Binary Intelligence

...thoughts and news on digital forensics, pentesting, electronic investigations, and the computer underground.

I have recently started using an iPhone for a variety of different functions related to my work. All in all, I have to say it is not my favorite phone, but it is serving a purpose in allowing me to become familiar with a variety of different options that this mainstream device offers. In working with the device and looking for a new Twitter client, I came across an application named Twinkle. I wanted to share with the community some of my observations from using the application.

Twinkle is a social networking application created by Tapulous for the iPhone or iPod Touch. It is similar to Twitter, with a few key differences. When a user first installs and runs Twinkle, the application requests an e-mail address to generate a Tapulous account. The e-mail address is utilized to confirm the account and a profile is created.

From this point on, the profile is accessed and managed on the iPhone with no password required. This process makes it extremely easy to start up and use the application. The ease of use combined with the large number of iPhone owners creates a sizable potential user base.

Users also have the option of associating the application with a Twitter account. If this step is not conducted, the profile and all generated content lives only within the Twinkle network and is only accessible through the iPhone or iPod Touch.

The key feature of Twinkle, and main difference from Twitter, is its location awareness. Within Twitter, users have to "follow" other users to see what they have posted to the network. Twinkle on the other hand, has the ability to build a dynamic network based on the proximity to other users. Users are able to quickly pull up all posts from other users within a defined proximity from their current location (default is 50 miles). The user’s location is automatically identified by Twinkle.

In most circumstances, this is a powerful feature. This allows users to quickly identify others in their local area and discuss popular events, places to eat, weather, traffic problems, and so on. If desired, users have the ability to define friends in the same manner as Twitter. Private messages are supported as well as attaching images to both public and private posts.

I find great utility in this application as it gives users a way to find out what is going on in their area from a “word on the street” level without relying on other news sources. When traveling, it is a great way to get a feel for the local area.

However, there is a huge potential for abuse that could occur on the network. For instance, below is the content that was displayed today when launching the application. This was the default list of recent posts from users close by.


If you look closer at the posts from one of the profiles on the list we find:


This sort of behavior, while regrettable, is almost expected of any service such as this.

One of the surprising aspects of this are some of the actions of the female profiles. For instance, here is a public profile from a young female within my local area:



Notice the repetitive requests for direct communication of "let's talk!” This is interesting from the perspective that this is a young female that is actively soliciting private communications. It’s possible that this isn’t a legitimate account and is someone posing as a female just to attract conversation (not law enforcement related activity). You can tell by the picture icon on some of those posts that pictures are attached to them. An example of the pictures which are posted:


At this point it’s impossible to tell if this is a valid account with activity by a young female or someone else utilizing pictures of young female to add “legitimacy” to the posts.

Within the application, you can also view a list of a user’s friends. This female profile had a number of friends with one that stood out due to the graphic nature of the posts.



This was the only picture in this male’s profile that was safe to post. The other images were entirely too graphic. It is interesting that this account was tied to the previously mentioned female profile as a friend since they are not in the same geographic area. It is unknown as to the intentions of these users, but it could be said that much of the activity is inappropriate.

When I first came across Twinkle, I noticed some of this content and initially dismissed it. However, after some weeks of using the application I have found this sort of content to be very common in my local area (and this may not be representative of other areas).

I do want to state that I am not trying to discredit Tapulous, the publisher of Twinkle. I appreciate that they are trying to publish a quality iPhone app for free. The negative aspects that I described come at the fault of the users, not of the software publisher. From reading the Tapulous support forums, it appears as if the publisher takes abuse seriously, and removes accounts that engage in inappropriate behavior.

I wrote this post simply to bring attention to Twinkle and the potential for its use in online enticement. This application is uniquely positioned for this purpose due to the reckless behavior by the user base, the fact that users are able to identify the proximity of other profiles, the relative anonymity of accounts (sign up under a false e-mail address), and the lack of attention paid to the content of the network.

The Twinkle network is widely unknown and I hope that this post will provide a resource to anyone involved in enticement investigations. By making parents and law enforcement aware of the negative possibilities, it is hoped that they can help educate their children and stop potential offenders before anything bad can occur.

Update:

I wrote this post over the weekend to post here on Monday. Sunday night, I took another look at what was happening in my local area, when I saw this:

Here we have a user from my local geographic area soliciting 13 to 14 year old girls.

This one screen shot makes my case.

1 comments:

Anonymous said...

I know people who work At Tapulous Ive informed them that they need to make a flag feature because Iam constantly seeing wayward youth showing there privates which by the way is child porn they seem uninterested in correcting the problem which is unfortunate.
So I hope no child gets hurt before it gets shutdown

Post a Comment