R/E/P Community

R/E/P => R/E/P Archives => R/E/P Saloon => Topic started by: ktownson on December 30, 2010, 02:09:41 PM

Title: Geotagging: Something to be careful with
Post by: ktownson on December 30, 2010, 02:09:41 PM
I've been doing a security presentation at work about phones with GPS and camera capabilities providing means to stalk the unsuspecting user. A lot of people here were totally unaware their phone is providing this info, so I thought I would pass it along.

In a nutshell, iPhones, Androids and Blackberries among others record the GPS coordinates of the phone (called "geotags) when the picture is snapped. This info is saved in the metadata of the photo.

If you upload the photo to many webservices, including facebook, twitter, Flickr, etc., the metadata goes with it, so, by extracting the metadata and putting the coordinates into a map service, you can get an exact location of where the picture was taken.

Some people and websites see this as a feature. Unfortunately, it can also be a stalker's favorite tool. Imagine a cute picture of your 9-year-old daughter in the living room, excitedly holding a Justin Bieber calendar. Her name is on a certificate on the wall behind her. You post it on Flickr. "Mary's just crazy about Justin."  

Creep drives to Fairhope, AL. "Hey, little Mary, want to see a cool picture of Justin Bieber?" The metadata tells the unscrupulous when you shot the picture, how to get directions to the house, and, to boot, he can see a flat panel TV and computer in the background, just in case burglary and not child abduction is his thing.

Yeah, it's a bit paranoid, but just another bit of personal data you should know about so you can manage it. Features like this are usually defaulted to on, and only a few web services prompt you to not include metadata.

Here's some links:  

http://redtape.msnbc.com/2010/12/ten-things-web-users-should -fear-in-2011.html

http://icanstalku.com

http://www.nytimes.com/2010/08/12/technology/personaltech/12 basics.html?_r=4

Our company issues iPhones to certain personnel. So far all but one were defaulted on for the coordinates to be included in the metadata.
Title: Re: Geotagging: Something to be careful with
Post by: RMoore on December 30, 2010, 02:53:34 PM
Incredible,

Its just a matter of time before enterprising criminals utilize this info - probably most likely for theft, as they already do with google earth
Title: Re: Geotagging: Something to be careful with
Post by: YZ on December 31, 2010, 12:11:01 AM
ktownson wrote on Thu, 30 December 2010 17:09

by extracting the metadata and putting the coordinates into a map service, you can get an exact location of where the picture was taken.


No need to to all that manually...  at least one freeware image viewer can do it for you in a couple of clicks. (IrfanView)

Nice gal I was chatting with the other day sent me a pic taken with her iPhone, indoors; you should have seen her reaction when a minute later I asked her about some places near her home - and she hadn't even mentioned before in which country she lived, let alone the address...

This is frightening.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on December 31, 2010, 12:20:39 AM
the iPhone even told us what direction he was facing when he took the picture. Call me old school, but this is TMI.

Title: Re: Geotagging: Something to be careful with
Post by: YZ on December 31, 2010, 03:42:55 AM
TMI for sure...  imagine you took a few pics of some gear you want to sell and posted them "anonymously" to a "safe" e-business site.

Anyone can locate the gear and try to have a go at it.
Title: Re: Geotagging: Something to be careful with
Post by: Tidewater on December 31, 2010, 02:18:31 PM
I just uploaded a picture of Jimmy Hoffa's body laying in my open doorway, with mounds of $100 bills I have been saving as a backdrop. My lock doesn't work, but I have 4 alien greys watching the money. They are also in the picture..... with Jesus, Waldo, and a supermodel wearing a shirt that says, "Finders, Keepers".

Maybe I should delete it?  Shocked
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on December 31, 2010, 05:45:34 PM
You found Waldo?
Title: Re: Geotagging: Something to be careful with
Post by: danickstr on December 31, 2010, 09:29:21 PM
Finding Waldo was easy, he posted an iphone picture of himself in front of his Beiber poster in his house.  He was facing east by the way.
Title: Re: Geotagging: Something to be careful with
Post by: Tidewater on January 03, 2011, 01:30:24 PM
I didn't find Waldo! He is supposed to be in the picture though.
Title: Re: Geotagging: Something to be careful with
Post by: Electric Warrior on January 04, 2011, 10:42:34 AM
http://img89.imageshack.us/img89/3495/waldoz.jpg
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 04, 2011, 12:10:21 PM
index.php/fa/16108/0/
Title: Re: Geotagging: Something to be careful with
Post by: Fibes on January 04, 2011, 01:44:47 PM
I have IrFan View with all the plug ins and can't figure out how to extract gps locations from my geotagged photos.

