Chema Alonso, Enrique Rando Metadata: Information stored to give - - PowerPoint PPT Presentation

▶
chema alonso enrique rando metadata
SMART_READER_LITE
LIVE PREVIEW

Chema Alonso, Enrique Rando Metadata: Information stored to give - - PowerPoint PPT Presentation

Apr 19, 2023 380 likes •964 views

Chema Alonso, Enrique Rando Metadata: Information stored to give information about the document. For example: Creator, Organization, etc.. Hidden information: Information internally stored by programs and not editable. For

slide-1
SLIDE 1

Chema Alonso, Enrique Rando

slide-2
SLIDE 2
slide-3
SLIDE 3

 Metadata:

  • Information stored to give information about the

document.

▪ For example: Creator, Organization, etc..

 Hidden information:

  • Information internally stored by programs and not

editable.

▪ For example: Template paths, Printers, db structure, etc…

 Lost data:

  • Information which is in documents due to human mistakes
  • r negligence, because it was not intended to be there.

▪ For example: Links to internal servers, data hidden by format, etc…

slide-4
SLIDE 4

Wrong management Bad format conversion Unsecure options New apps

  • r program

versions Embedded files Search engines Spiders Databases Embedded files

Wrong management Bad format conversion Unsecure options

slide-5
SLIDE 5

 The answer is NOT.  Almost nobody is cleaning documents.  Companies publish thousand of documents

without cleaning them before:

  • Metadata.
  • Hidden Info.
  • Lost data.
slide-6
SLIDE 6

Total: 4841 files

slide-7
SLIDE 7
slide-8
SLIDE 8

Real Name Username Internal Domain .. And more…

slide-9
SLIDE 9

Total: 896 files

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12

Total: 1075 files

slide-13
SLIDE 13

User Software Version Internal Server NetBIOS name Remote Printer Name Local Printer

slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18

 Office documents:

  • Open Office documents.
  • MS Office documents.
  • PDF Documents.

▪ XMP.

  • EPS Documents.
  • Graphic documents.

▪ EXIFF. ▪ XMP.

  • And almost everything….
slide-19
SLIDE 19

EXIFREADER http://www.takenet.or.jp/~ryuuji/

slide-20
SLIDE 20
slide-21
SLIDE 21

http://video.techrepublic.com.com/2422‐14075_11‐207247.html

slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

 Users:

  • Creators.
  • Modifiers .
  • Users in paths.

▪ C:\Documents and settings\jfoo\myfile ▪ /home/johnnyf

 History of use.  Operating systems.  Software versions.  Paths.

  • Local and remote.

 Network info.

  • Shared Printers.
  • Shared Folders.
  • ACLS.
slide-26
SLIDE 26

 Printers.

  • Local and remote.

 Internal Servers.

  • NetBIOS Name.
  • Domain Name.
  • IP Address.

 Database structures.

  • Table names.
  • Colum names.

 Devices info.

  • Mobiles.
  • Photo cameras.

 Private Info.

  • Personal data.
slide-27
SLIDE 27

 Info is in the file in raw format:

  • Binary.
  • ASCII .

 Therefore Hex or ASCII editors can be used:

  • HexEdit.
  • Notepad++.
  • Bintext

 Special tools can be used:

  • Exif redaer
  • ExifTool
  • Libextractor.
  • Metagoofil.
  • …

 …or just open the file!

slide-28
SLIDE 28
slide-29
SLIDE 29

 http://www.edge‐security.com/metagoofil.php

slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38

 These tools only extract metadata.  Not looking for Hidden Info.  Not looking for lost data.  Not post‐analysis.

slide-39
SLIDE 39

 Fingerprinting Organizations with Collected

Archives.

  • Search for documents
  • Automatic file downloading
  • Capable of extracting Metadata, hidden info and

lost data.

  • Cluster information
  • Analyzes the info to fingerprint the network.
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42

http://www.informatica64.com/FOCA

slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45
slide-46
SLIDE 46

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=144e54ed‐ d43e‐42ca‐bc7b‐5446d34e5360

slide-47
SLIDE 47
slide-48
SLIDE 48

 OOMetaExtractor

http://www.codeplex.org/oometaextractor

slide-49
SLIDE 49
slide-50
SLIDE 50

http://www.metashieldprotector.com

slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55
slide-56
SLIDE 56

 Authors

  • Chema Alonso

▪ chema@informatica64.com

  • Enrique Rando

▪ Enrique.rando@juntadeandalucia.es

  • Alejandro Martín

▪ amartin@informatica64.com

  • Francisco Oca

▪ froca@informatica64.com

  • Antonio Guzmán

▪ antonio.guzman@urjc.es

slide-57
SLIDE 57