Case Description
This is Martina Gretzmann, born 21.6.1984, married to Alan Gretzmann, they have three children.
Martina wants to be elected to the National Council for the first time in the next elections for the “pioneering party” and has just announced her candidacy. She is an exemplary IT user who rarely or never publishes private details and keeps both her work machine and private IT-equipment clean and up-to-date.
Task 1
You’re the attacker. Your party, the “National Conservative Nay-Sayers”, wants to make Martina Gretzmann’s candidacy more difficult or at least weaken her electoral chances. They hired you as a well-known IT expert to find “usable data” about the Gretzmann family. You won’t find anything at all on Google (probably also because this is a fictitious case). The only information you have is a family photo of the Gretzmanns in their garden, provided to the press by Martina – you have the original as it was sent out in the press release announcing her candidacy.
Analyze the image with all the tools of an OSINT investigator at your disposal and try to find out the Gretzmanns’ home address.
Since you really can’t find anything incriminating about Martina, you concentrate on the rest of the family.
The Gretzmanns’ eldest daughter could be a worthwhile target – try to find out if she has an account on any social media platform (Facebook, Twitter, Instagram…). You don’t necessarily find her using the search function – you might have to try a few usernames. Take all the information you’ve found so far…
If you have found her social media account, try to find out if she posted anything there that endangered her family’s reputation. Assume that her mother probably does the same thing from time to time and intervenes when necessary…
While you’re at it – can you identify a possible attack vector?