Passive Reconnaissance: Strava and Fitness Trackers

1. User runs/cycles with:
   - Smartphone app
   - Fitness watch (Garmin, Fitbit, Apple Watch)
   - Other GPS device

2. GPS tracks route

3. Activity uploaded to Strava

4. User shares with friends/public

5. Data aggregated into Global Heatmap

Users share:
✗ Where they live (start/end of routes)
✗ Where they work (lunch runs, commutes)
✗ When they're active (predictable routines)
✗ Security patrol routes
✗ Access to restricted areas
✗ Secret facility locations

URL: https://www.strava.com/heatmap

Free, no account required
Shows aggregated GPS data from 3+ billion activities
Updated regularly

Bright areas = High activity
- Popular running routes
- Cycling paths
- Common exercise locations

Dark/isolated bright spots = Interesting!
- Military bases in remote areas
- Secret facilities
- Security patrols
- Individual users in sparse areas

Researchers discovered:
- US military bases in Afghanistan/Syria
- Patrol routes around perimeters
- Interior base layouts
- Guard post locations
- Helicopter landing zones

How?
Soldiers using fitness trackers while:
- Running on base
- Patrolling perimeter
- Working out in restricted areas

Remote desert location:
- No cities nearby
- Bright running tracks on heatmap
- Rectangular perimeter (base fence)
- Interior paths (roads, facilities)
- Patrol patterns visible

Conclusion: Undisclosed military facility

Suspected CIA locations:
- Office buildings (officially "other uses")
- Employee lunch runs reveal true purpose
- Start/end points show residential areas
- Can correlate with other OSINT

Look for:
- Unmarked facilities
- High security visible on Street View
- Exercise routes starting from location
- Multiple users (not just one person)

Tech company offices:
- Employee running routes
- Campus layout (paths, buildings)
- Shift patterns (when employees exercise)
- Parking lot locations
- Nearby residence patterns

Use cases:
- Physical penetration testing
- Social engineering (where employees live)
- Spear phishing (target employees)

Specific person:
- Home address (start/end of most runs)
- Work location (weekly pattern)
- Gym location
- Regular schedule
- Predictable absence from home

Security risks:
- Stalking
- Burglary planning
- Kidnapping (high-value targets)
- Social engineering

Guards using fitness trackers:
- Perimeter patrol paths
- Frequency of patrols
- Gaps in coverage
- Timing patterns
- Blind spots

Red team gold: Avoid patrols, find gaps

1. Go to https://www.strava.com/heatmap
2. Search location or navigate manually
3. Zoom in/out
4. Toggle activity types:
   - All (default)
   - Ride (cycling)
   - Run
   - Water (swimming)
   - Winter (skiing)

Look for:
- Activity in remote areas (why there?)
- Regular geometric patterns (patrols?)
- Isolated facilities with multiple users
- Clusters in unexpected locations

Workflow:
1. Find interesting heatmap activity
2. Cross-reference with Google Earth/Maps
3. Identify facility type
4. Confirm with other OSINT (news, etc.)

Example:
Heatmap: Bright activity in desert
Google Earth: Compound with security fence
News search: "military base [location]"
Result: Confirmed classified facility

Many routes start/end at same location:
= Residential area

Zoom in:
- Street-level detail
- Specific buildings
- Apartment complexes

Cross-reference:
- Phone directories
- Social media
- Property records

When are people active?
- Early morning: Before work
- Lunch time: Mid-day
- Evening: After work

Security implications:
- When facilities are less staffed
- Predictable absence patterns
- Shift change times

✗ Real name
✗ Profile photo
✗ Location (city)
✗ All activities (runs, rides)
✗ Routes taken
✗ Frequency and schedule
✗ Clubs/groups joined
✗ Segment leaderboards

1. Create free Strava account
2. Search for person by name
3. View public activities
4. Map home/work locations from routes

Strava segments = specific route sections

Example:
"Main St to Park" segment
- Shows everyone who ran it
- Public profiles visible
- Can identify locals

Use case:
Find employees of target company
Search segments near their office

Users join clubs:
- Company running clubs
- Military unit fitness groups
- Neighborhood groups

Search clubs:
- "[Company Name] Runners"
- "[Military Base] Running Club"
- Member lists visible

Public activities show:
- Who gave "kudos" (likes)
- Who commented
- Social connections

Map social network:
Person A knows Person B knows Person C
All work at target company

