Subscribe now

In October 2023, the Dossier Center revealed that publicly accessible data had inadvertently exposed sensitive Russian government and military facilities, including previously unknown FSB sites, where power outages could lead to severe consequences. Unfortunately, the Dossier Center did not include the source document, and by the time I started looking for it, the Russian government had taken it down from their servers, leaving me with only a map in the article with obfuscated locations. I’m here to take you on my journey to finding the coordinates. You can find the coordinates on X if you don’t care about the rest of this ;)

First stop: the WayBack machine

Archive.org regularly crawls websites and snapshots them at specific moments in time. Of course, this process has limits. Deeper links often need to be manually snapshotted. In this case, there was no record of this webpage (until I made one that day). I searched parent links but found nothing of interest. 

Second stop: Clear/Dark web searching

In the article, they tell us the exact description of the file: “Перечень потребителей электрической энергии (мощности), ограничение режима потребления электрической энергии которых может привести к экономическим, экологическим, социальным последствиям,” which translates to “List of consumers of electrical energy (power), limiting the mode of consumption of electrical energy which can lead to economic, environmental, and social consequences.” A quick Google search revealed that this is required under Decree of the Government of the Russian Federation 04.05.2012 N 442[5], where Russia mandates regional governments create these lists in case of emergency.

A search of the exact description “Перечень потребителей электрической энергии (мощности), ограничение режима потребления электрической энергии которых может привести к экономическим, экологическим, социальным последствиям” in Google and Yandex (on a Russian VPN) bore out the files from Bryansk, Vologda, Crimea, Novosibirsk, and Tambov. 

As for results on the Darkweb, I used ahmia[.]fi in Tor Browser to do some searching with variations of the description I used to search Google and Yandex. Nothing came up.

Third stop: Reverse Engineering The Map

At this point, the only way to get some version of the data is to dig through the map's source code and figure out how to extract all of the information. NOTE: I realized at the end that there was a faster way of reaching the same conclusion, but I think the following workflow is still useful to those trying to understand how to reverse engineer something like this.

The Hard Way

In hopes of an easy win, I started by using Chrome’s Dev Tools to inspect the network calls to look for an easy data grab. I was specifically looking for Fetch/XHR calls that returned a JSON of latitudes and longitudes but found nothing. There were calls to the Mapbox API, but the response was gibberish to me at that moment.

Since nothing was helpful in the network tab, I turned to the sources tab to walk through the map’s source code. I was specifically looking for where the map object is first loaded because it is a fair assumption that there’d be an array that contained all of the data I needed. I was able to find that in the script included in danger_zone.html. In this file, there was a map.on(‘load’, function()) where I added a breakpoint to inspect the map object.

Once I added the breakpoint, I realized that I needed to find a method to retrieve the features of the map layer that held these obfuscated points. I started combing Mapbox’s GL JS API for ideas and landed on the map.get_source(<source_name>)method because “Sources specify the geographic features to be rendered on the map. Source objects may be obtained from Map#getSource.” Earlier in the code, I saw variables that contained what I assumed to be the source_name, so I grabbed those strings and called the method with map.get_source(‘objects’), which returned a vector object.

The Source page for Mapbox GL JS explained that a vector source meant the layer's features were in the Mapbox Vector Tile format. When I expanded the vector object in Chrome DevTools, there was a tiles object associated with the source, which contained two links. At this point, I didn’t fully understand vector tile formats and decided to see if there was an out-of-the-box solution to transform Mapbox Vector Tiles to a GeoJSON. A quick Google search brought me to a handy utility called vt2geojson that took the Mapbox tile URLs and three variables as input and resulted in a GeoJSON. 

The last hurdle was determining the “x, y, and z” variables typically part of the URL when calling vt2geojson. Mapbox uses a “slippy map” where “z” is the zoom level, “x” is the column, and “y” is a row in that column. In layperson’s terms, a slippy map is a gridded version of a map so that the vector tiles are served to the browser appropriately and provide a smooth panning and zooming experience on the front end. Figuring out these values came down to trial and error using OpenStreetMap’s Python method for converting latitudes and longitudes to slippy tile numbers. I found the latitudes and longitudes for Moscow, St. Petersburg, Kaliningrad, Belgorod, and Sevastopol and set a zoom level to 9 to return the appropriate geojsons. I could not set the zoom variable any further because there was too much data. 

Now that I had the correct values for x, y, and z, I pulled the access token from the front end and called vt2geojson to retrieve the geojsons. The following is an example call I made to retrieve the Moscow GeoJSON:

vt2geojson  "https://api.mapbox.com/v4/dossier-center.6sjwmvr5/8/154/80.vector.pbf?access_token=<access_key>" >> moscow_dossier.geojson  

The above call resulted in a GeoJSON of all of the obfuscated locations. Upon inspection of the GeoJSON, I noticed a property value set for google_lat and google_lon, which I assume the map developers used to create the obfuscated locations. Using Python's Shapely library, I transformed each polygon geometry of the GeoJSON to a point geometry, using the google_lat and google_lon values in properties. I then translated all of the metadata from Russian to English, saved it back into a GeoJSON, threw it into Proton drive and voila! Feel free to download this, and open it in geojson.io to inspect the resulting locations.

The Easy Way

Had I known about Mapbox and vector tile formats, all the information I needed was actually in Chrome’s Dev Tools. The response already had the “id” and the access token I needed, and I just had to calculate the x, y, and z values as I did above to plug it into vt2geojson.

Final Stop: Introducing Myself

For those of you who don’t know me, I’m a software-enabled threat intelligence specialist by day and an OSINT-er by night. I love using software to solve fun problems like this one, so if you have any ideas or need any help, shoot me a message on X.

Subscribe now