"Doxing" users on Social Media

Question

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get.

Suppose the following

• A user is posting libel and slander on social media (lets say Twitter for example). The posts may be misleading, propaganda or just downright lying
• A user has suspicions and they believe they know who the user may or may not be in real life
• The user is not as computer savvy, and most likely not security minded like a professional might be. They are using their home computer or telephone to post the content and are not connecting through proxy's or VPN's

How would you go about trying to prove the persons identity - assuming that the social media website will be of no assistance. There's no real plan of legal recourse...just want to prove that a person that we suspect is posting these things, is actually posting these things. Methods must be legal.

I assume that social engineering will be involved in some capacity - in fact, I would imagine this would almost all be done with social engineering. What I was thinking was trying to entice the user to click on a link pointing to a site owned by me, and linking the logged IP address to that of one sent from an e-mail (or something to that effect). How would you attempt to prove the identity of the poster?

Answer 1

If the user is not security minded then probably the easiest non-instrusive way will surely be to carry out old fashioned detective work. Using websites such as Pipl and google on the username used. From there you can see if the user has used that username in other websites and start to build up a profile based on the information you can gather.

If that username is no good, another way could be crawl through their previous tweets and see if they make any reference to a specific place more than once.

Another way is to see if they have posted any photos and see if they have GPS meta-data still embedded and see if that correlates to the suspected location of your user. As the FBI recently did on an unsuspecting Anonymous member.

Answer 2

To stay legal, I would suggest documenting everything you can and get a court order.

Any type of social engineering or active attacks could be dismissed in court if not done properly in your state.

Also to sue someone for libel or slander you must suffer a loss in some manner that can be quantified. (Ex. supervisor documents that you did something that you didn't and you are suspended without pay from work for a day) This would be a day of lost wages for the damages.

If they are saying that you are short and you are tall you may view this as defamation of character but unless you have lots of cash to throw at them to make them miserable it's not worth it. Besides, karma will come around at some point in time, just be patient.

Answer 3

If you can get the user into viewing a message you send to them you may be able to have them automatically downloading resources (e.g. picture) from a server you monitor. If you send them a link to e.g. myserver.com/1px.jpg their application may automatically download the picture from your server thus revealing their IP address in your server logs. The picture may for instance be a 1x1 pixel sized image.

Please note that this type of technique can be controversial to use. You should consult with your lawyer before attempting this type of technique.

Social-engineering may be used to try to exploit the users fear or trust. Hopefully you can try make the user come forward in a legal way by crafting good messages. Never under estimate the power of social engineering. Remember that this technique is very often used in real-life scenarios where the perpetrator is actively tried being swayed by a professional social-engineer from law-enforcement.

Once IP address have been exposed you can have law-enforcement contact the ISP in order to retrieve the user behind the IP's real name and address.