URL: https://connect.garmin.com

Similar to Strava:
- Activity tracking
- Public profiles
- Route mapping
- Social features

Privacy: Slightly better defaults
Still risky if not configured

Public activity feed
Route sharing
Leaderboards

Check for target individuals

Route database
User profiles
Activity feeds

Social features
Activity sharing
Less detailed than Strava

Challenges and leaderboards
Friend activities
Less GPS detail (usually)

Location: Syria
Discovery: 2018
Method: Strava Heatmap analysis

Findings:
- US military base location confirmed
- Perimeter patrol routes visible
- Interior roads mapped
- Helicopter landing zones
- Guard posts identified

Impact:
- Operational security compromised
- Potential targeting by adversaries
- Policy changes (fitness trackers banned)

Target: Suspected intelligence operative
Method: Strava profile analysis

Process:
1. Officer used real name on Strava
2. Regular runs from "unmarked" building
3. Building identified as intelligence facility
4. Officer's home address found (run start points)
5. Personal routine mapped

Impact:
- Officer's cover blown
- Family security at risk
- Facility confirmed

Target: Tech company CEO
Method: Strava public profile

Findings:
- CEO ran same route daily (predictable)
- Always at 6 AM (time window)
- Same start point (home address)
- Remote section of route (isolated area)

Risk:
- Kidnapping opportunity
- Physical security failure
- Lack of operational security

Strava → Settings → Privacy Controls:
☑ Make activities private
☑ Hide home/work locations (Privacy Zones)
☑ Don't appear in group activities
☑ Opt out of Heatmap
☑ Hide profile from search

Set radius around:
- Home address
- Work address
- Frequently visited locations

Activities starting/ending in zone:
= Hidden from map display

Use pseudonym or initials
Avoid identifiable photos
Don't link to other social media

Check map preview
Ensure no sensitive locations visible
Consider route before running

Ban fitness trackers in:
- Classified areas
- Secure facilities
- While on duty (security personnel)

Education:
- OPSEC training
- Demonstrate risks
- Provide guidance

Monitor heatmap for your facilities:
- Are your locations exposed?
- Employee routes visible?
- Security patrols leaked?

Tools:
- Regular heatmap checks
- OSINT on your own organization

Physical controls:
- No phones/devices in SCIFs
- Device check-in at entry
- RF shielding (if necessary)

1. Go to https://www.strava.com/heatmap
2. Navigate to your city
3. Identify:
   - Popular running paths
   - Your neighborhood
   - Nearby offices/facilities
4. Can you identify patterns?

1. Search known military base location
2. Zoom in on heatmap
3. Observe:
   - Perimeter routes?
   - Interior activity?
   - Patterns visible?

Example locations:
- Fort Bragg, NC
- Naval Base San Diego, CA
- Wright-Patterson AFB, OH

If you use Strava:
1. Review your privacy settings
2. Set privacy zones (home/work)
3. Make past activities private
4. Review what's visible publicly

If you don't use Strava:
1. Check if friends/colleagues do
2. Are they exposing information?
3. Can you identify them?

1. Pick a major tech company
2. Find campus on heatmap
3. Identify:
   - Employee running routes
   - Campus layout
   - Nearby residential areas
4. What can you learn?

Examples:
- Apple Park, Cupertino
- Google Campus, Mountain View
- Amazon HQ, Seattle

✓ Heatmap is public data
✓ Analyzing public info is legal
✓ No hacking or unauthorized access

✗ Using data for stalking = illegal
✗ Trespassing based on intel = illegal
✗ Harming individuals = illegal

✓ Security research (authorized)
✓ Defensive analysis (your org)
✓ Education and awareness
✓ Improving OPSEC

✗ Stalking or harassment
✗ Targeting individuals maliciously
✗ Selling data to criminals
✗ Enabling harm

If you find critical exposure:
1. Document findings
2. Notify affected party privately
3. Allow time to remediate
4. Report to platform if needed

Don't:
- Publish immediately
- Shame individuals
- Exploit vulnerabilities

Strava Heatmap:
https://www.strava.com/heatmap

What to look for:
- Activity in unexpected places
- Regular patterns (patrols)
- Isolated facilities
- Start/end clusters (residences)

Privacy settings (Strava):
Settings → Privacy Controls
- Enable privacy zones
- Make activities private
- Hide from public
- Opt out of heatmap

Cross-reference tools:
- Google Maps/Earth
- Satellite imagery
- WHOIS/DNS data
- Social media profiles