OSINT Exercise #028

Here's my walkthrough of how I went about solving this OSINT challenge.

To answer most of the challenge questions, I decided that I would first need to geolocate the photo.

As I spend a lot of time in the Netherlands, just by quickly looking at the photo, my first guess was that it was taken somewhere in the Netherlands. A quick reverse image search confirmed that: it came back with hundreds of similar-looking houses listed for sale on Dutch realty websites:

 

However, none of these listings were an obvious exact match, and carefully studying each listing to confirm if it is a match would have been too time consuming, so I decided to first pursue other leads first.

I then tried focusing on the most obvious identifying feature in the photo - the tall yellow building in the background. First, I cropped the original photo to only include the yellow building and put it in reverse image search.

Once again, it returned no exact matches. Just in case the yellow building is somewhat famous, I also tried googling “yellow building Netherlands,” “geel gebouw” and “lelijk geel gebouw,” but as expected these returned no matches either. 

At this point, I decided to listen to the hint in the challenge description, which says: “Sometimes the fastest way to geolocate an image is to track down the movements of the person behind the lens. I took the photo below, on 20 September 2023, at 08:11 local time.” First, I searched for “20 September 2023 OSINT,” “20 September 2023 OSINT conference” and “20 September 2023 Netherlands events” but once again nothing relevant turned up. 

In case this was a work-related trip, I looked up Sofia Santos on LinkedIn and scrolled back on her posts all the way until September. This is when I came across this post:

According to the post (in particular, the letter of appreciation pictured), on 20 September 2023, Sofia participated in the "SIRIUS CTF Finale: The role of women in OSINT investigation" at Europol headquarters in The Hague. Google Maps shows two Europol buildings in The Hague. Google Street View of  one of them clearly shows the yellow building from the background of the original photo (the tall building on the left in the photo below).

Walking around the area on Street View, led me to 55 Eisenhowerlaan (52.091933961543205, 4.280068654804999):

Now that I knew where exactly the photo was taken, I could answer the challenge questions. 

a) What device I used to take the photograph.

To determine this, I downloaded the original photo on my computer and used Preview to check the image’s metadata. To do this, I clicked Tools -> Show Inspector -> TIFF, which led me to this data: 

 

A quick Google search reveals that a Samsung phone with the above specifications is most likely a Samsung Galaxy A12.

b) Where I was headed.

Europol (see above for more details).

c) How far I was from the entrance of my destination.

According to Google Maps, as the photo was taken at Eisenhowerlaan 55 and the destination was Europol, the photo was taken 80m from the entrance to the destination.

Bonus challenge: In which hotel did I stay?

The LinkedIn post from the Europol event in The Hague includes an Easter egg, it mentions that this photo was taken from the balcony of the hotel in question.

Once again, a reverse image search of the cropped out background returned nothing relevant. 

My next step was to check the big chain hotels within walking distance from the Europol headquarters. They were Novotel and Mariott. The Google Maps Street View as well as satellite view are not that useful when trying to figure out the view from somewhere, so for this purpose I used the 3D view feature on Google Earth. In the case of both of these hotels, the Google Earth 3D view was nowhere even close to the one pictured above. 

At this point I was purely guessing, but based on the rather modern architecture style of the buildings in the background, my guess was that the hotel was not located in the city centre where buildings are generally lower and more historical. As the cityscape in the photo rapidly drops off, I thought that the hotel was maybe located somewhere close to the beach and facing it. I decided to start off with Google Earth 3D view in the Scheveningen area - the best known beach in The Hague, located not too far from the Europol building. If this proved to be fruitless, I would have moved on to other areas around the city, such as the area around the central station, where I knew some similar style buildings, including hotels, are located.

To be honest, it was mainly due to luck (and partly persistence), but eventually, while exploring the area, I came across this building, which has the distinctive roof features seen in the original photo.

I then started looking for hotels a few rows back and came across this row of buildings, much taller than their surroundings:

Among them, two are hotels. The balcony style of Ibis Style Den Haag Scheveningen looked most similar to the one in the photo so I decided to check out that one first.

Although the background of the photo is quite blurry and it’s hard to tell for sure, the view looks similar to the view from Ibis Styles by Scheveningen beach. 

Update: I watched the solution video and now know there was a much simpler method to solving the bonus question. I can't help but feel a bit silly for not checking the LinkedIn post comments first. But, lesson learned: work smarter, not harder.