#reverse RC verification

[z5061241]

Something Awesome Week 5

tldr: Yo. I. Found. Some. Shiz.  ----------------------------------

I found some interesting stuff last week but I want to try and take this to another level this week using some more advanced osint strategies (Dorking and other tools).  Before that, a few ideas since last week:

What do parents do when you get an award? Get proud and send people photos (at least this is what Asian parents do to flex on other Asian parents). Andrew has won a lot of awards, maybe I can find photos of him online receiving said awards? or perhaps a relatives facebook or something.

Sometimes when I represented the school in something, my name would be published in the school newsletter and I remember being able to find that newsletter online. Should try and search something like “Andrew Carmichael Barker Newsletter”

Facebook

I realized I haven’t actually found Andrew’s facebook...I should start with that.  I used the search feature in facebook itself and found it pretty easily, only because Andrew actually has a profile photo on this, there isn’t one in his LinkedIn profile. (Facebook Profile Link - here).  A few things I gained from this: 

Photo: I could potentially use his photo to reverse image search on google and see if any other photos of him turn up. 

Alias/Username: The facebook profile link is https://www.facebook.com/andrew.carmichael.395. Note the ‘andrew.carmicheal.395’, this looks typical of a username that could be used elsewhere. I checked the LinkedIn one, ‘andrew-rc-carmichael’. Now I’m not too sure if one (or both) of these are auto-generated from the social media sites themselves but if they are not and they were made by Andrew, then it suggests that he isn’t the type of person who uses only one username everywhere for convenience. 

Scotland?: Now I know this is weird, but I have friends who have gone to Scotland and I’ve seen enough Skyfall to know what the Scottish highlands look like. The texture of the mountains, and green shades and the fact that he is wearing a huge weather-proof looking jacket seems to confirm that this photo was in fact taken in Scotland and that he was definitely on exchange. Facebook, unfortunately, doesn’t show any dates and removes EXIF data so there’s no way of 100% confirming but I am about 80% certain.  

I tried reverse image searching on just his face: 

Funny....but it didn’t help, unfortunately.  Google Dorking  I decided to try out some of the ideas I had thought of since last week. In order to search through newsletters online without actually going through all the newsletters myself, it seemed like google could do this using a specialised search query: `allintext: “Andrew Carmichael” “Barker”`. From this, I managed to find a photo of Andrew in 2015 at a school awards ceremony?  https://www.facebook.com/barkercollege/photos/nicholas-bennett-hayden-brooks-andrew-carmichael-isabelle-trayner-kate-fischer-r/10153001684152000/ I tried reverse image searching on this one too! 

Accurate....but also...mug shots?? I tried some other searches like “allintext: andrew carmichael unsw“ and that led me to find a dean’s honour list archive which had his full name: Andrew Robert Coulthard Carmichael. I was able to confirm that this is definitely him because I ended up searching “Andrew Carmichael distinguished achievers list 2014“. Surely with his high ATAR, he would’ve been placed on some list and I was correct. (Link) There is an Andrew Robert Carmichael from Barker college in 2014 who was recognized for two subjects.  Honestly, this felt huge! Seeing how private he is online and now having his full name meant that I had a better chance of figuring out his personal email.  osintframework.com & bellingcat & LinkedIn (again!) From osintframework.com I was able to find a tool called an Email Permutator (Link). Basically, you provide it a person’s first name, last name, domain (gmail in this case - he mentioned he has one), and optional fields for middle names and nicknames and it generates a list of possible common email permutations. I got 46 possible combinations :O. After doing some digging around, I managed to find out about the LinkedIn Sales Navigator. This tool is basically a URL that looks up LinkedIn user’s via their email (typically used by salespeople for lead generation). For example the following: https://www.linkedin.com/sales/gmail/profile/viewByEmail/a.carmichael395@gmail. It doesn’t work but if it did, it would bring up his profile. On osintframework.com & bellingcat they have listed some email verification tools but most of them only seem to work in the US. 

Note: This is where my findings took a weird turn, more info in my private blog... Unfortunately because of what I found (in private blog) and the time I took to verify the knowledge, I ran out of time this week to progress through the investigation. This is a little worrying because I only have 2-3 weeks left and I don’t even have a personal email or a phone number...and that’s meant to be basic stuff. I still haven’t used Maltego yet, mainly because I need to watch a few more tutorials, but hopefully, that will be really useful and I’ll be able to find more interesting information with it next week!  Why is having this data important?

