OSINT Amateur Hour

What happens when two complete newcomers to the art of open-source intelligence try their hand at a geolocation challenge? Turns out that, with persistence and a few key resources, we were able to get pretty close! Here's how we did it and what we learned.

I should say from the beginning that I have no formal training; however, when I came across the @quiztime account on Twitter, I was intrigued. I did a bit of reading about open-source intelligence (OSINT) analysis and techniques, and mentioned my interest to a like-minded friend who suggested tag-teaming some challenges one evening.

The initial challenge: to pinpoint where exactly this photo was taken.

At first glance, this seemed really daunting. Some random rainy corner? How on earth were we supposed to narrow this down? But then I noticed a linked tweet from the previous week, with another photo taken on the same trip:

Okay, so now we had two photos taken in approximately the same place within a few days of each other. Still, one showed what could have been any street corner, and the other showed – what – some trees? A random window? A nondescript chair?!

I huffed out a breath and took a sip of beer, and leaned in. “Okay, so, what’s here?”

We started by looking at the first photo. The newspapers on the post seemed like a good place to start; punching Die Son newspaper into Google popped up a bunch of results from a South African newspaper. Die Burger was another. Okay, so, South Africa.

We turned our attention to the second photo. Since the photo was hosted on Twitter, it was scrubbed of metadata that might have given additional clues. All that was in the photo was some trees and sky, and a chair, and - wait – buildings in the distance. A skyline.

Ah ha!

Looking more closely at the skyline, a few buildings looked pretty distinctive. I focused my attention on a black and white skyscraper that stood out to me.

I cropped the photo and zoomed in and put it through a reverse-image search on Yandex, to see what other photos I could find with the same building in it.

No dice, or rather so many dice that I couldn’t find the one I wanted. I was getting results from all over the place. Hmm.

Okay, so what else did we know? My friend brought the Twitter feed back up, musing out loud. The person who had posted it was a security researcher, right? And they’d said they were on a trip at the time? Maybe it was a work trip, or to a conference…? The first photo had a tree and what looked like might be a university administrative building...universities host conferences…?

Some quick Googling revealed several universities in Pretoria, and I decided to wing it and take a closer look at the Pretoria skyline.

Gotcha! There was the black and white building! Maybe now we could find where the second photo was taken.

A few more Google searches confirmed that this was the ABSA building in Pretoria, South Africa. But we didn't want just the city: we wanted to know exactly which building it was; which window, if possible. How could we narrow it down further from here? We looked at the map and did some Google street views of the area around the University of South Africa and it didn’t look quite right. Shouldn’t it be further out…? But where?

It felt like we were shooting in the dark.

At this point, we took a figurative step back.

"There are some hills in the background there," my friend pointed out after a moment, and pulled up a topographical map of the area. "There are some hills here, and here… "

"Good thinking. You look at the hills, I’m going to keep looking at the skyline," I decided. I zoomed in on another building that stood a bit apart from the others and identified it with the help of Google: the Agricultural Union Centre. I thought that if I could find out on a map where the ABSA building and the Agricultural Union Centre were in relation to each other, I could then compare the line between them to the angle they appeared in the photo. Unfortunately, I’ve never been great at reading maps, and I’d been staring at the screen for quite a while already.

I leaned back and squeezed my eyes shut, and, having finished my second beer at this point, I decided it was time for a break anyway. I stood up. "I'll be right back," I said. "I think the photo was taken somewhere to the south, though. Probably." I showed my friend the map and the skyline and headed to the bathroom.

Away from the table, I kept trying to think of what to do next. “South of Pretoria” wasn’t much to go on, but it was something, at any rate. Maybe we could look at the first photo again, compare the angles of the street intersection with a map to see if there were any likely matches on the university campus… it looked like there was a wide stretch of green area or forest in the second photo, so maybe we could find some kind of park?

When I returned, still mulling all this, my friend had a wide grin, and turned the tablet towards me. "The Freedom Park museum."

Sure enough, we were now looking at a view of the exact same window in the second photo, now from a slightly different angle.

"How did you…?!" I sputtered. "I was gone for three minutes!"

"You said south, and I thought about what kind of places to the south of the city might have funky windows like that. Cultural museum. Bam."

He quickly switched to another tab that had a map of the museum and its relation to Pretoria’s downtown; perfect match! We high-fived.

“I think we can call that one a win.”

“Yeah!”

We never did figure out exactly where the first photo was taken, but chalked the whole experience up to a victory nonetheless. Not bad for a first time!

So what did we learn from this experience?

• A surprising amount can be gleaned from a photo itself, even without metadata.
• Asking yourself what you can actually see is a good place to start. Making a list helps.
• Sometimes using a sort of cultural knowledge (like window shapes and where you might find unusual ones!) can provide a breakthrough, as opposed to anything specific to the data.
• It helps to tackle the problem with a friend to bounce ideas off of, and to split efforts. It helps keep you both from falling down a rabbit hole, and keeps things fun. Who knows how long I might have stared at intersections on a map? (Or how soon I might have given up?)
• Beer doesn't hurt, either.