosec