nsa - converged analysis of smartphone devices: identification/processing/tasking – all in a...
TRANSCRIPT
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
1/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY1
(U) Converged Analysis of
Smartphone Devices
Identification/Processing/Tasking
All in a days work
Paula Kuruc, NSA
May 2010
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
2/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY 2
Smartphone
Converged mobile devicesoffering advanced capabilities,
often with PC-like
functionality. No set industrystandard definition.
Boasts powerful processors,
memory, larger screens andopen operating systems.
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
3/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY 3
Economics of Transportation
!The gradual blurring oftelecommunications, computers, and the
Internet
! Multifaceted layering technologies! Examples of convergence in SIGINT:
" Blackberry, iPhone data, Smartphones" VOIP" Wireless Local Loop" GPRS General Packet Radio Service
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
4/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
SmartPhone Applications
!Visual Communicator Free application thatcombines Instant Messaging, Photo-Messaging
and Push2Talk capabilities on a mobile
platform. VC used on GPRS or 3G networks;
heavily used in AQI Mosul Network! Symbian Operating System supporting
encryption programs.
! WinZip, compression and encryption program.
4
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
5/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Usage/Features
!Social Networking via Flixster
Social Networking site allowing users to share
movie ratings, discover new movies and meet
others with similar movie taste.
! Google Maps features! Photo capture and editing capabilities! Phone settings! Mobile Facebook Apps (iPhone/Android)
6
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
6/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Location Based Services
Where is the target?
! GPRS Dataset breaking down barriers! Providers catering to users based on location! Android Phones pass GPS data in the clear! No longer DNI/DNR
7
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
7/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Taking a Closer Look
Photo Capture Software -! iPhone Geotags for PhotosRaw tags coming through from a variety of
devices
! Flixster App uses GPRS! Flickr/Photobucket! Mobile Facebook Apps Uploads
8
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
8/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Processing
All in the Metadata, not the pretty pictures! Unique applications require unique analysis! GPS Indicators (sent to the server and towers
for both phone and application)
! VoIP Indicators (multiple services)! Type of Phone and Apps
9
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
9/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Identification via Xkeyscore
!Make use of fingerprints in Xkeyscore via theEXIF metadata plugin
! Fingerprints for images (jpeg, tiff, gifs etc.)! Examine the raw XML! Provides device and time/location for the imagefingerprint('image/exif/gpsCoordinates') =
file_ext('jpeg' or 'pjpeg' or 'jpg' or 'pjpg' or 'tiff' or 'gif' or 'png' or 'riff' or
'wav') and
'exif:GPSLatitude' or 'exif:GPSLongitude' or 'exif:GPSDestLatitude' or
'exif:GPSDestLongitude';
10
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
10/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Golden Nugget!
Perfect Scenario Target uploadingphoto to a social media site taken
with a mobile device.
What can we get?
11
TOP SECRET//COMINT/REL TO USA FVEY
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
11/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
User Activity Leads
! Examine settings of phone as well as serviceproviders for geo-location; specific to a certain
region
! Networks connected! Websites visited! Buddy Lists! Documents Downloaded! Encryption used and supported! User Agents
12
TOP SECRET//COMINT/REL TO USA FVEY
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
12/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Targeting
13
Targeting both Telephony and DNI systems
! Call Logs! SMS! SIM Card Leads! Email address! IMEI/IMSI! Unique Identifiers! Blackberry PINS
TOP SECRET//COMINT/REL TO USA FVEY
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
13/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Why do we care?
14
Additional exploitationTarget Knowledge/LeadsLocationTarget TechnologyDenote Media used
TOP SECRET//COMINT/REL TO USA FVEY
-
8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work
14/14
TOP SECRET//COMINT/REL TO USA, FVEY
TOP SECRET//COMINT/REL TO USA, FVEY
Conclusion
! Challenge is how to tag data for analysts! We can geo phones from virtually anywhere! Buried GeoStamp from Phone or Apps! Xkeyscore/Marina! Tasking systems
15