I guess i'm just not savvy enough.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 04, 2011, 02:12:23 PM
If you have photoshop go to File>File Info...

Click on Advanced in the left column, then EXIF.  If the coordinates are recorded, they will show up as
 
exif:GPSLatitude xx,xx.xN
exif:GPSLongitude xx,xx.xxW

index.php/fa/16109/0/
Title: Re: Geotagging: Something to be careful with
Post by: Electric Warrior on January 04, 2011, 02:39:17 PM
ktownson wrote on Tue, 04 January 2011 18:10

index.php/fa/16108/0/


Are they in a back yard in London, Pembroke Road?
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 04, 2011, 02:52:13 PM
Well, they are supposed to be at 4 Chelsea Manor Studios, 1-11 Flood Street, Chelsea, London.  Michael Cooper's photog studio at the time.

Can't say I've mastered Google Maps, though.
Title: Re: Geotagging: Something to be careful with
Post by: Electric Warrior on January 04, 2011, 03:03:12 PM
me neither. how did you get it to display the coordinates?
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 04, 2011, 03:53:56 PM
Right click on the map--slide down to What's Here and click, and the coordinates pop up in the Google Maps search field
Title: Re: Geotagging: Something to be careful with
Post by: Electric Warrior on January 04, 2011, 04:17:40 PM
doesn't work for me. might be different in the german version  Confused

I finally found my mistake. Longitude was a negative value and I used a positive one. d'oh!  Embarassed
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 04, 2011, 05:30:39 PM
index.php/fa/16110/0/
Title: Re: Geotagging: Something to be careful with
Post by: YZ on January 04, 2011, 06:39:28 PM
Fibes wrote on Tue, 04 January 2011 16:44

I have IrFan View with all the plug ins and can't figure out how to extract gps locations from my geotagged photos.

I guess i'm just not savvy enough.


PM sent with instructions and example.
Title: Re: Geotagging: Something to be careful with
Post by: Electric Warrior on January 05, 2011, 10:49:59 AM
ktownson wrote on Tue, 04 January 2011 21:53

Right click on the map--slide down to What's Here and click, and the coordinates pop up in the Google Maps search field


ah, found it. you have to click onto to marker. thanks a lot! might come in handy one day..
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 05, 2011, 02:41:35 PM
Actually, I can click anywhere on the map and get the coordinates. I am using a Windows machine with a two-button mouse.
Title: Re: Geotagging: Something to be careful with
Post by: Tidewater on January 05, 2011, 09:29:29 PM
R  

O


F


L
Title: Re: Geotagging: Something to be careful with
Post by: Fenris Wulf on January 08, 2011, 01:33:20 AM
Tidewater wrote on Thu, 06 January 2011 02:29

R  

O


F


L

I'm not laughing. Nothing is more infuriating than software that does things you DIDN'T ASK IT TO DO, especially when it violates your privacy in the process.

We need a new holiday. "Punch a Programmer in the Face Day." Just on general principles.
Title: Re: Geotagging: Something to be careful with
Post by: MagnetoSound on January 08, 2011, 07:01:04 AM

You think this is down to the programmers, really?


Come on, think about it. This is covert tracking. Who would do that?


I'm glad I'm not paranoid.  Wink


Title: Re: Geotagging: Something to be careful with
Post by: Jon Hodgson on January 08, 2011, 09:22:52 AM
MagnetoSound wrote on Sat, 08 January 2011 12:01


You think this is down to the programmers, really?


Come on, think about it. This is covert tracking. Who would do that?


I'm glad I'm not paranoid.  Wink





It's not covert, since it's not hidden, it's just the result of various things interacting into something that people either didn't think about, or thought was somebody else's responsibility (the photo owners)

!) Camera Manufacturer - Geotagging is a useful feature for photos for a lot of people, GPS is now ubiquitous and cheap, cool we'll add it as a feature to our camera to sell more.

