SlideShare uma empresa Scribd logo

(121027) #fitalk big brother forensics, device tracking using browser-based artifacts

•
•
INSIGHT FORENSIC
INSIGHT FORENSIC

2012 F-INSIGHT TALK

Tecnologia
1 de 35
Baixar para ler offline
FORENSIC INSIGHT SEMINAR Big Brother Forensics : Device Tracking Using Browser-Based Artifacts proneer proneer@gmail.com http://forensic-proof.com Kim Jinkook
forensicinsight.org Page 2 / 35 Big Brother Forensics  영국 소설가인 조지 오웰(George Orwell, 1903∼1950)의 소설 “1984년”의 등장인물  정보를 독점하여 사회를 감시하는 독재체제  빅브라더 사회로 가고 있나? 아니면…  빅브라더 포렌식은? 빅브라더
forensicinsight.org Page 3 / 35 Big Brother Forensics  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 1)  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 2)  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3) SANS 포스팅
forensicinsight.org Page 4 / 35 Big Brother Forensics 빅브라더 : Geolocation 여기에 스마트폰을 더하면?
forensicinsight.org Page 5 / 35 Big Brother Forensics  구글 레티튜드 : 구글의 Geolocation 서비스 Geolocation(1) : Google latitude
forensicinsight.org Page 6 / 35 Big Brother Forensics  구글 레티튜드 : 구글의 Geolocation 서비스 Geolocation(1) : Google latitude
forensicinsight.org Page 7 / 35 Big Brother Forensics  스마트폰에서 : GPS 기반 Geolocation(1) : Google latitude
forensicinsight.org Page 8 / 35 Big Brother Forensics  데스크탑에서(Chrome) : IP 기반 Geolocation(1) : Google latitude
forensicinsight.org Page 9 / 35 Big Brother Forensics  데스크탑에서(IE) : IP 기반 Geolocation(1) : Google latitude
forensicinsight.org Page 10 / 35 Big Brother Forensics  위치찾기 뱃지 Geolocation(1) : Google latitude
forensicinsight.org Page 11 / 35 Big Brother Forensics  Geolocation API 지원  활용 데이터 : WIFI 위치, 3G 기지국 삼각 측량, GPS 데이터, IP 주소 기반 Geolocation(2) : HTML5 http://caniuse.com/
forensicinsight.org Page 12 / 35 Big Brother Forensics  Geolocation API 지원 Geolocation(2) : HTML5 http://forensicmethods.com/wp-content/uploads/2012/04/Location_Sharing.jpg Default
forensicinsight.org Page 13 / 35 Big Brother Forensics  Geolocation API 샘플 (http://www.w3schools.com/html/html5_geolocation.asp) Geolocation(2) : HTML5 <!DOCTYPE html> <html> <body> <p id="demo">Click the button to get your coordinates:</p> <button onclick="getLocation()">Try It</button> <script> var x=document.getElementById("demo"); function getLocation() { if (navigator.geolocation) { navigator.geolocation.getCurrentPosition(showPosition); } else{ x.innerHTML="Geolocation is not supported by this browser."; } } function showPosition(position) { x.innerHTML="Latitude: " + position.coords.latitude + "<br>Longitude: " + position.coords.longitude; } </script> </body> </html>
forensicinsight.org Page 14 / 35 Big Brother Forensics  Latitude: 37.566535, Longitude: 126.977969 Geolocation(2) : HTML5
forensicinsight.org Page 15 / 35 Big Brother Forensics  Auto tracking using HTML5: http://www.mileage-charts.com/search/calc.php  자동으로 현재 위치를 구글맵에 표시  인터넷 사용흔적 확인 Geolocation(3) : Google Map
forensicinsight.org Page 16 / 35 Big Brother Forensics  구글맵 연동 사이트 방문  히스토리  구글맵 연동 사이트 방문  캐시 Geolocation(3) : Google Map
