Every Step You Take: Application and Network Usage in Android

Transcription

1 Jessica Hyde

2 Every Step You Take: Application and Network Usage in Android Jessica Hyde Director of Forensics Magnet Forensics Adjunct Professor George Mason University June 8, 2018

3 Jessica Director Forensics, Magnet Forensics Adjunct Professor, George Mason University Previous: Basis Technology Ernst and Young American Systems United States Marine Corps

4 Traditional Mobile Analysis Focus on App analysis Artifacts First Web Browsers Chat App

5 Traditional Mobile Analysis Digging for Application Data Taught in courses, ie FOR585 Methodology for unsupported app data Discover Test Find Parse Script

6 Why Android Application Usage Analysis We do this for computer investigations! OS Artifacts Why don t we apply this concept to our Android applications? Why would it be useful?

7 Using Application Analysis Pattern of Life Analysis

8 Using Application Analysis Pattern of Life Analysis Showing a lack of a particular usage SANS DFIR Summit 2018

9 Using Application Analysis Pattern of Life Analysis Showing a lack of a particular usage Supporting artifacts for sync d data

10 com.vending.android

11 com.vending.android Tracks purchases BUT It LIES! Multi-user Second Device \data\com.android.vending\databases\library.db

12 Android Usagestats Tells you what file was in the foreground, background, etc. \data\system\usagestats\0\..\daily, \monthly. \weekly, \yearly.xml file named as epoch timestamp

13 Android Usage History roid/app/usage/usageevents.event User Interaction Move to Foreground Move to Background Configuration Change

14 Android Usagestats

15 Android Usagestats

16 Battery Status Monitors Battery usage system\batterystats-daily.xml \data\data\com.google.androi d.gms\shared_prefs\batterysta ts.xml Think of this as SRUM for Android

17 Battery Status \data\data\com.google.android.gms\shared_ prefs\batterystats.xml

18 BatterystatsDumpsysTask \data\data\com.google.android.gms\files \BatterystatsDumpsysTask.gz

19 BatterystatsDumpsysTask

20 BatterystatsDumpsysTask

21 Recent Images \system_ce\0\recent_images

22 Recent Images \system_ce\0\recent_images

23 Recent Images

24 Recent Tasks \system_ce\0\recent_tasks

25 Recent Tasks \system_ce\0\recent_tasks

26 Recent Tasks

27 Recent Tasks

28 Recent Tasks

29 Recent Tasks

30 Recent Tasks

31 Recent Tasks task_id effective_uid = first active time = May 11, :23:55:484 PM last active time = May 11, :33:20 PM last time moved = May 11, :32:43:392

32 Snapshots \system_ce\0\shortcut_service\ snapshots

33 Snapshots

34 Snapshots

35 Snapshots

36 3rd Party com.cleanmaster.security On lots of devices Logs battery usage Logs application usage

37 Cheetah Mobile Apps media\0\android\data\com.cleanmaster.se curity\files\logs\

38 Cheetah Mobile Apps media\0\android\data\com.cleanmaster.security \files\logs\applocklog

39 Cheetah Mobile Apps

40 Cheetah Mobile Apps

41 Cheetah Mobile Apps media\0\android\data\com.cleanmaster.security \files\logs\perfmetricsreport

42 Cheetah Mobile Apps

43 Cheetah Mobile Apps

44 Google Cloud Activity Takeout Download My Activity from s/takeout with credentials

45 Google Cloud Activity

46 Google Cloud Activity

47 Google Cloud Activity

48 Google Cloud Activity

49 Google Cloud Activity

50 Putting it all together Artifact Task ID Effective UID app Event UNIX Timestamp Time Date com.vending.android com.twitter.android Purchase /18/18 3:16 PM uid stats com.twitter.android UID Stats Twitter Cell /11/18 12:00 PM recent tasks com.twitter.android first active time /11/18 1:23 PM snapshots 244 Twitter jpg twitterpage snapshots 244 Twitter reduced.jpg 5/11/18 1:25 PM 5/11/18 1:25 PM recent tasks com.twitter.android last time moved /11/18 1:32 PM snapshots 244 Twitter.proto file 5/11/18 1:32 PM recent tasks com.twitter.android last active time /11/18 1:33 PM uid netstats com.twitter.android UID Stats Twitter Cell /11/18 2:00 PM

51

52 Founded in 2007 Headquartered in San Francisco, California, USA On December 7, 2016, Fitbit officially announced that they acquired assets from Pebble January 2017, Fitbit acquired Romania-based smartwatch startup Vector Watch SRL June 2011: Fitbit criticized for its website's default activity-sharing settings, which made users' manually-entered physical activities available for public viewing Some users were including details about their sex lives in their daily exercise logs, and this information was, by default, publicly available

53 Fitbit as evidence in investigations: Woman s fitness watch disproved rape report When Fitbit Is the Expert Witness (personal trainer civil case)

54 Fitbit as evidence in investigations: Big Brother was definitely watching as George Burch killed Nicole VanderHyden

55 Profiles

56 Profiles

57 Fitbit Profiles

58 Fitbit Profiles

59 Profiles How this could help Name associated to User ID Personal info / profile pic Stride length could come in handy depending on your case

60 Profiles Caveats Stride length calculated by using your gender and height (user entered) Can be adjusted cles/en_us/help_article/ 1135

61 Steps Steps

62 Steps Steps

63 Fitbit Steps

64 Steps How this could help Great evidence to show a person s level of activity, time of activity, and amount at a particular time Ties back to the false rape case Presence/lack of movement during a crime

65 Floors Climbed Floors Climbed

66 Floors Climbed

67 Fitbit Floors Climbed

68 Floors Climbed How this could help Indicates overall activity for the day Can show a trend of activity over a number of days

69 Heart Rate Heart Rate

70 Heart Rate

71 Fitbit Heart Rate

72 Heart Rate How this could help Great indicator of the user s physical exertion at points in time (5 min segments) Can especially help if graphed over time Why was there a spike at specific time? (e.g. time crime committed)

73 Sleep Sleep

74 Sleep Sleep

75 Fitbit - Sleep

76 Sleep How this could help Another very helpful indicator Remember the false rape case mentioned earlier Place someone at specific times Some questions around time awake/time asleep numbers

77 Questions? Jessica Hyde