Uncovering the Covered Tracks: Finding What s Left Behind JAD SALIBA FOUNDER & CTO

Transcription

1 Uncovering the Covered Tracks: Finding What s Left Behind JAD SALIBA FOUNDER & CTO

2 Background Teenage geek - IT/Software industry Police officer for 7 years Worked in Tech Crime Unit Started JADsoftware (now Magnet Forensics) as a part-time side project now a team of developers

3 Overview Recovering artifacts from multiple devices: PCs: Mobile: Skype Facebook Google Maps Kik Messenger Facebook Snapchat Chromebooks: Getting to unencrypted data Using timelines to find out what happened Tools that can help

4 PC Artifacts

5 Skype Voice over IP service (with video and text chat options) Started in 2003 Over 633 million registered users 65 million people sign in to Skype every day 700 million minutes spent in Skype-to-Skype calls every day Microsoft has retired Windows Live Messenger in favor of its Skype service, although Messenger will continue in mainland China. Microsoft began the transition for all users on April 8, 2013.

6 Skype

7 Skype

8 Skype chatsync

9 IP Addresses

10 Skype main.db file SQLite database Contains majority of interesting data Account info, Calls, Contacts, Messages, SMS messages, Video session info, Voic info

11 Skype

12 Skype ( POSTED_TEXT )

13 Skype ( Sent )

14 Skype Sender username / display name

15 Skype Date/time (Unix time, in UTC)

16 Skype Voic s require a premium account Only get saved to this folder after being played Filename can be found in the Voic s table in the main.db file - filename contains the date/time Audio is in a proprietary Skype format BUT there is a way!

17 Facebook Leading social networking site Started in 2004 Over 950 million Facebook users worldwide (Source: Facebook) 500 million people log onto Facebook daily (Source: The Social Skinny 2012) There are 83 million fake profiles. (Source: CNN) Photo uploads total 300 million per day (Source: Gizmodo)

18 Facebook Chat Not like the good o l days Still left behind, but mainly in live RAM, pagefile, hibernation file Multiple formats Live chat and messages essentially the same

19 Facebook Chat {\"msg\":{\"text\":\"lol i love facebook, it's so awesome. chatting is fun!!\"},\"from\": ,\" to\": ,\"time\": ,\"type\":\"msg\"}

20 More chat: {"tid":"mid :d61a480cfa3a140d91","href":"\/me ssages\/read\/?tid=mid \u00253ad61a480cfa3 a140d91","author_fbid": ,"author_name": "Wendy Manford","thread_name": Bourne","snippet":"Hey have you seen the new...","message":"hey have you seen the new Bourne movie?","time":"just now","image":{" html": "\u003cimg src=\" pg\" alt=\ Wendy Manford\" class=\"img profpic\" height=\"43\" width=\"43\" \/>

21 Wall post: fbid":" ","legacyid":" ","body":{"text":"can see y dem would a call afta u...","ranges":[],"aggregatedranges":[],"hastranslat ablecontent":true},"author":" ","ften tidentifier":" ","likecount":0,"hasvie werliked":false,"canremove":false,"canreport":true,"ca nedit":false,"source":1,"istranslatable":false,"timesta mp":{"time": ,"text":"april 6 at 2:24am"

22 Facebook Decoding photo URLs Recovered photo view URL: https: // &set=at &type=1& theater

23 Facebook Decoding photo URLs https: // &set=at &type=1& theater Facebook Photo ID is " "

24 Facebook Decoding photo URLs https: // &set=at &type=1& theater Facebook Album ID is " "

25 Facebook Decoding photo URLs https: // &set=at &type=1& theater Photo belongs to user ID " "

26 Facebook Decoding photo URLs https: // &set=at &type=1& theater Now what?

27 Facebook Decoding photo URLs https: // &set=at &type=1& theater We can use the Facebook Graph API to learn more about this user.

28 Facebook Decoding photo URLs https: // &set=at &type=1& theater We ll take the user ID above (bolded) and put it in to the below URL (no need to login to Facebook):

29 Facebook Decoding photo URLs

30 Another photo URL: {"tid":"mid :d61a480cfa3a140d91","href":"\/me ssages\/read\/?tid=mid \u00253ad61a480cfa3 a140d91","author_fbid": ,"author_name": "Wendy Manford","thread_name": Bourne","snippet":"Hey have you seen the new...","message":"hey have you seen the new Bourne movie?","time":"just now","image":{" html": "\u003cimg src=\" jpg\" alt=\ Wendy Manford\" class=\"img profpic\" height=\"43\" width=\"43\" \/>

31 Quick Facebook URL Demo

32 Google Maps Started in 2004 Over 1,162,460 sites use Google Maps Overtook MapQuest in terms of traffic in 2009 Google Maps Navigation, included on Android handsets, has guided users 12 billion miles a year 200 million users on Google Maps for Mobile Cases involving runaway youths, kidnapping, luring, homicide Jo Yates homicide - Avon and Somerset Constabulary, Scott Eggins