Travel history: From the facebook and linkedIn data, I was able to gather that Andrew has been to Scotland on exchange. Not only does this give us an idea of where he has been, or places he would like to visit next, but it allows an attacker to exploit this for an attack. For example, let’s assume Andrew loved his time in Scotland (most of my friends who went on exchange share this sentiment so I think its a reasonable assumption) and he can’t wait to get to go back and visit again. An attacker could formulate a phishing email disguised as a “Qantas: Cheap Tickets To Scotland” email or something with a clickbaity title like “You won’t believe what this Sydney student found in the Scottish highlands”. 

Usernames: Using the potential usernames I found, I can look them up on other social media sites to try and find matches.

Photo: Having photos of targets is always valuable! Especially when you can’t access their facebook photos.

Full Name: Having someone’s full name allows you to try and come up with potential emails and usernames (like I’ve been trying to do). It also could help with further narrowing searches on public records, but here in Australia, we don’t have that sort of capability. 

[breazyvapors]

iStick Pico Dual 200W Box Mod - Eleaf

Vendor: Eleaf Type: Hardware Price: 23.49 iStick Pico Dual 200W Box Mod - Eleaf     Thinking about getting yourself a new box mod because the one that you are currently using is getting a little boring. Trust us, we hear you. However, it seems like Eleaf is hearing even louder because they are introducing us to a piece of hardware that is going to be impressive and enjoyable to use. The iStick Pico Dual 200W Box Mod is the name of the mod that people are going crazy over. This mod is going to come in a compact size so that you will not be worried when it comes to taking it along with you. Just place it in your pocket or mod and you will be good to go. It is going to require dual high-amp 18650 batteries that are going to be long-lasting and definitely worth getting once you pop them into your mod. There is going to be a wattage output range of 1W to 200W, a temperature control range of 200˚F to 600˚F, and a minimum atomizer resistance of 0.05ohm. The intuitive OLED screen will offer you this information and more when working with the mod. Just simply push on the single firing button and take a big pull. Your vape juices might even be smoother and tastier than you are used to.        Product Features:   * Dimensions: 75mm x 46mm x 44mm * Required Batteries: Dual High-Amp 18650 Batteries (Sold Separately) * Wattage Output Range: 1W - 200W * Minimum Atomizer Resistance: 0.05ohm * Temperature Control Range: 200˚F - 600˚F * Supports Ni200, Titanium, and 316 Stainless Steel  * Ergonomic Rounded Contour * Recessed Tank Section And fits up to 25mm * Optional Power Bank Capability  * Preheat Functionality * OLED Screen * Changeable Interface * Oversized Firing Design * Hinged Flip Battery Cover * Cell Balancing Trickle Charge Technology * Innovative Buck-Boost Technology * Dual Circuit Protection * Reverse Polarity Protection * Stainless Steel 510 Connection   Package Includes:   * 1 x iStick Pico Dual Mod By Eleaf * 1 x QC USB Cord * 1 x RC Adapter     ***All specifications and descriptions are based on information provided by the manufacturer. Information provided is not representative of testing and or verification by Breazy.com and should be used at consumers discretion.    Disclaimer: Use At Your Own Risk! Advanced products are for experienced users with extensive knowledge of how electronic devices work along with access to the appropriate safety tools. Please ensure proper precautions are taken when using these devices. There is an inherent risk with the use of any and all rechargeable batteries in any circumstance. Use special caution when working with Li-ion (Lithium-ion), LiPo (Lithium-ion Polymer) and any rechargeable cells, as they are very sensitive to charging characteristics and may explode or burn if mishandled. Never leave charging batteries unattended. Breazy Inc will not be held responsible or liable for any injury, damage, or defect, permanent or temporary that may be caused by the improper use of a Li-ion (Lithium-ion), LiPo (Lithium-ion Polymer) and any rechargeable battery/batteries. https://breazy.com/products/istick-pico-dual-200w-mod-eleaf?utm_source=dlvr.it&utm_medium=tumblr