2) Photo Website - We let people upload their photos so they can show them to other people, we just do a simple upload and download of everything including metadata because that's the easiest thing to do, if the user wants to change or remove metadata, that's their job before uploading

3) Google maps - we provide a facility where people can put in coordinates and get a place on the map

All three perfectly reasonable and innocent things, which unfortunately can add up to a bad combination if you add in a nefarious human being, as pointed out in the original post.

The solution is simple enough, make a fuss and get the photo websites (and photo software) to make the information visible (to the uploader) and filterable. It's not a particularly difficult task for them, so a bit of public pressure should probably do it.
Title: Re: Geotagging: Something to be careful with
Post by: MagnetoSound on January 09, 2011, 07:13:00 AM

Jon, it's probably just my suspicious mind, but the fact that this is set to default to 'ON', and that you have to dig around to even know about it, puts my teeth on edge.

Isn't carrying one of these around, without even thinking about the fact that GPS is active, just a small step away from personal tagging?

I was brought up to question things like this, particularly when there is not much mention made of it at the time of introduction.


I'm sure it is all perfectly benign, for now at least.


Title: Re: Geotagging: Something to be careful with
Post by: Jon Hodgson on January 09, 2011, 07:42:24 AM
MagnetoSound wrote on Sun, 09 January 2011 12:13


Jon, it's probably just my suspicious mind, but the fact that this is set to default to 'ON', and that you have to dig around to even know about it, puts my teeth on edge.


And if the manufacturer's defaulted it to "off", then they'd get a flood of complaints about how someone bought their camera because it had geotagging but they'd taken a whole holiday's worth of snaps without tags because it wasn't switched on.

If you've ever had to develop, sell or support products you'll know that as a group, users are really stupid. Individually they might be Nobel prize winning scientists, but put enough of them together and they will make every stupid mistake under the sun, and every mistake will cost you a disproportionate amount of time (and money), so you try to choose the route where the thickest laziest person will have the least hassle possible.

It is your suspicious mind, at least in this case, nobody's going round to the manufacturers and twisting their arms to set the default to on, the manufacturer just has two options and they'll go with the one which makes the most customers happy. When they introduced the feature, that was definitely setting it to "ON", if enough people now get upset and the public and customer relations guys decide it's a better bet, it'll be set to "OFF", end of story.

Not every negative thing that happens is the result of some nefarious master plan.

I'm not dismissing the issue, the OPs point is valid and important, but although it may be more fun to rant about it and blame people it is probably more productive to recognize the issue for what it is, and the solution, and do something about it.

Geotagging on photos is here to stay I would say, but all it needs to keep it under control is for the people developing photo handing software and websites to make it visible and filterable, it's not hard, you just have to convince them that they'll lose enough customers by not having it that it's worth the time to implement it.

Bring it to their attention and some programmers might even do it on their own time because they feel it's the right thing to do, amazing as it may seem, most of them are actually quite nice people.
Quote:

I was brought up to question things like this, particularly when there is not much mention made of it at the time of introduction.

Absolutely, you should question it, but then when the answer is simple and obvious, why go trying to twist it into something more sinister?
If you look on the website listing for the camera, you'll probably see GPS or GeoTagging mentioned, if you look on the box when you buy it, you definitely will (it's there to sell more cameras). They're not trying to hide anything.
What you don't see is a warning that says "Warning, if you photograph something nice and then post the picture on the web without removing the geotag metadata then some nasty person may download the photo, find out where it was taken, and come round and nick the nice thing"... but then if you posted every such warning on every product where some combination of actions could lead to negative results, you wouldn't even have room for the logo on the box, and nobody would read them anyway.
Title: Re: Geotagging: Something to be careful with
Post by: Jon Hodgson on January 09, 2011, 08:01:07 AM
MagnetoSound wrote on Sun, 09 January 2011 12:13


Isn't carrying one of these around, without even thinking about the fact that GPS is active, just a small step away from personal tagging?



Your phone is a far more effective way of tracking you. You can't be tracked through your camera because it doesn't transmit anything(GPS is a receive only system, it has to be combined with recording or transmission of the position data to track you), they can only track where pictures were taken if they have the pictures.
Title: Re: Geotagging: Something to be careful with
Post by: MagnetoSound on January 09, 2011, 08:34:26 AM
Jon Hodgson wrote on Sun, 09 January 2011 13:01

Your phone is a far more effective way of tracking you.



