Updated on 27 April 2012: The image with the metadata that was hosted on TinyURL has been removed and both Facebook Users have been marked as “unavailable”.
I have produced a Maltego Graph hosted on GitHub with the GPS EXIF Image Forensics Local Transforms from Recx Ltd of the image from the PasteHTML page referenced in the statement of Scott Jensen:
The following were also noted during this OSINT exercise:
- imgur removed the EXIF and GPS data from each uploaded image, as observed within exhibits #1, #2, #3 and #4. However, the articles of clothing (or lack thereof) are similar to the image hosted on TinyURL.
- The Latitude and Longitude of the image are -37.857,145.2503.
- The relationship with Kylie Gardner (the woman in the image) was correlated to Huginio Ochoa’s Facebook.
- Searching for the UserID of “higochoa” e.g. deviantART or Twitter, and also ”HiginioOchoa” e.g. ning might result in additional examples of membership of other Social Networks. Further correlation could be achieved by exploring the relationship to @OzGirl (i.e. Kylie Gardner), such as this example.
I estimate that there are approximately 292 web servers for Microsoft Small Business Server (SBS) with RDP (possibly) enabled based on the Maltego Graph hosted at GitHub which the SHODAN and BuiltWith Transforms.
I developed three (3) Maltego Local Transforms that return a Gravatar Image and MD5 hash of an e-mail address as shown in Maltego graph below:
The Alpha v0.0.2 release is available for download from Google Code and the repository is hosted on GitHub, including the Roadmap, etc.
I would like to thank Andrew MacPherson from Paterva for his review of the Alpha v0.0.1 release.
This is a preview of my first article that will be published in the second printed issue of Secure Computing Magazine (Australia).
These series of articles will be based on the slides that I presented at SAGE-AU in November 2011.
The article has been quoted in its entirety as it will be shorten for publication due to pagination for print.
A “fingerprint” is a more visual and shorten representation of a OpenSSH Public/Private Keypair that reduces the rate of error when viewed by an End User or System Administrator when correlating a OpenSSH Private Key to a OpenSSH Public Key (or vice versa).
When generating a new OpenSSH Public/Private Keypair using ssh-keygen (with default values excluding the comment) the fingerprint and associated ASCII “randomart image”[1] are automatically displayed:
The key fingerprint is:
The key’s randomart image is:
+—[ RSA 2048]——+
| |
| |
| . |
|. . o |
|.o.. o S |
|+E o o. . |
|+ . + o o . |
| . . .o += . . |
| .**o. . |
+————————-+
The above fingerprint and associated ASCII “randomart image” can be reproduced at a later date with ssh-keygen -lv -f ~/.ssh/id_rsa.pub and the same fingerprint is displayed for the OpenSSH Private Key i.e. ssh-keygen -lv -f ~/.ssh/id_rsa (i.e. without the .pub file extension) to identify the related OpenSSH Public Key transmitted to the remote host.
OpenSSH can also display the same fingerprint in “BubbleBabble” [2] encoding i.e. a series of pseudowords, with the -B command line option to further improve readability over hexadecimal e.g. on OpenBSD 5.0:
cmlh@openbsd$ ssh-keygen -B -f ~/.ssh/id_rsa.pub
2048 xobar-defab-pitom-byrok-zokos-geden-zopov-nedog-segeg-rykoz-noxax/home/cmlh/.ssh/id_rsa.pub (RSA)
In addition, the associated ASCII “randomart image” can also be displayed with the “BubbleBabble” [2] encoding with the -Bv command line option to further improve readability e.g. on OpenBSD 5.0:
cmlh@openbsd$ ssh-keygen -Bv -f ~/.ssh/id_rsa.pub
2048 xobar-defab-pitom-byrok-zokos-geden-zopov-nedog-segeg-rykoz-noxax/home/cmlh/.ssh/id_rsa.pub
The key’s randomart image is:
+—[ RSA 2048]——+
| |
| |
| . |
|. . o |
|.o.. o S |
|+E o o. . |
|+ . + o o . |
| . . .o += . . |
| .**o. . |
+————————-+
![A Maltego Graph leveraging the “Just T[he]IP” Local Transform of gamearena.com.au and is available from GitHub and CodePlex.
According to http://www.telstra.com.au/abouttelstra/media-centre/announcements/bigpond-games-site-security-incident.xml, 203.46.104.10 is “operated by a third party company”. However, this is disputed since the last identified hop of the route to 203.46.104.10 is 165.228.157.30 which resolves to telstr516.lnk.telstra.net (the complete list of route hops is available from visualroute.visualware.com).](http://25.media.tumblr.com/tumblr_m4ifaewLem1qz5xz0o1_1280.png)
