6 ms·

'Cree.py' Social Engineering Tool Pinpoints A Person's Physical Location

125 points by ssclafani 16y ago

cadab 16y ago
Been running it for about 15 minutes now and its still downloading the tweets/photos. Anyone else experiencing this sort of delay?
- ilektrojohn 16y ago
  Yeap, it gets like this for users with many (>5000) tweets, a big number of which contains some link to image hosting services or foursquare . I guess that the amount of retrieved locations will make up for the wait.
  - kmfrk 16y ago
    I get the same for people with <1000 tweets, and it eventually terminates with some sort of error. It can't retrieve twitpic photos and returns a 502 for one. Running it on Windows 7. I wouldn't be surprised if the error is with Twitter.
Nanofied 16y ago
This is awesome. Kinda scary for you guys that use geolocation with everything though. I personally try to avoid it.
- pyre 16y ago
  Geo-tagging your photos is kinda cool, and it's a feature that I would find interesting if I had a device that supported it, but I would make _sure_ to strip those tags before publishing the photos anywhere.
  - nuxi 16y ago
    Startup idea: Strip.py?
    - berntb 16y ago
      >>Strip.py Write in Erlang. Surprisingly, Strip.er and Stripp.er are free... Eritrea is an unusually disgusting dictatorship afaik, so they'll probably be happy to sell domain names (along with body parts of people with the wrong opinions). Lots of English words end in 'er', right? Another business idea -- offer to administer the top domain. Edit: http://en.wikipedia.org/wiki/.er http://en.wikipedia.org/wiki/.er
      - eli 16y ago
        I don't think they're for sale, actually.
    - kmfrk 16y ago
      Would make a good Mac App Store ... app. And, perhaps, web service. After all, privacy is the new green. On the other hand, you'll need to educate people about the dangers of meta-data, before you can attract them to use your product.
snitko 16y ago
Twitter icon in the app is awesome.
Animus7 16y ago
Neat. It's pretty much exactly what Color is trying to do, except it cost $41 million less to make.
- matthewslotkin 16y ago
  Speaking of Color, you can use Color it in combination with this locator and this: http://www.digitaltrends.com/mobile/color-hack-allows-users-to-spy-on-anyone-from-anywhere/ http://www.digitaltrends.com/mobile/color-hack-allows-users-... to massively multiply your creep factor.
  - GrandMasterBirt 16y ago
    People love the new "everything is social" movement (twitter, FB, etc) and now color. The problem is that people don't realize what they are exposing and the conflict of interest is that these companies want EVERYTHING exposed so they can advertise/market. That's the problem. People just don't get it. Or rather people don't realize the value their personal data has.
thascales 16y ago
Well, I hope this doesn't surprise anyone. I'm running under the assumption that people who use Foursquare and other such geolocation services are fully aware that they can be used to find out where they've been. If that assumption is false, I think I'm going to become a hermit.
- Animus7 16y ago
  Well, it does other stuff like mine pictures for meta tags, the privacy implications of which wouldn't be obvious to a non-techie.
  - heyitsnick 16y ago
    And I doubt most people realise; Twitters tweet location * Coordinates when tweet was posted from mobile device [side note: is this feature 'enabled' by default on some mobile clients?] * Place (geographical name) derived from users ip when posting on twitter's web interface. Place gets translated into coordinates using geonames.com * Bounding Box derived from users ip when posting on twitter's web interface. The less accurate source, a corner of the bounding box is selected randomly.
    - eli 16y ago
      is this feature 'enabled' by default on some mobile clients? Pretty sure it's disabled by default on the official android client, but I'm sure somewhere there's some client that has it always on.
  - thascales 16y ago
    Ah, you're quite right. Then maybe this will bring broader attention to their implications.
    - sasvari 16y ago
      which is a supremely optimistic assessment :-)
441069567 16y ago
welcome our store,we have the best service and good price,you can find what you want in our online store. <a href="http://www.monster-beatss.com/sennheiser-c-2.html>Sennheiser http://www.monster-beatss.com/sennheiser-c-2.html>Sennhe... </a> <a href="http://www.monster-beatss.com/bose-headpones-c-3.html>Bose http://www.monster-beatss.com/bose-headpones-c-3.html>Bo... Headpones</a> <a href="http://www.monster-beatss.com/lady-gaga-headphones-c-4.html>Lady http://www.monster-beatss.com/lady-gaga-headphones-c-4.html&... Gaga Headphones</a> <a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT Baridi Shoes</a><a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens-c-2_28.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens... Baridi Womens</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collection-c-1.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collectio... Midnight Deluxe Collection</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-set-c-2.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-... Midnight Collection Gift Set</a> <a href="http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets-c-20.html>GHD http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets... Nobler Diamonds Gift Sets</a> <a href="http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.html>GHD http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.... Pink Limited Edition</a> <a href="http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html>GHD http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html&... IV Styler Green</a>
- bawatski 16y ago
  spam?
  - Animus7 16y ago
    Either that or a hacker so twitchy they don't have time to check for ctrl-v's before hitting update to get back to their spambot side project.
  - ars 16y ago
    Yes, click the 'link' by the post, then flag it.
taitems 16y ago
Does anyone remember an application that uses the information gathered by tools like this to predict where a user will be at any given time? I'm not sure I understand the difference between that concept and what this does? If no-one has actually built it, then I'm really disappointed as it's quite simple - and I would be pretty easy to locate too. We're all creatures of habit.
scommab 16y ago
Neat this like a more general implementation of the latitude tracking program from XKCD: http://xkcd.com/596/ http://xkcd.com/596/
kmfrk 16y ago
Has anyone used this successfully? (Especially on Windows?) I keep getting errors.
RK 16y ago
Unrelated, but I've been noticing that sites like whitepages.com and LookupAnyone.com seem to be showing up higher in Google and many have people's home addresses displayed for free. I saw one that seemed to list almost all of the 12 or so addresses I've lived at in the last 15 years, plus a map with a pin at my current address, and a list of all of my immediate family members. This is all data (theoretically) gathered from publicly available records. If anyone wants to stop by, just call first. I'm sure my number is on those sites as well. :) Makes me feel like signing up for Facebook.

