This article is more than 1 year old
Need a facial recognition auto-doxxx tool? Social Mapper has you covered
Use this to match profiles to names of people at an organization. Nothing could possibly go wrong here
Finding people's social media profiles can be a slow and manual business – so why not get facial recognition to help?
That's the pitch coming from Trustwave's SpiderLabs, which wants to make life easier for penetration testers trying to infiltrate clients' networks and facilities using social engineering and targeted hackery.
SpiderLabs' Jacob Wilkin explained that new tool Social Mapper can start with the name of an organisation on LinkedIn, a folder full of named images, or a CSV listing of names with URLs to images. With those inputs, he explained this week, the software's facial recognition capabilities can “correlate social media profiles across a number of different sites on a large scale.”
In other words: even though your LinkedIn, Twitter, Facebook, Google+ (because we've all got one of those), Instagram, Russian VK, and Chinese Weibo profiles are all under different names and handles, Social Mapper can link all those profiles to you by matching a photo of your face to the selfies you used on each of the account pages.
And then repeat that over and over for an organization. So you could throw a bunch of named photos of a team from their website at Social Mapper, and it'll do its best to find their individual social networking profiles for you to message and hoodwink.
It handles the trawl-index-report process in three stages: first, Social Mapper parses the input. The second stage is where the facial recognition kicks in, we're told:
It does this by instrumenting the Firefox browser, logging into the afore mentioned supported social media sites and begins searching for targets by name. It pulls out the top results from this search (usually between 10 and 20) and starts downloading the profile pictures and performing facial recognition checks to try and find a match.
This is a slow process: Wilkin said a search of 1,000 targets could run for 15 hours and suck up an unspecified “large amount” of bandwidth.
Social Mapper searching for its author, Jacob Wilkin ... Click to embiggen
The final stage is to generate a report, giving the user a starting point to target individuals on social media for phishing, link-sharing, and password-snooping attacks. The company's post also suggests an attacker could peep at photographs to “familiarize yourself with building interiors” – useful for physical penetration testing.
The GitHub repo for Social Mapper is here, and because it's written in Python, it should run on any OS, so long as you've installed Firefox, the Selenium API, and the Geckodriver browser proxy. ®
Biting the hand that feeds IT
