The “-s” command line switch is particularly helpful for forensic analysts, since it lets us download and preserve tweets for later analysis. Tweets Analyzer gives a couple of useful options. Either way, recent activity does look automated. Maybe it was operated by a human for some time, and then the activity was scripted from some point to the present. Since everything is not exactly the same, there’s a chance that there’s also a human using this account. The name of the account is actually listed in the “Detected Sources” section (we’ve redacted it here), which definitely points to automated posting activity. There is more activity, but the activity is more uniform. Note the differences in the activity distribution graph: Or, if we were looking for additional sources of digital evidence, we’d have good reason to suspect the user has at least an iPhone and iPad, and likely an Android device and desktop computer, too.īelow is more output from Tweets Analyzer. Then, we could tweet a CyberSecurity “related” story URL to them, or send it via their Direct Messages, and attempt to compromise their device or phish them. If we wanted to simulate an attack on this individual, we may want to do research into the Twitter app and look for vulnerabilities. Individual primarily uses an iPhone to make tweets This is a personal account (A mixture of different hashtags, tweets on the weekends and off hours) This individual is focused on CyberSecurity (#malware, #wannacry, #dfir, #infosec) This has already given us a ton of useful data. The chart shows a definite dip in activity in the early morning hours in the eastern coast of the United States, where the operator lives. If possible, Tweets Analyzer will pull down the time zone of the user in question. We pointed the tool at a cybersecurity account, which we know is operated by a human. The output of Tweets Analyzer is clean and straight-forward. Details about how it may be used is present here: What’s really posting as that handle?
It’s currently licensed under the GNU GPL 3.0. The tool is written in Python, making it easy enough to customize or add onto. It requires that you create both a Twitter API key and an Access token, but both of these are free to create. As you might expect, it lets you enter someone’s Twitter handle, and it pulls the content of their tweets and provides you with data about their activity. On Github, user x0rz has created a tool called Tweets Analyzer.
0 kommentar(er)
