Welcome back, aspiring cyberwarriors!
AllTrails is a good platform for discovering and navigating trails, and for keeping track of your fitness, with more than 30 million users worldwide. It started as just a simple trail directory but has turned into a powerful mix of a mapping tool, GPS navigation app, and outdoor social network. You can search for hiking, running, cycling, or mountain biking trails by location, difficulty, length, and more. You can also navigate those trails live using GPS and record and share your adventures with the AllTrails community.
For OSINT analysts, AllTrails is pretty unique among social media platforms because it offers a time-stamped, GPS-accurate record of where someone has been, how they got there, and, often, where they ended up. When users set their activities to public, which is the default for new accounts, anyone can check out this info without the user even knowing they are being tracked.
In this article, we’re going to dive into what AllTrails offers and how we can collect that information for OSINT. Let’s get rolling!
Step #1: What Is Public By Default
Every new AllTrails account is created with a default privacy setting of ‘Public’. To view different accounts, we need to create a personal account, which is a quick process. Once signed in, users can access various public accounts and find notable information. This includes the profile photo, display name, and location.
Additionally, high-level statistics, such as the total number of completed trails, total distance, and cumulative elevation gain, are available. Users can view the completed trails marked by the account holder, along with the dates they were completed. Recorded activities show GPS-tracked routes, detailing the precise path walked, run, or cycled, including timestamps and distance.
Also, reviews and star ratings for specific trails, as well as any photos uploaded to those trails, are visible. Users might have curated lists of trails they have created or saved, which they can explore. Finally, one can see followers and who the user follows.
Moreover, it is important to note that AllTrails profiles are indexed by Google and other search engines by default, so using a simple Google search query can help you find numerous public accounts:
site:alltrails.com/members/
Step #2: AllTrails Platform Features Relevant to OSINT
AllTrails features a handy mapping interface with customizable layers, making it great for geospatial analysis as well as user tracking. You can view the AllTrails base map highlighting trails, switch to a road map for context, or use satellite imagery for terrain checks. In the US, topographic maps show elevation and features, and they include a terrain view of hills and valleys. You can also access layers for national parks and community-driven data like OpenStreetMap.
For details, you’ll find waypoints for points of interest, user-uploaded photos, nearby trails, and distance markers. There’s a heatmap showing popular routes and overlays for current weather, air quality, light pollution, and pollen counts.
Step #3: Case Study — The Biden Official Exposure (Vice, 2023)
In March 2023, Vice’s Motherboard reported that security researcher Wojciech looked into AllTrails’ public settings and uncovered the detailed movement history of a former senior Biden administration official. Wojciech kicked off his investigation by searching AllTrails for user activity near key U.S. government locations, including the Pentagon, the NSA, the CIA headquarters at Langley, and the White House. It was pretty straightforward. He just used AllTrails’ location-based search to zoom into these areas, browsed the trail pages, checked community activity, and spotted user profiles that showed up in the activity and completed lists for those specific routes.
Once he found users in those spots, he explored deeper into their public activity history on AllTrails. This allowed him to track exactly where each user had been, thanks to GPS data that marked specific start and end points. He could easily identify patterns, such as someone frequently returning to the same residential address, suggesting it was their home.
The data from AllTrails revealed quite a bit. The profile of the former official was linked to their personal email, which Motherboard confirmed by attempting to create a new account with that same address. An activity recorded in December showed they had been at the White House, and he identified a nearby building where they finished a journey that matched an address in the area. The data also helped track their regular movements around Washington, D.C., when they were in office, and cross-reference their starting points with public records to identify a house associated with their family.
Step #4: Limitations and Data Quality
Coverage Gaps
AllTrails covers trails well in the U.S. and Western Europe, but it can be inaccurate in other regions. If you’re looking into trails in less popular areas, the absence of data doesn’t mean a trail isn’t there; it might just not be documented on the app.
Accuracy Issues
Because AllTrails relies on user-generated data, the accuracy can vary. GPS logs work well in open spaces but may be off in dense forests or urban areas.
Temporal Limitations
The app only tracks routes while in use, so if someone hikes without recording or uses another app, their AllTrails account may not show much info.
No Real-Time Access
AllTrails doesn’t provide real-time location tracking. The live sharing feature is for invited users only, so you can only see someone’s past hiking history, not their current location.
Summary
AllTrails is actually a surprisingly useful tool for OSINT because it’s not really intended for spying on people. Its social features, GPS tracking, and community stuff are all about getting people outside and enjoying nature together. But all the data that comes from those features is basically location data, and location data is a goldmine for intelligence.
If you’re looking to enhance your OSINT skills, consider exploring our OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at [email protected], and we’ll conduct a comprehensive OSINT investigation for you.
Source: HackersArise
Source Link: https://hackers-arise.com/open-source-intelligence-osint-transforming-the-alltrails-hiking-app-into-an-open-source-intelligence-resource/