unmask.py – Statistical E-mail & Blog Profiling


This is a cool tool I found recently amongst all the flame wars in the security mailing lists, someone developed this tool to profile the semantics of text.

Basically you pump in a load of e-mails from a known source, then compare it to the anonymous socks and see what probability it is that they are the same person based on the text. You can do the same thing with blogs, not just e-mail!

This is version 1.0 of Unmask – a python script that attempts to unmask anonymous text by matching its statistical properties against someone else’s text with a known identity.

Other uses include determining “area of origin”,gender,age, occupation, sexual orientation, etc from text’s statistical properties. Any decision YOU can make against an unknown author, Unmask will also make. Of course, it may be less or more accurate than your determination.

You should probably fiddle with it as you go, to make it work on whatever sample set you have, before using it in the wild.

To use it, simple “store” text (with -s bob -f file.txt). Then just compare your unknown file to that particular store, or use -i to compare it to all stores. Make up a store of all male and all female text and then compare some random weblog, just for kicks.

You can download unmask here:

unmask1.0.tar.gz

Posted in: Hacking News


Latest Posts:


Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)


2 Responses to unmask.py – Statistical E-mail & Blog Profiling

  1. dre October 25, 2007 at 11:07 pm #

    watch as christopher abad explains how behaviorial analysis can be applied to user fingerprinting in his slides from Toorcon 2004. the winner of a selected set of words can be predicted based on their use of the command line (bash shell in this case).

    i just saw chris abad speak again at toorcon 9 this past weekend. he is an excellent speaker, and usually “you have to be there” to understand – his work can’ really be explained.

    i imagine that with abad’s techniques (and dave aitel’s techniques in umask.py) – along with hdm’s decloak… and a little Google Analytics cookie saving and search query stealing – you can gather tons of information on random bloggers or other website users.

  2. Sir Henry December 14, 2007 at 7:34 pm #

    Darknet, have you tried this tool yet? What are your thoughts on it? It would be interesting to see any results from a test.