125 points by ssclafani 16y ago

cadab 16y ago

Been running it for about 15 minutes now and its still downloading the tweets/photos. Anyone else experiencing this sort of delay?

ilektrojohn 16y ago
Yeap, it gets like this for users with many (>5000) tweets, a big number of which contains some link to image hosting services or foursquare . I guess that the amount of retrieved locations will make up for the wait.
- kmfrk 16y ago
  I get the same for people with <1000 tweets, and it eventually terminates with some sort of error. It can't retrieve twitpic photos and returns a 502 for one. Running it on Windows 7. I wouldn't be surprised if the error is with Twitter.

Nanofied 16y ago

This is awesome. Kinda scary for you guys that use geolocation with everything though. I personally try to avoid it.

pyre 16y ago
Geo-tagging your photos is kinda cool, and it's a feature that I would find interesting if I had a device that supported it, but I would make _sure_ to strip those tags before publishing the photos anywhere.
- nuxi 16y ago
  Startup idea: Strip.py?
  - berntb 16y ago
    >>Strip.py Write in Erlang. Surprisingly, Strip.er and Stripp.er are free... Eritrea is an unusually disgusting dictatorship afaik, so they'll probably be happy to sell domain names (along with body parts of people with the wrong opinions). Lots of English words end in 'er', right? Another business idea -- offer to administer the top domain. Edit: http://en.wikipedia.org/wiki/.er http://en.wikipedia.org/wiki/.er
    - eli 16y ago
      I don't think they're for sale, actually.
  - kmfrk 16y ago
    Would make a good Mac App Store ... app. And, perhaps, web service. After all, privacy is the new green. On the other hand, you'll need to educate people about the dangers of meta-data, before you can attract them to use your product.

snitko 16y ago

Twitter icon in the app is awesome.

Animus7 16y ago

Neat. It's pretty much exactly what Color is trying to do, except it cost $41 million less to make.

matthewslotkin 16y ago
Speaking of Color, you can use Color it in combination with this locator and this: http://www.digitaltrends.com/mobile/color-hack-allows-users-to-spy-on-anyone-from-anywhere/ http://www.digitaltrends.com/mobile/color-hack-allows-users-... to massively multiply your creep factor.
- GrandMasterBirt 16y ago
  People love the new "everything is social" movement (twitter, FB, etc) and now color. The problem is that people don't realize what they are exposing and the conflict of interest is that these companies want EVERYTHING exposed so they can advertise/market. That's the problem. People just don't get it. Or rather people don't realize the value their personal data has.

thascales 16y ago

Well, I hope this doesn't surprise anyone. I'm running under the assumption that people who use Foursquare and other such geolocation services are fully aware that they can be used to find out where they've been. If that assumption is false, I think I'm going to become a hermit.