forensicinsight.org Page 17 / 35 Big Brother Forensics  검색 : dongdaemun Geolocation(3) : Google Map
forensicinsight.org Page 18 / 35 Big Brother Forensics  검색 : dongdaemun  히스토리 Geolocation(3) : Google Map
forensicinsight.org Page 19 / 35 Big Brother Forensics  검색 : dongdaemun  캐시 Geolocation(3) : Google Map
forensicinsight.org Page 20 / 35 Big Brother Forensics  검색 : dongdaemun  Latitude: 37.570945, Longitude: 127.009688 Geolocation(3) : Google Map
forensicinsight.org Page 21 / 35 Big Brother Forensics  구글맵 파라미터 Geolocation(3) : Google Map http://forensicmethods.com/wp-content/uploads/2012/04/Google_Maps_Queries.jpg
forensicinsight.org Page 22 / 35 Big Brother Forensics  사진 위치 정보 확인(Map) Geolocation(4) : Flickr
forensicinsight.org Page 23 / 35 Big Brother Forensics  사진 위치 정보 확인  히스토리  사진 위치 정보 확인  캐시 Geolocation(4) : Flickr
forensicinsight.org Page 24 / 35 Big Brother Forensics  위치 근처 사진 검색(NearBy) Geolocation(4) : Flickr
forensicinsight.org Page 25 / 35 Big Brother Forensics  위치 근처 사진 검색  히스토리  위치 근처 사진 검색  캐시 Geolocation(4) : Flickr
forensicinsight.org Page 26 / 35 Big Brother Forensics  트위터 위치 설정 Geolocation(5) : Twitter
forensicinsight.org Page 27 / 35 Big Brother Forensics  트위터 위치 설정  트윗  히스토리  트위터 위치 설정  트윗  쿠키 Geolocation(5) : Twitter geo_locations %7B%22 recent_ids %22%3A%5B%22c00e5392b3fa46fb%22%5D%2C%22 overrides%22%3A%5B%7B%22 id%22%3A%22c00e5392b3fa46fb%22%2C%22 ip%22%3A%22118.176.147.153%22%7D%5D%7D twitter.com/account/ 1537 1364675840 30992835 2991402449 30258077 *
forensicinsight.org Page 28 / 35 Big Brother Forensics  페북 담벼락 위치 추가 Geolocation(6) : Facebook
forensicinsight.org Page 29 / 35 Big Brother Forensics  페북 담벼락 위치 추가  히스토리 Geolocation(6) : Facebook
forensicinsight.org Page 30 / 35 Big Brother Forensics  네이버맵 접속 위치  위치 아티팩트 X Geolocation(7) : Naver Map
forensicinsight.org Page 31 / 35 Big Brother Forensics  요청 & 응답 Geolocation(7) : Naver Map GET http://map.naver.com/common2/getRegionByPosition.nhn?xPos=126.967363&yPos=37.5397998 HTTP/1.1 {"result": {"region": {"rcode":"09170112", "doCode":"0900000000", "doName":"서울특별시", "siCode":"0917000000", "siName":"용산구", "dongCode": "09170112", "dongName":"원효로1가", "level":null, "xPos":"126.9673625“, "yPos":"37.5398", "ltX":"126.9639845", "ltY":"37.5376216", "rbX":"126.971025", "rbY":"37.5421463“ }, "weather":{ "weatherCode":"21","weatherText":"구름많음,"temperature":"15.0", "iconURL":"http://static.naver.net/weather/images/w_icon/w_s21.gif", "detailURL":"http://weather.naver.com/rgn/townWetr.nhn?naverRgnCd=09170112"}}}
forensicinsight.org Page 32 / 35 Big Brother Forensics  다음맵 접속 위치  위치 아티팩트 X Geolocation(8) : Daum Map
forensicinsight.org Page 33 / 35 Big Brother Forensics  요청 & 응답 Geolocation(8) : Daum Map GET http://map.daum.net/iptargeting/point HTTP/1.1 var t_mapx="498812.0"; var t_mapy="1116945.0"; var t_address="서울특별시 용산구 서빙고동";
forensicinsight.org Page 34 / 35 Big Brother Forensics  Smart Device Based Artifacts Then,
forensicinsight.org Page 35 / 35 질문 및 답변

