OSINT 0x1: “Less Is More”

Disclaimer: this write-up is for educational purposes only. Use your skills for good.

In this write-up, I’m going to highlight some flaws I tend to do during my research, and how I could have avoided going down the rabbit hole. Let’s get our investigative skills on.

Sigh. Why y’all gotta do me like that though?

Here’s what we know:

1. Farnsworth Avenue
2. An overpass
3. A red building
4. Public Park sign (blue, yellow, gray)
5. Traffic signs showing the maximum height, instructions, and a parking sign (yellow, white, green)
6. Traffic lights in the distance, with a green sign

Let’s start with the giveaway: Farnsworth Avenue.
Google Maps, you’re up.

We know that’s far too broad a search perimeter still, but at least we now know we can start looking around Aurora, IL.

I’ll start with where I went wrong, then lead up to how I could have cracked the mystery with possibly the quickest search query ever. Reason being that I want you to learn from my mistakes.

The only thing that stands out about the picture is the “Public Park”. I’m sure you must be thinking by now, “That’s not gonna work; do you know just how many there are? And how the search may come up with parks instead of parking lots?”, and you’re absolutely correct.

Let’s try “parking” on the active map area.

Thanks, Google.

How about “parking garage”?

I’m not feeling it.

Looks like we’re gonna have to pull off some Hollywood “Blow it up. Enhance.” move, because that works, right?

*Googles: “image zoom”*
Yep. that definitely worked. Thanks, Hollywood.

Probably don’t try this at home; you’re wasting your time, unless you’re hell-bent on going through sharpening, smoothening, sharpening again, and a whole bunch of AI image enhancing algo rabbit hole you really don’t wanna get into.

Goddammit. If I could just read that freaking sign…

Time for a paradigm shift: let’s start searching for anything that might lead us to the following keywords, bridge|overpass.

*Googles: “bridges in Aurora, IL”*
“bridges near Farnsworth Avenue”
“overpass in Aurora”

I came across this potentially valuable mapping system; Chicago City’s GIS.

Overkill? Most likely.

We could go on and on trying to find terrain info, use different map providers that contain legends for bridges and the like, but it feels like it’s going to take ages.

Useless. Maybe we can try looking up shopping malls around the area? That was another clue.
We’ll quickly realize that we still can’t work out where she actually was even if we got the correct shopping mall.

I’m absolutely lost, and it’s almost been an hour already. Let’s start over, but this time we’ll keep it as simple as possible. It will feel stupid at first, but trust me, you’ll be surprised. *Googles: “aurora chicago red building”*

That’s an old-looking interesting building. The bridge in the photo kinda looked a bit old. Let’s bring that picture back up for reference.
The building on the left kinda has a similar style, but it’s not exactly the same. Let’s see what relevant images show.
HELLO!

PUBLIC PARK! Let’s check out that link!

Nothing specific in the comments, description, or tags. The main image from which got those relevant images was that of the the Paramount Theatre. *Googles: “aurora chicago paramount”*

First result: “Paramount Theatre - Aurora, IL.” Let’s get back to Google Maps, but this time, we dive right into street view with “Paramount Theatre”.

What’s that I’m seeing in the far distance—an overpass?

Let’s drive up to there.

HOLY SHIT!

Red building? Check. Overpass? Check. Yellow lanes? Check. Blue, gray, and yellow Public Park sign? Not check. Why’s that? Check the Image capture at the bottom-right corner of street view: “Image capture: Jul 2019”. Since everything else checks out, we can safely assume that we arrived at the correct spot. Also, that very distinguishable X-looking thing on the overpass? Yeah, we can’t miss that.

Street View (left) — OSINT challenge picture (right)

I hope you learned something new, and remember: “Less is *sometimes* more”. I could have gone there much sooner in my research, but there’s always a lesson.

If you enjoyed this write-up, check out D Nemec’s (Twitter @djnemec) solution, which was posted only 3 hours after commandergirl’s (Twitter @illyrian598) tweet.

As for the remaining task of finding out which mall, I’m gonna post another part for that; life happens. ¯\_(ツ)_/¯

Thanks for stopping by,
@X0RW3LL

Here to secure your sh*%, hopefully. Wire: @x0rw3ll