Animus7 16y ago
Well, it does other stuff like mine pictures for meta tags, the privacy implications of which wouldn't be obvious to a non-techie.
- heyitsnick 16y ago
  And I doubt most people realise; Twitters tweet location * Coordinates when tweet was posted from mobile device [side note: is this feature 'enabled' by default on some mobile clients?] * Place (geographical name) derived from users ip when posting on twitter's web interface. Place gets translated into coordinates using geonames.com * Bounding Box derived from users ip when posting on twitter's web interface. The less accurate source, a corner of the bounding box is selected randomly.
  - eli 16y ago
    is this feature 'enabled' by default on some mobile clients? Pretty sure it's disabled by default on the official android client, but I'm sure somewhere there's some client that has it always on.
- thascales 16y ago
  Ah, you're quite right. Then maybe this will bring broader attention to their implications.
  - sasvari 16y ago
    which is a supremely optimistic assessment :-)

441069567 16y ago

welcome our store,we have the best service and good price,you can find what you want in our online store. <a href="http://www.monster-beatss.com/sennheiser-c-2.html>Sennheiser http://www.monster-beatss.com/sennheiser-c-2.html>Sennhe... </a> <a href="http://www.monster-beatss.com/bose-headpones-c-3.html>Bose http://www.monster-beatss.com/bose-headpones-c-3.html>Bo... Headpones</a> <a href="http://www.monster-beatss.com/lady-gaga-headphones-c-4.html>Lady http://www.monster-beatss.com/lady-gaga-headphones-c-4.html&... Gaga Headphones</a> <a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-c-2.html>MBT Baridi Shoes</a><a href="http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens-c-2_28.html>MBT http://www.mbt-scarpe.net/mbt-baridi-shoes-mbt-baridi-womens... Baridi Womens</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collection-c-1.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-deluxe-collectio... Midnight Deluxe Collection</a> <a href="http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-set-c-2.html>GHD http://www.ghd-midnight-uk.com/ghd-midnight-collection-gift-... Midnight Collection Gift Set</a> <a href="http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets-c-20.html>GHD http://www.ghd-midnight-uk.com/ghd-nobler-diamonds-gift-sets... Nobler Diamonds Gift Sets</a> <a href="http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.html>GHD http://www.ghd-midnight-uk.com/ghd-pink-limited-edition-c-3.... Pink Limited Edition</a> <a href="http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html>GHD http://www.ghd-midnight-uk.com/ghd-iv-styler-green-c-5.html&... IV Styler Green</a>

bawatski 16y ago
spam?
- Animus7 16y ago
  Either that or a hacker so twitchy they don't have time to check for ctrl-v's before hitting update to get back to their spambot side project.
- ars 16y ago
  Yes, click the 'link' by the post, then flag it.

taitems 16y ago

Does anyone remember an application that uses the information gathered by tools like this to predict where a user will be at any given time? I'm not sure I understand the difference between that concept and what this does? If no-one has actually built it, then I'm really disappointed as it's quite simple - and I would be pretty easy to locate too. We're all creatures of habit.

scommab 16y ago

Neat this like a more general implementation of the latitude tracking program from XKCD: http://xkcd.com/596/ http://xkcd.com/596/

kmfrk 16y ago

Has anyone used this successfully? (Especially on Windows?) I keep getting errors.

RK 16y ago

Unrelated, but I've been noticing that sites like whitepages.com and LookupAnyone.com seem to be showing up higher in Google and many have people's home addresses displayed for free. I saw one that seemed to list almost all of the 12 or so addresses I've lived at in the last 15 years, plus a map with a pin at my current address, and a list of all of my immediate family members. This is all data (theoretically) gathered from publicly available records. If anyone wants to stop by, just call first. I'm sure my number is on those sites as well. :) Makes me feel like signing up for Facebook.