Recomendados

A pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexingA pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
Eric Sieverts
 
DV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
DV 2016: Don't Track Me, Bro - Security and Privacy as a DifferentiatorDV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
DV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
Tealium
 
Web browser privacy and security
Web browser privacy and security Web browser privacy and security
Web browser privacy and security
amiable_indian
 
Browser security — ROOTS
Browser security — ROOTSBrowser security — ROOTS
Browser security — ROOTS
Andre N. Klingsheim
 
Browser Security
Browser SecurityBrowser Security
Browser Security
Roberto Suggi Liverani
 
(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)
INSIGHT FORENSIC
 

Recomendados

A pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexingA pair of shoes in the thesaurus; some reflexions on human and computer indexing
A pair of shoes in the thesaurus; some reflexions on human and computer indexing
Eric Sieverts
 
DV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
DV 2016: Don't Track Me, Bro - Security and Privacy as a DifferentiatorDV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
DV 2016: Don't Track Me, Bro - Security and Privacy as a Differentiator
Tealium
 
Web browser privacy and security
Web browser privacy and security Web browser privacy and security
Web browser privacy and security
amiable_indian
 
Browser security — ROOTS
Browser security — ROOTSBrowser security — ROOTS
Browser security — ROOTS
Andre N. Klingsheim
 
Browser Security
Browser SecurityBrowser Security
Browser Security
Roberto Suggi Liverani
 
(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics(160820) #fitalk fileless malware forensics
(160820) #fitalk fileless malware forensics
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)(150124) #fitalk advanced $usn jrnl forensics (korean)
(150124) #fitalk advanced $usn jrnl forensics (korean)
INSIGHT FORENSIC
 
(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)(150124) #fitalk advanced $usn jrnl forensics (english)
(150124) #fitalk advanced $usn jrnl forensics (english)
INSIGHT FORENSIC
 
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
INSIGHT FORENSIC
 
(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend
INSIGHT FORENSIC
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
INSIGHT FORENSIC
 
(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts
INSIGHT FORENSIC
 
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
INSIGHT FORENSIC
 
(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch
INSIGHT FORENSIC
 
(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석
INSIGHT FORENSIC
 
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
INSIGHT FORENSIC
 
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
INSIGHT FORENSIC
 
(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis
INSIGHT FORENSIC
 
(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls
INSIGHT FORENSIC
 
(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)
INSIGHT FORENSIC
 
(130202) #fitalk china threat
(130202) #fitalk china threat(130202) #fitalk china threat
(130202) #fitalk china threat
INSIGHT FORENSIC
 
(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics
INSIGHT FORENSIC
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
INSIGHT FORENSIC
 
(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery
INSIGHT FORENSIC
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)
INSIGHT FORENSIC
 
(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea
INSIGHT FORENSIC
 
(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory
INSIGHT FORENSIC
 
(131102) #fitalk get windows logon password in memory dump
(131102) #fitalk get windows logon password in memory dump(131102) #fitalk get windows logon password in memory dump
(131102) #fitalk get windows logon password in memory dump
INSIGHT FORENSIC
 

Mais conteúdo relacionado

Mais de INSIGHT FORENSIC

(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
INSIGHT FORENSIC
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
INSIGHT FORENSIC
 
(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory
INSIGHT FORENSIC
 

Mais de INSIGHT FORENSIC (20)

(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs(140118) #fitalk detection of anti-forensics artifacts using ioa fs
(140118) #fitalk detection of anti-forensics artifacts using ioa fs
 
(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend(140118) #fitalk 2013 e-discovery trend
(140118) #fitalk 2013 e-discovery trend
 
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
(141031) #fitalk plaso 슈퍼 타임라인 분석 도구 활용 방안
 
(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts(141031) #fitalk os x yosemite artifacts
(141031) #fitalk os x yosemite artifacts
 
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식(140716) #fitalk 전자금융사고에서의 디지털 포렌식
(140716) #fitalk 전자금융사고에서의 디지털 포렌식
 
(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch(140716) #fitalk digital evidence from android-based smartwatch
(140716) #fitalk digital evidence from android-based smartwatch
 
(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석(140625) #fitalk sq lite 소개와 구조 분석
(140625) #fitalk sq lite 소개와 구조 분석
 
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석(140407) #fitalk d trace를 이용한 악성코드 동적 분석
(140407) #fitalk d trace를 이용한 악성코드 동적 분석
 
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법(140625) #fitalk sq lite 삭제된 레코드 복구 기법
(140625) #fitalk sq lite 삭제된 레코드 복구 기법
 
(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis(130216) #fitalk reverse connection tool analysis
(130216) #fitalk reverse connection tool analysis
 
(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls(130216) #fitalk potentially malicious ur ls
(130216) #fitalk potentially malicious ur ls
 
(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)(130202) #fitalk trends in d forensics (jan, 2013)
(130202) #fitalk trends in d forensics (jan, 2013)
 
(130202) #fitalk china threat
(130202) #fitalk china threat(130202) #fitalk china threat
(130202) #fitalk china threat
 
(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics(130119) #fitalk sql server forensics
(130119) #fitalk sql server forensics
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
 
(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery(130119) #fitalk all about physical data recovery
(130119) #fitalk all about physical data recovery
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)
 
