OSINT Techniques – Image Searching

Generally speaking – you will commence an OSINT investigation for a person with some very basic details. These details will likely include their full name, year of birth, place last seen, and perhaps some other attributes or context around their circumstances just prior to disappearing.
There may well also be a profile picture of the missing person, which has likely been provided by their next of kin to aid in locating this person.

Depending on how long the person you are looking for has been missing, it may be hard to find information on the subject due to the amount of reposting and redigesting of the missing persons report. So it may be useful to use some clever Google hacks to filter out the noise and get to the information you need – but first and foremost – if there is a profile picture of the subject, and it looks to be an actual photo, and not a scan or photo of a photo… then that image likely exists somewhere on the Internet.

Image Searching and Pivoting

So what can we do with an image of a subject – we can search for places where that same image has been used on the Internet, and we can investigate the context of that image reuse.

Chrome makes this really easy with the right-click functionality ‘Search Google for Image’ however with other browsers you may need to install an add-on to achieve this.

1000+ Great Male Photos · Pexels · Free Stock Photos
Randomly selected profile image from the Internet

Now that I have my randomly selected profile image, I now want to know where else this image has been used. As I mentioned, Google Image search has this functionality, and there a multitude of other resources available too which do the same thing, but have likely got some different techniques in their search function.

Google Image Search results for the random profile image

It appears I have randomly selected a stock photo which is being used across a massive spread of different websites. My initial thoughts for this example was, this was a poor choice to explain the concept – but there is another thought here….

This person has either had their identity stolen, or they are a male model of some description.

Working on the premise of the latter, then this content could potentially be licensed (i.e. subject to copyright), and fortunately Google will allow you to filter for results where the content has been flagged as commercial use only.

A single result for a commercial term for the image.

The image can be found on pexels.com, and has been marked as free for use, so this explains the widespread usage of the image. But there is some interesting information available with this sample which could be of use.

Image result interesting information

According to the image it was uploaded on 5th of November 2016 by Pixabay, but the image was reportedly taken on 6th of May 2015. This is interesting in that we now have a time that the photo was taken, and we can also see that someone called ‘pixabay’ presumably uploaded it more than a year after it was taken.

But we can also see here that the image was taken using a commercial grade Canon EOS camera, and we can also see the settings used by the photographer at the time the photo was taken.

If you are familiar with Pixabay, this is another image website where images are freely licensed, and searching for specific entries in that website becomes problematic too. So we can adjust the Google Image search parameters to see if we can find the image in there too.

Filtered by license – Creative Commons

Now that I have filtered by Creative Commons we can see some different results – and there are some Pixabay options in here too. So lets take a look at what I suspect may be a named photo on the second row, second from the left.

And I hit another dead end here, the user who uploaded this image did so sometime after July 2020, well and truly younger than a majority of the other hits.

Lesson learnt here: There are many, many ways to pivot around an image.

Just for fun, I decided to run this image through the Google Vision API (a paid API through Google Console) to see how the same image appears to an API search. I did this through TheHive after raising the case as an Incident Case.

The output from the API call gives me a rundown of the URLs where this image has been seen on other websites. The same image, including when it has been scaled, flipped, or included in the background behind other elements.

100words.org.au background image found by GoogleVision API

There is also an alleged reference as an Amazon author for C# Programming Illustrated Guide For Beginners, which reportedly identifies the man in the profile image as William Sullivan.

Alleged William Sullivan identity associated with the profile image

But the bit I really like about the GoogleVision API is what the Google Algorithm attributes as keywords to this image. In this case, there are some interesting results which could also be used for pivoting.

Google Vision keyword associations

Google weights these scores in descending (strongest to weakest) where it for the categories it associates with the image. For example, the highest value has been assigned to that of it being an image (correct), and that is features prominently on stock imagery websites (correct).
But more oddly, it determines a mid-range likelihood of the image being related to a person by the name of Oleksandr Savchenko. Given the scoring here, there could be some merit in pivoting on the name Oleksandr Savchenko.

Google Image searching for Oleksandr Savchenko

Frustratingly, there is another Amazon profile using the same image under the name Oleksandr Savchenko.

More lessons learnt: There are more tools out there to help you when you feel like you are stuck. You might still get stuck, but sometimes you will come up with more interesting results.

And also – not everything you find on the Internet is accurate. There is definitely a lot of deception when it comes to usage of stock imagery for profile images.

Summary

This particular person’s profile image is very well used, and perhaps its popularity aided in my selecting it in the first place. Searching for ‘profile photo’ in Google Image search will likely also give you the same image as I found to conduct this experiment. However, if you were to choose a lesser known / popular image in terms of Google etc, you may come up with more useful results.

In testing the Google Vision API previously, I had fed an image of an active missing person’s profile to the API. In the results was a reference to a street name and a suburb. Interestingly, when Googling the street name and suburb in Google Maps, a default view is brought up from the Street View (which is the case when you do not specify exactly where you want to place the marker).

In this case, the image presented on the street name search, was the previous residence for the missing person, and it was returned as the default street result.

Also interestingly now that I had the address for the missing person, I could feed an image of the front yard to Google Vision API, and it provided me with another photo of the same property from a different direction and from several years earlier prior to the missing person living in the residence.

So there is some very interesting functionality buried in the Google Vision API which is not presented to the Google Image search and Google Maps functionalities.



Categories: Techniques, Uncategorized

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: