Document Metadata, The Silent Killer - PaulDotCom

More documents

Recommendations

Info

Where This All Started (for me) • Inspiration: Myspace private picture leak • Automation grabbed 560,000 images marked as private from 44,000 profiles • That’s 17GB of pictures! • I figured there was a bunch I could learn from the metadata... (gps data on those sexy pics?) Wednesday, March 11, 2009
What I Learned • Processing 560,000 images is a nightmare • Those “sexy” images often weren’t so sexy • Myspace truly is the “Wretched hive of Scum and Villainy” • Images uploaded to Myspace are converted and sanitized of metadata! Wednesday, March 11, 2009
Page 1: Metadata in Common Document Types !
Page 5 and 6: Wednesday, March 11, 2009
Page 7 and 8: Wednesday, March 11, 2009 Word!
Page 9 and 10: Word! $ strings Test_Metadata_Docum
Page 11 and 12: Wednesday, March 11, 2009 Acrobatic
Page 13 and 14: Acrobatics! $ strings Test Metadata
Page 15 and 16: • So, what can we learn? Strings
Page 17 and 18: Too revealing? • How about the em
Page 19 and 20: Wednesday, March 11, 2009 Picture t
Page 21 and 22: Speaking of location • How about
Page 23 and 24: Adding GPS up • We now know: •
Page 25 and 26: A few scary examples • Eliot •
Page 27 and 28: Wednesday, March 11, 2009 Eliot, Ho
Page 29 and 30: Wednesday, March 11, 2009 Tina, Hom
Page 31 and 32: Wednesday, March 11, 2009 Taking it
Page 33 and 34: How do we know? • PGP Keysigning
Page 35 and 36: Direct e-mail example Delivered-To:
Page 37 and 38: OOO Subject: [Email Tips] The Keyma
Page 39 and 40: Too cool for tool • Sure, there
Page 41 and 42: Analyzing Word • Metagoofil • E
Page 47 and 48: Exiftool • It turns out that Exif
Page 49 and 50: Custom user lists • So, lets take
Page 51 and 52: My pwn SANS Paper InfoKey: Creator
Page 53 and 54:
JPEG GPS Data • Google maps is yo
Page 55 and 56:
Wednesday, March 11, 2009 Maltego D
Page 57 and 58:
Wednesday, March 11, 2009 Document
Page 59 and 60:
Wednesday, March 11, 2009 This is h
Page 61 and 62:
How can this be used? • Determine
Page 63 and 64:
Wednesday, March 11, 2009
Page 65 and 66:
Consider this... • Remember this
Page 67 and 68:
Microshafted! • For prior to Offi
Page 69 and 70:
PDF! • Acrobat Standard/Pro • G
Page 71 and 72:
A note on cleanup... • Some infor
Page 73:
EOF larry@pauldotcom.com http://www
show all

Document Metadata, The Silent Killer - PaulDotCom

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?