(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea(130105) #fitalk criminal civil judicial procedure in korea
(130105) #fitalk criminal civil judicial procedure in korea
 
(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory(131116) #fitalk extracting user typing history on bash in mac os x memory
(131116) #fitalk extracting user typing history on bash in mac os x memory
 
(131102) #fitalk get windows logon password in memory dump
(131102) #fitalk get windows logon password in memory dump(131102) #fitalk get windows logon password in memory dump
(131102) #fitalk get windows logon password in memory dump
 

(121027) #fitalk big brother forensics, device tracking using browser-based artifacts

  • 1. FORENSIC INSIGHT SEMINAR Big Brother Forensics : Device Tracking Using Browser-Based Artifacts proneer proneer@gmail.com http://forensic-proof.com Kim Jinkook
  • 2. forensicinsight.org Page 2 / 35 Big Brother Forensics  영국 소설가인 조지 오웰(George Orwell, 1903∼1950)의 소설 “1984년”의 등장인물  정보를 독점하여 사회를 감시하는 독재체제  빅브라더 사회로 가고 있나? 아니면…  빅브라더 포렌식은? 빅브라더
  • 3. forensicinsight.org Page 3 / 35 Big Brother Forensics  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 1)  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 2)  Big Brother Forensics: Device Tracking Using Browser-Based Artifacts (Part 3) SANS 포스팅
  • 4. forensicinsight.org Page 4 / 35 Big Brother Forensics 빅브라더 : Geolocation 여기에 스마트폰을 더하면?
  • 5. forensicinsight.org Page 5 / 35 Big Brother Forensics  구글 레티튜드 : 구글의 Geolocation 서비스 Geolocation(1) : Google latitude
  • 6. forensicinsight.org Page 6 / 35 Big Brother Forensics  구글 레티튜드 : 구글의 Geolocation 서비스 Geolocation(1) : Google latitude
  • 7. forensicinsight.org Page 7 / 35 Big Brother Forensics  스마트폰에서 : GPS 기반 Geolocation(1) : Google latitude
  • 8. forensicinsight.org Page 8 / 35 Big Brother Forensics  데스크탑에서(Chrome) : IP 기반 Geolocation(1) : Google latitude
  • 9. forensicinsight.org Page 9 / 35 Big Brother Forensics  데스크탑에서(IE) : IP 기반 Geolocation(1) : Google latitude
  • 10. forensicinsight.org Page 10 / 35 Big Brother Forensics  위치찾기 뱃지 Geolocation(1) : Google latitude
  • 11. forensicinsight.org Page 11 / 35 Big Brother Forensics  Geolocation API 지원  활용 데이터 : WIFI 위치, 3G 기지국 삼각 측량, GPS 데이터, IP 주소 기반 Geolocation(2) : HTML5 http://caniuse.com/
  • 12. forensicinsight.org Page 12 / 35 Big Brother Forensics  Geolocation API 지원 Geolocation(2) : HTML5 http://forensicmethods.com/wp-content/uploads/2012/04/Location_Sharing.jpg Default
  • 13. forensicinsight.org Page 13 / 35 Big Brother Forensics  Geolocation API 샘플 (http://www.w3schools.com/html/html5_geolocation.asp) Geolocation(2) : HTML5 <!DOCTYPE html> <html> <body> <p id="demo">Click the button to get your coordinates:</p> <button onclick="getLocation()">Try It</button> <script> var x=document.getElementById("demo"); function getLocation() { if (navigator.geolocation) { navigator.geolocation.getCurrentPosition(showPosition); } else{ x.innerHTML="Geolocation is not supported by this browser."; } } function showPosition(position) { x.innerHTML="Latitude: " + position.coords.latitude + "<br>Longitude: " + position.coords.longitude; } </script> </body> </html>
  • 14. forensicinsight.org Page 14 / 35 Big Brother Forensics  Latitude: 37.566535, Longitude: 126.977969 Geolocation(2) : HTML5