33 Google Maps Temporary Internet Files RAM captures pagefile.sys / hiberfil.sys

34 Google Maps Uses a tile system to display maps Each tile is 256x256 pixels Filename in Temporary Internet Files contains x, y, and z coordinates Coordinates are based on a world map x, y requires the z value (zoom) Examples: lyrs=m@ &hl=en&src=app&x=5&y=8&z=4&s=galile o[1].png &x=9054&y=11982&z=15.png

35 Google Maps

36

37 Google Maps Tiles can be downloaded:

38 Google Maps Tile coordinates can be converted to Longitude, Latitude: function tile2long(x,z) { } return (x/math.pow(2,z)* ); function tile2lat(y,z) { } var n=math.pi-2*math.pi*y/math.pow(2,z); return (180/Math.PI*Math.atan(0.5*(Math.exp(n)- Math.exp(-n))));

39 Google Maps

40 New Google Maps Newer version of Google Maps launched in March 2014 Tile filenames and URLs are different now (thanks Google!) It s not pretty: pb=!1m4!1m3!1i11!2i564!3i751!2m3!1e0!2sm!3i !3m 8!2sen!5e1105!12m1!1e47!12m1!1e1007!12m1!1e38!4e0!7s!2 0m1!1b1[1].png

41 New Google Maps The new URLs: ,12z/data=!3m1!4b1!4m2!3m1!1s0x882b89b820e46c19:0x503 7b28c7231d ,11z/data=!3m1!4b1!4m13!4m12!1m5!1m1!1s0x882c732d94 85d199:0x581a671dca1a1705!2m2!1d !2d !1m5!1m1!1s0x882b88f2ca61211d:0xf99f9dd 46477f986!2m2!1d !2d

42 New Google Maps The new tiles: Sample filename: pb=!1m4!1m3!1i11!2i564!3i751!2m3!1e0!2sm!3i !3m8! 2sen!5e1105!12m1!1e47!12m1!1e1007!12m1!1e38!4e0!7s!20m 1!1b1[1].png Another sample, slightly different: pb=!1m5!1m4!1i15!2i18147!3i23991!4i128!2m1!1e0!3m3!5e1105!12m1!1e47!4e0[1].png

43 Quick Google Maps Demo

44 Mobile Artifacts

45 Facebook Focusing on chat and geolocation data stored On Android, files are located in the following folder on the data partition: com.facebook.katana File we re interested in is named threads_db2 SQLite database

46 Main folder

47 The databases folder

48 threads_db2 main.messages

49 threads_db2 main.messages

50 Kik Messenger Again, focusing on chat but there is potentially a lot of great data here Files are located in the following folder on the data partition: kik.android File we re interested in is named kikdatabase.db SQLite database (surprise!)

51 Main folder

52 The databases folder

53 kikdatabase.db main.messagestable

54 Snapchat Photo messaging app More than 100 million users along with more than 350 million snaps sent per day Users can take photos, record videos, add text and drawings, and send them to a controlled list of recipients Sent photographs and videos are known as "Snaps Users set a time limit for how long recipients can view their Snaps (1 10 seconds) After time expires, the Snap is deleted Some data can still be recovered!

55 Snapchat data folder

56

57

58

59 Google Chrome OS (Chromium OS)

60 Google Chrome OS Launched on June 15 th, 2011 Linux kernel-based operating system designed by Google Works primarily with web applications Aimed at users who spend most of their computer time on the web Almost a pure web thin client OS, cloud based, cloud reliant Chromium is the open source project, Chrome OS is the commercial version only on specific hardware from Google s partners

61 Google Chrome OS Encryption / Security User data is encrypted on a separate partition Web apps are sandboxed Verified boot system files are hashed and protected No root/shell access unless in Developer Mode

62

63 Google Chrome OS So what can we do? Need user login/password Screenshots of web history Copy out files (non-traditional, not forensically sound ) Developer Mode

64 Google Chrome OS So what can we do? Need user login/password Screenshots of web history Copy out files (non-traditional, not forensically sound ) Developer Mode

65 Google Chrome OS Getting shell access Open browser, press Ctrl+Alt+T Type shell and press ENTER We don t have shell access outside of Developer Mode

66 Google Chrome OS Getting into Developer Mode Need to find method specific to your Chromebook: For my HP Chromebook, hold down the Esc and Refresh key and poke the power button

67 Now, press Ctrl-D

68

69

70

71 This will take a few minutes then we ll start fresh

72 Google Chrome OS Now we have shell access

73 Familiar looking files?

74 Familiar looking files?

75 Some signs of encryption

76 USB mount point

77 Copying out the user home directory

78 Creating an image List the partitions

79 dd if=/dev/mmcblk0p1 of=/media/removable/usb\ Drive /chromebook.dd bs=4096 conv=notrunc,noerror,sync

80 Timeline Demo

81 Questions? Thanks for your time!