Dubbed Social Mapper, the facial recognition tool automatically searches for targets across 8 social media platforms, including—Facebook, Instagram, Twitter, LinkedIn, Google+, the Russian social networking site VKontakte, as well as China's Weibo as well as Douban—based on their names as well as pictures.
The tool's creators claim they developed Social Mapper intelligence-gathering tool predominantly to help pen testers as well as cerise teamers alongside social engineering scientific discipline attacks.
Although the searches of names as well as pictures tin already last performed manually, Social Mapper makes it possible to automate such scans far faster as well as "on a volume scale alongside hundreds or thousands of individuals" at once.
"Performing tidings gathering online is a time-consuming process, it typically starts past times attempting to honour a person's online presence on a diversity of social media sites," Trustwave explained inward a blog post detailing the tool.
How Social Mapper Open Source Intelligence Tool Works
Social Mapper plant past times running through 3 stages:
Stage 1—The tool creates a listing of targets (consisting of a advert as well as a picture) based on the input y'all give it. The listing tin last provided via links inward a CSV file, images inward a folder or via people registered to a companionship on LinkedIn.
Stage 2—Once the targets are processed, the mo phase of Social Mapper kicks inward that automatically starts searching social media sites for the targets online.
The researchers advise running the tool overnight alongside a expert mesh connective equally the search could stimulate got over xv hours for lists of 1,000 people as well as role a pregnant amount of bandwidth.
Stage 3—After searching, the tertiary phase of the Social Mapper starts generating reports such equally a spreadsheet alongside links to the profile pages of the target list, or a to a greater extent than visual HTML written report that also includes photos for rapidly checking as well as verifying the results.
What Could Possibly Go Wrong?
However, since the tool is similar a shot available inward open-source, anyone including bad actors or tidings agencies tin reuse facial recognition tech to construct their ain surveillance tools to search against already collected trove of data.
The companionship farther proceeded to outline unopen to nefarious-sounding uses of Social Mapper, which are express "only past times your imagination," i time y'all stimulate got the goal number inward your hand, suggesting that it tin last used to:
- Create faux social media profiles to "Friend" targets as well as hence ship them links to downloadable malware or credential capturing landing spider web pages.
- Trick targets into disclosing their emails as well as telephone numbers alongside vouchers as well as offers to pin into "phishing, vishing or smishing."
- Create custom phishing campaigns for each social media platform, making certain that the target has an account, as well as brand these to a greater extent than realistic past times including their profile painting demonstrate inward the email. Then capture the passwords for password reuse.
- View target's photos looking for employee access bill of fare badges as well as familiarise yourself alongside edifice interiors.
Trustwave has made Social Mapper available on GitHub as well as making it available to everyone for free.
Trustwave's Jacob Wilkin is going to introduce Social Mapper at the Black Hat USA conference this week, where IBM Research is detailing its highly evasive as well as highly targeted AI-powered malware called DeepLocker.