  • 15. forensicinsight.org Page 15 / 35 Big Brother Forensics  Auto tracking using HTML5: http://www.mileage-charts.com/search/calc.php  자동으로 현재 위치를 구글맵에 표시  인터넷 사용흔적 확인 Geolocation(3) : Google Map
  • 16. forensicinsight.org Page 16 / 35 Big Brother Forensics  구글맵 연동 사이트 방문  히스토리  구글맵 연동 사이트 방문  캐시 Geolocation(3) : Google Map
  • 17. forensicinsight.org Page 17 / 35 Big Brother Forensics  검색 : dongdaemun Geolocation(3) : Google Map
  • 18. forensicinsight.org Page 18 / 35 Big Brother Forensics  검색 : dongdaemun  히스토리 Geolocation(3) : Google Map
  • 19. forensicinsight.org Page 19 / 35 Big Brother Forensics  검색 : dongdaemun  캐시 Geolocation(3) : Google Map
  • 20. forensicinsight.org Page 20 / 35 Big Brother Forensics  검색 : dongdaemun  Latitude: 37.570945, Longitude: 127.009688 Geolocation(3) : Google Map
  • 21. forensicinsight.org Page 21 / 35 Big Brother Forensics  구글맵 파라미터 Geolocation(3) : Google Map http://forensicmethods.com/wp-content/uploads/2012/04/Google_Maps_Queries.jpg
  • 22. forensicinsight.org Page 22 / 35 Big Brother Forensics  사진 위치 정보 확인(Map) Geolocation(4) : Flickr
  • 23. forensicinsight.org Page 23 / 35 Big Brother Forensics  사진 위치 정보 확인  히스토리  사진 위치 정보 확인  캐시 Geolocation(4) : Flickr
  • 24. forensicinsight.org Page 24 / 35 Big Brother Forensics  위치 근처 사진 검색(NearBy) Geolocation(4) : Flickr
  • 25. forensicinsight.org Page 25 / 35 Big Brother Forensics  위치 근처 사진 검색  히스토리  위치 근처 사진 검색  캐시 Geolocation(4) : Flickr
  • 26. forensicinsight.org Page 26 / 35 Big Brother Forensics  트위터 위치 설정 Geolocation(5) : Twitter
  • 27. forensicinsight.org Page 27 / 35 Big Brother Forensics  트위터 위치 설정  트윗  히스토리  트위터 위치 설정  트윗  쿠키 Geolocation(5) : Twitter geo_locations %7B%22 recent_ids %22%3A%5B%22c00e5392b3fa46fb%22%5D%2C%22 overrides%22%3A%5B%7B%22 id%22%3A%22c00e5392b3fa46fb%22%2C%22 ip%22%3A%22118.176.147.153%22%7D%5D%7D twitter.com/account/ 1537 1364675840 30992835 2991402449 30258077 *
  • 28. forensicinsight.org Page 28 / 35 Big Brother Forensics  페북 담벼락 위치 추가 Geolocation(6) : Facebook
  • 29. forensicinsight.org Page 29 / 35 Big Brother Forensics  페북 담벼락 위치 추가  히스토리 Geolocation(6) : Facebook
  • 30. forensicinsight.org Page 30 / 35 Big Brother Forensics  네이버맵 접속 위치  위치 아티팩트 X Geolocation(7) : Naver Map
  • 31. forensicinsight.org Page 31 / 35 Big Brother Forensics  요청 & 응답 Geolocation(7) : Naver Map GET http://map.naver.com/common2/getRegionByPosition.nhn?xPos=126.967363&yPos=37.5397998 HTTP/1.1 {"result": {"region": {"rcode":"09170112", "doCode":"0900000000", "doName":"서울특별시", "siCode":"0917000000", "siName":"용산구", "dongCode": "09170112", "dongName":"원효로1가", "level":null, "xPos":"126.9673625“, "yPos":"37.5398", "ltX":"126.9639845", "ltY":"37.5376216", "rbX":"126.971025", "rbY":"37.5421463“ }, "weather":{ "weatherCode":"21","weatherText":"구름많음,"temperature":"15.0", "iconURL":"http://static.naver.net/weather/images/w_icon/w_s21.gif", "detailURL":"http://weather.naver.com/rgn/townWetr.nhn?naverRgnCd=09170112"}}}
  • 32. forensicinsight.org Page 32 / 35 Big Brother Forensics  다음맵 접속 위치  위치 아티팩트 X Geolocation(8) : Daum Map
  • 33. forensicinsight.org Page 33 / 35 Big Brother Forensics  요청 & 응답 Geolocation(8) : Daum Map GET http://map.daum.net/iptargeting/point HTTP/1.1 var t_mapx="498812.0"; var t_mapy="1116945.0"; var t_address="서울특별시 용산구 서빙고동";
  • 34. forensicinsight.org Page 34 / 35 Big Brother Forensics  Smart Device Based Artifacts Then,
  • 35. forensicinsight.org Page 35 / 35 질문 및 답변