City Crawl: Sofia Santos OSINT Exercise #028 Write-up
Hi again, welcome to another one of my write-ups, where I will guide us through the steps I took to complete Sofia Santos’ OSINT Exercise #028.
As always these exercises are a great dose of fun and challenging, and I am always learning about new approaches and ways of tackling an investigation.
Let us begin.
Sometimes the fastest way to geolocate an image is to track down the movements of the person behind the lens. I took the photo below, on 20 September 2023, at 08:11 local time.
Your task is to determine:
a) What device I used to take the photograph.
b) Where I was headed.
c) How far I was from the entrance of my destination.Bonus challenge: In which hotel did I stay?
Click here to open the image on a new window.
In what device was the photograph taken?
Based on the nature of the question, I expected to find some clues in the metadata of the file. When looking at the file name alone, we can see that the date and time (down to the second) match the description of the brief.
I used an Exif viewer extension that allows me to extract metadata from images without having to save them to my computer.
Through the information provided about the Camera Make and the Camera Model we can conclude that the picture was taken with a Samsung device. After googling “SM-A125F”, I was able to narrow things down and see that the photo was specifically taken with a Samsung Galaxy A12 device.
Answer to a)
The device used to take the photograph was a Samsung Galaxy A12.
Where was Sofia headed?
It’s time to do some social OSINT! I was able to find Sofia’s Twitter and LinkedIn through the direct links provided on her website, or by googling “Sofia Santos OSINT”.
I started by doing an advanced Twitter search to see the type of content that Sofia had posted on her Twitter during the entire month of September of 2023 (from 01/09 - 30/09) to see if I could get any clues about her whereabouts.
The reason why I cast a wider net for the entire month of September was to take into account the fact that maybe she didn’t post anything relevant on the exact date of the 20th, but could have made references of what she was up to a few days before or prior.
Through Twitter’s advanced search I was able to find a tweet she posted on the 24th of September, 2023. This tweet mentions that she was a speaker in the “SIRIUS CTF Finale: The role of women in OSINT investigations event”.
The tweet also contained images of the event, the medal and a letter of appreciation dated: 20th of September 2023.
Since Twitter has a character limit, I checked Sofia’s LinkedIn to see if I could find more information about the event she attended. At the moment things are checking out, the letter of appreciation is dated on the same day as the photo was taken, but I still wanted to double-check.
Unlike Twitter, LinkedIn is not as precise with their time stamps, we can just see that it was posted 9 months ago. Through trevorfox.com I was able to extract the ID of the LinkedIn post and get the exact date of when it was posted (check out the website for more details on how this is actually done, it’s pretty cool).
The local time is based on my own timezone, not the poster’s.
Based on this information and the fact that Sofia mentions on her post that she gave the talk “last Wednesday” we can confirm that the date of this event falls on the 20th of September.
Furthermore, on her LinkedIn post it says that she was in the Europol headquarters for this event.
For even more conclusive information we can also refer to Europol’s Consolidated Activity Report from 2023, which summarizes the SIRIUS Capture the Flag event for us, it states that the event took place at Europol on the 20th of September.
I was able to find the address of the HQ in Europol’s website:
Europol
Eisenhowerlaan 73
2517 KK The Hague
The Netherlands
Answer to b)
Sofia was headed towards Europol’s Headquarters in The Hague. Eisenhowerlaan 73, 2517 KK. The Hague. The Netherlands
How far was Sofia from the entrance?
First I analyzed the image to see what pointers to look out for. What stood out the most was the tall triangular shaped building in the background. Overall, it looks like the picture was taken in a suburban zone considering the house number, mailbox, and the large house in the background.
After checking the vicinity of the Europol building on Google Maps, the triangular building immediately stood out. To the left some houses with flat roofs and numbers from 55-61 can be seen.
After checking house number 55 with street view, we can confirm that this was the house pictured in the source image. The gate and house number match, the mailbox, tree and green pipe are also present.
We now have our start point, Sofia was in Eisenhowerlaan 55, 2517 KK. The Hague.
In the Contact us section of the Europol website there is a map outlining how to get to the entrance. Since we know that Sofia was coming from Eisenhowerlaan, we can see the route she took to arrive to the entrance.
I used the measuring tool provided by Google Maps to get an approximate estimate of how far away Sofia was from the entrance.
Answer c)
Sofia was about 172 m from the entrance.
Bonus! Which hotel did Sofia stay at?
Although this information was already revealed in comments of her LinkedIn post, I still find it useful as a beginner to practice.
As we know from the LinkedIn post, the image above was taken from the hotel Sofia was staying at. Even though the background is blurry we can get some significant visual markers. There is a black and white building containing three elevations on top, we can also see orange roofs below and a clear horizon.
Since the Netherlands is very flat, I figured that the hotel was most likely by the forest of by the beach, as there were no other tall buildings further in the background.
I began by searching “Hotels in The Hague” on Google Maps to get visual markers of where the hotels in the city were located on the map.
After that, my process was to manually check for any buildings that matched the background in the source image. based on the lack of buildings further in the horizon, I decided to start with the hotels that were near the forest and the beach in The Hague. I was looking for a black and white building with the three elevations at the top, with shorter structures that had orange roofs in the vicinity.
I enabled 3d mode for this, which allowed me to see the difference in elevation between the buildings to make my search easier.
After some time, I found the black and white building that matched the source image on Google Maps. We can see that the hotel in front of it is the ibis Styles Den Haag Scheveningen. The short houses with the orange roofs are present and so are the shorter buildings in the foreground.
A picture uploaded by the hotel itself, showcasing the seafront view also gives us a look into the perspective of someone inside the hotel and facing out into the street. We can see that the picture’s background is very similar to Sofia’s.
Answer to bonus question:
Sofia stayed at the ibis Styles Den Haag Scheveningen hotel. Gevers Deynootweg 63, 2586 BJ Den Haag
Thank you so much for having a look at my write-up, I hope this has been fruitful. Until next time!
-Stay curious and keep diving into OSINT, for the world's secrets unfold to those who never stop seeking.-
