Geolocation Challenge #2: The power of image editing

For today’s blog post we will solve the @quiztime challenge set by @julia bayers on 05/01/2021 in twitter. The challenge is as follows:

Where was this photo taken?
What happened here recently?


Answering the “where” question:
On a previous blog post, we talked about finding unique elements inside a photo, in order to help us geolocate the place it has been taken. Looking at this picture we can see an interior of something that looks like a castle (museum?), a unique plaque with a black hat sculpture on it and many arches shaped outside of the windows. The stairs on the left and the light bulbs hanging from the ceiling are not considered unique elements that could help us identify the place as they could be found in many places in the world. So let’s take these elements one by one:

Castle (museum?) with many arches outside:


When I tried multiple combinations with some or all of the words “castle” “museum” “arches” “exterior” and other relevant for google queries, I got like a thousand irrelevant results. After much frustration, I went on to focus my investigation specifically to the plaque seen in the picture.

The plaque:
The plaque was the most unique element in the picture. If something could give a positive result, that would be it. After searching the full photo on Google and Yandex reverse image search engines, I found the following results:

Google image search results



Yandex image search results

For some reason, Google thought I was searching for daylighting as a key word (wtf?) and Yandex thought I was looking for light bulbs hanging from the ceiling. Although both results were crap, it does show us why we always need to check multiple engines for the same image. Each search engine has different algorithms and produces different results to the same queries and that of course can prove very valuable to an investigation.
Since Yandex has allowed the awesome feature of image cropping while on image search (previously found only on bing image search), we focus our search to include only the plaque with the hat, since its what we intended to search from the start anyway. The results are not as enlightening as we thought they would be:


Yandex second image results


Google stubbornly refuses to add a “crop image” function to its image search engine (shame on you Google!), so we zoom in and crop the photo to receive this image as a result:


Google image search brings up the following results:

Google second image search results

Google this time thinks that “language” is the keyword now (wtf x2). We assume the new cropped image might help Yandex, so we reverse image search again.


Yandex third image search results


Yandex brings up again irrelevant images. I want to note that while actually solving the quiz, Yandex brought up icons with shields, which is more relevant results, but while writing this post it didn’t. This means that sometimes the same search engine can produce different results.

Now what?

I failed in almost everything and just when I was about to give up on this, an idea struck me. The photo is leaning a little bit and has an angle. Maybe if I could somehow rotate it in order to make it vertical (as a tourist might have taken it?), it would help the search engines.
In order to rotate the picture fast, I used powerpoint (yes I assume there were better ways but anyway who cares). Navigating in the menu on the top of the window, I used Insert --> Picture. Using the rotate function as seen below, I rotated the picture.


Now it looks more like how someone would really have photographed it. Using the snipping tool on windows (hit the window button and search snipping on search bar), I cropped the photo in a rectangle as shown in the photo above (red rectangle). This way I will let the search engines ignore that guy with the mask and the freaking light bulbs showing all over the place(!). The result was good, but I didn’t like the darkness of the photo. So I inserted it again on powerpoint (what? I like this program!). Clicking the format tab and changing the brightness and clarity of the photo the result was very much different from the first pictures we were trying to (reverse) search.



Google searching this image now brings additional results. The first one below the “similar images” is this:



Clicking the result now takes us to a facebook page identifying the place as “Gürzenich Köln”, which seems to be a Conference Center in Cologne (Julia come on not cologne challenges again).

Answering the “what happened here recently” question:
On its Facebook page, the Gürzenich Köln conference center posted the “Jungen Union NRW” as the latest conference taking place (October 2020). In the photos uploaded, we see multiple people sitting, keeping distances and wearing masks due to corona virus pandemic.

Conclusion
Reverse image search can be really useful when no other technique seems to work. But it’s a hit or miss so you need to always have alternatives in mind. If reverse image searching doesn’t show any good results, think if you can alter the image in a way which could “help” the search engines without altering the core elements of the picture.

Thanks for reading. Until next time, stay healthy!

Do you have a question/comment regarding this methodology? Please e-mail me at theinspector32@protonmail.com,or send me a message on twitter.

Comments

Popular posts from this blog

Skype – A hidden OSINT goldmine

Geolocation & Chronolocation challenge #1: A trip to Cologne

Using OSINT to find missing persons – A Trace Labs Search Party OSINT CTF writeup