Yes, I thought we were talking about phones.


ktownson wrote on Thu, 30 December 2010 19:09

I've been doing a security presentation at work about phones with GPS and camera capabilities providing means to stalk the unsuspecting user. A lot of people here were totally unaware their phone is providing this info, so I thought I would pass it along.

In a nutshell, iPhones, Androids and Blackberries among others record the GPS coordinates of the phone (called "geotags) when the picture is snapped. This info is saved in the metadata of the photo.




I realise however that I don't know the full story and I certainly didn't mean to be criticising programmers for simply doing their job. I understand that sales must be driven and that end users can be difficult beasts to communicate with.  Smile


Title: Re: Geotagging: Something to be careful with
Post by: Jon Hodgson on January 09, 2011, 08:56:13 AM
MagnetoSound wrote on Sun, 09 January 2011 13:34

Jon Hodgson wrote on Sun, 09 January 2011 13:01

Your phone is a far more effective way of tracking you.



Yes, I thought we were talking about phones.




In the context of the OPs post, the phone part is irrelevant, because we're talking about the metadata added to the photo file, which many cameras do as well as camera phones, and this info isn't transmitted unless you upload the picture. If the geotagging is extended to transmitting your current position and tracking everywhere you go (without at least a court order being in existence to switch it on and security measures to limit who gets access to the info), then that would be a different matter.

However I think most people are aware that they can be tracked to some degree through their phones, even without GPS.

Incidentally, Apple proudly proclaim the geotagging feature in their info, HTC list it in the specs, like I said, nobody's hiding it, it's not really their fault if the users don't read the info or think about the consequences.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 09, 2011, 09:32:35 PM
I don't think it's evil--I just want people to know what their phones are reporting.

Title: Re: Geotagging: Something to be careful with
Post by: Hallams on January 10, 2011, 06:24:10 AM
Jon Hodgson wrote on Sun, 09 January 2011 01:22

MagnetoSound wrote on Sat, 08 January 2011 12:01


You think this is down to the programmers, really?


Come on, think about it. This is covert tracking. Who would do that?


I'm glad I'm not paranoid.  Wink





It's not covert, since it's not hidden, it's just the result of various things interacting into something that people either didn't think about, or thought was somebody else's responsibility (the photo owners)

!) Camera Manufacturer - Geotagging is a useful feature for photos for a lot of people, GPS is now ubiquitous and cheap, cool we'll add it as a feature to our camera to sell more.

2) Photo Website - We let people upload their photos so they can show them to other people, we just do a simple upload and download of everything including metadata because that's the easiest thing to do, if the user wants to change or remove metadata, that's their job before uploading

3) Google maps - we provide a facility where people can put in coordinates and get a place on the map

All three perfectly reasonable and innocent things, which unfortunately can add up to a bad combination if you add in a nefarious human being, as pointed out in the original post.

The solution is simple enough, make a fuss and get the photo websites (and photo software) to make the information visible (to the uploader) and filterable. It's not a particularly difficult task for them, so a bit of public pressure should probably do it.


The reality is.....some time in the foreseeable future,  a currently democratic nation could well be ruled by a totalitarian Government.( ie a network of large corporations hijacks the democratic process and takes control of government)

The technology to facilitate state control of citizens movement is entrenched in our communications and road transport systems. Politically left or right, the only thing that will prevent this from happening is the safeguarding of the checks and balances built into a democratic system, and we have seen them being significantly eroded over the past few decades.
Title: Re: Geotagging: Something to be careful with
Post by: Jon Hodgson on January 10, 2011, 06:51:54 AM
Hallams wrote on Mon, 10 January 2011 11:24

Jon Hodgson wrote on Sun, 09 January 2011 01:22

MagnetoSound wrote on Sat, 08 January 2011 12:01


You think this is down to the programmers, really?


Come on, think about it. This is covert tracking. Who would do that?


I'm glad I'm not paranoid.  Wink





It's not covert, since it's not hidden, it's just the result of various things interacting into something that people either didn't think about, or thought was somebody else's responsibility (the photo owners)

!) Camera Manufacturer - Geotagging is a useful feature for photos for a lot of people, GPS is now ubiquitous and cheap, cool we'll add it as a feature to our camera to sell more.

2) Photo Website - We let people upload their photos so they can show them to other people, we just do a simple upload and download of everything including metadata because that's the easiest thing to do, if the user wants to change or remove metadata, that's their job before uploading

3) Google maps - we provide a facility where people can put in coordinates and get a place on the map

All three perfectly reasonable and innocent things, which unfortunately can add up to a bad combination if you add in a nefarious human being, as pointed out in the original post.

The solution is simple enough, make a fuss and get the photo websites (and photo software) to make the information visible (to the uploader) and filterable. It's not a particularly difficult task for them, so a bit of public pressure should probably do it.


The reality is.....some time in the foreseeable future,  a currently democratic nation could well be ruled by a totalitarian Government.( ie a network of large corporations hijacks the democratic process and takes control of government)

The technology to facilitate state control of citizens movement is entrenched in our communications and road transport systems. Politically left or right, the only thing that will prevent this from happening is the safeguarding of the checks and balances built into a democratic system, and we have seen them being significantly eroded over the past few decades.


The countries with the most totalitarian state control today are in many cases those with more backward technology and economy, so I think the idea that having a geotagging feature in your phone is what is going to lead to a totalitarian state is a red herring.

I agree with you on the safeguarding of checks and balances (which is why I said earlier that any auto tracking feature on a phone should require a court order to switch on). However this thread has been about tag metadata on photos that the user takes  and choses to upload and the user has complete control over, but is unfortunately often ignorant about.

Yes it's a good idea to let people know about it... thank you KTownson... and it's also a good idea to push photo website and software developers to add features to reduce the chances of users inadvertantly giving away their location, but let's not paint it into something it isn't. It's not a violation of privacy, nor is it some government/corporate scheme to track the movements of individuals.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 10, 2011, 10:28:55 AM
It's also sometimes inadvertent on the part of programmers.

Real Life Example: Someone posts an item for sale on Craigslist. They don't include personal contact information with the ad, having the expectation that they can control the situation and can decide if they want to meet in a safe place with a potential buyer.

They snap a picture of the item with an iPhone and upload it with the ad. The geotags are embedded by default because they are a normal part of the photo being uploaded, not by any malicious intent on the part of the web developer. Now, anyone moderately savvy viewer can locate the position of the item, and show up on your doorstep. Or wait until you're gone and steal it.

It's a shame that criminals can use seemingly innocent and useful tools against us. It used to be common practice for parents to sew a nametag on the outside of children's backpacks. It made it easy for the students to find their own backpacks and it made it easy on the teachers. It also made it easy for pedophiles with binoculars to learn your child's name and approach him/her using their name.

Be informed, keep alert, think long and hard about what information you put on the web.
Title: Re: Geotagging: Something to be careful with
Post by: Tidewater on January 10, 2011, 05:20:38 PM
I just found a new dating strategy. I need to sew my name on my backpack.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 10, 2011, 10:41:56 PM
If  you're looking to date pedophiles, your local sheriff has a whole website full of them.
Title: Re: Geotagging: Something to be careful with
Post by: Paul Cavins on January 10, 2011, 11:26:49 PM
So, if you were to check out someone on a chat room that supposedly featured sheriffs and other police officers, would you really be talking with a pedophile?



Title: Re: Geotagging: Something to be careful with
Post by: Tidewater on January 11, 2011, 08:31:00 AM
Too old for a pedophile.. unless they are like 100.. creepy.
Title: Re: Geotagging: Something to be careful with
Post by: ktownson on January 11, 2011, 09:43:48 AM
Man, this topic just took a screaming left and slammed into a telephone pole...
Title: Re: Geotagging: Something to be careful with
Post by: johnR on January 16, 2011, 06:12:33 PM
Jon Hodgson wrote on Mon, 10 January 2011 11:51


The countries with the most totalitarian state control today are in many cases those with more backward technology and economy, so I think the idea that having a geotagging feature in your phone is what is going to lead to a totalitarian state is a red herring.


I think the point was not that it would lead to a totalitarian state, but that it would provide a ready made surveillance system for such a state if one arose in future. Technologically advanced totalitarian states have existed in the past. Can anyone guarantee that it will never happen again?