shmoocon 2011 - inside the app: all your data are belong to me
TRANSCRIPT
INSIDE THE APP: ALL YOUR DATA ARE BELONG TO ME Sarah Edwards [email protected], @iamevltwin Shmoocon – January 2011 © 2011 Harris Corporation
About Me
¨ Digital Forensic Analyst with Harris Corporation ¨ Computer Intrusions
¤ Free time is used for iOS/Mac forensic research.
¨ Works with the Feds ¤ I don’t like wearing suits.
¨ Not a hacker. ¤ I don’t code/hack/exploit things. ¤ But I do like to get into things, I’m nosy.
© 2011 Harris Corporation
Objec;ves
¨ iOS Applica;on Security Awareness ¤ Inves;gators ¤ Users ¤ Developers ¤ Bad Guys?
¨ What about Android/Blackberry/Windows?
© 2011 Harris Corporation
Objec;ves
¨ If you sit through this, you’ll get: ¤ Contacts ¤ Pictures ¤ Documents ¤ Usernames ¤ Passwords ¤ Loca;onal Data ¤ …much more.
¨ It is so easy, almost too easy.
© 2011 Harris Corporation
iOS Apps
¨ Prevalence ¤ iPhone ¤ iPad ¤ iPod Touch
¨ How many Apps? ¤ 10 Billion downloads ¤ ~350,000 Apps
n [hZp://www.buzzbiznews.com/035133/apple’s-‐app-‐store-‐hits-‐10-‐billion-‐downloads/]
© 2011 Harris Corporation
Recent News
¨ viaForensics [viaforensics.com] ¤ appWatchDog
¨ Wall Street Journal ¤ Current privacy lawsuit ¤ Data at Rest vs. Data in Transit
¨ People vs. Diaz (California Supreme Court) ¤ Gist: Pursuant to arrest, officials can review your cellphone.
© 2011 Harris Corporation
Caveats
¨ Third-party applications only. ¨ Redaction…this is a privacy talk after all. ¨ Lots of pictures ¨ Software Verification and Validation ¨ Evidence Admissibility ¨ Detailed acquisition techniques
© 2011 Harris Corporation
ACCESSING THE DATA
© 2011 Harris Corporation
State of Forensic Socware
© 2011 Harris Corporation
¨ There are many tools. ¨ Some are better than others. ¨ Some get only logical data. ¨ Some require the passcode. ¨ Most are expensive. ¨ Most do not auto-magically parse 3rd party
application data. ¨ Proprietary data output formats.
Backups vs. Physical vs. Logical
Backups
• Easy Access • Historical
Context • Encryption • Must have HDD • Limited Data
Physical
• Difficult to capture
• Up-to-date • Access to
physical device • Potential to get
EVERYTHING • Encryption
Logical
• Easy Access • Up-to-date • Access to
physical device • Limited to
logical data
© 2011 Harris Corporation
Backup Data Loca;ons
¨ Windows ¤ <APPDATA>\Apple Computer\MobileSync\Backup\
¤ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup
¨ Mac ¤ ~/Library/Application Support/MobileSync/Backup/
© 2011 Harris Corporation
Backup Files (iOS 3.x)
¨ mddata ¨ mdinfo ¨ Info.plist ¨ Manifest.plist ¨ Status.plist
© 2011 Harris Corporation
Backup Files (iOS 4.x)
¨ Info.plist ¨ Manifest.mbdb ¨ Manifest.mbdx ¨ Manifest.plist ¨ Status.plist
© 2011 Harris Corporation
Socware for Backups
• iPhone Backup Extractor – Mac only – Available at supercrazyawesome.com – Free! (Donations are welcome.)
© 2011 Harris Corporation
Socware for Backups
¨ iPhone Backup Extractor ¤ Windows, Linux & Mac ¤ Available at:
n iphonebackupextractor.com ¤ Free & Paid Versions
© 2011 Harris Corporation
Socware for Backups
¨ iBackupBot ¤ Windows Only ¤ Available at:
n icopybot.com ¤ Free Trial ($35)
© 2011 Harris Corporation
Socware to Access Physical Device
¨ Forensic Socware ¨ Jailbreak
¤ SSH/DD/SCP
¨ "Zdziarski" Method ¤ NIST Approved ¤ LE/Military Only
¨ Commercial Non-‐Forensic Socware ¤ PhoneDisk ¤ PhoneView
© 2011 Harris Corporation
Socware to Access Physical Device
¨ PhoneDisk ¤ Mac & Windows ¤ Available at: macroplant.com/phonedisk/ ¤ $20
© 2011 Harris Corporation
Socware to Access Physical Device
¨ PhoneView ¤ Mac ¤ Available at: ecamm.com/mac/phoneview/ ¤ $20
© 2011 Harris Corporation
Applica;on Directories
¨ /private/var/mobile/Application (Actual Path, linked to /User/Application)
¨ /User/Applications/########-####-####-####-############
¤ Universally Unique ID
¨ <Application_Home>/AppName.app – Applica;on Bundle (Not Backed Up)
¨ <Application_Home>/Documents/ -‐ Contains user documents and data files. (Backed Up)
¨ <Application_Home>/Library/ -‐ Contains applica;on specific files. (Backed Up)
¨ <Application_Home>/Library/Preferences – Applica;on Preference Files (Backed Up)
¨ <Application_Home>/Library/Caches – Applica;on specific support files. Persistent between applica;on launches. (Not Backed Up)
¨ <Application_Home>/tmp/ -‐ Temporary files, not persistent between applica;on launches. (Not Backed Up)
© 2011 Harris Corporation
/User/Applica;ons Directory
© 2011 Harris Corporation
Applica;on Directory
© 2011 Harris Corporation
iTunesMetadata.plist
¨ Contains informa;on such as: ¤ Product Informa;on ¤ Purchase Data ¤ Apple Account Data
© 2011 Harris Corporation
iTunesMetadata.plist
© 2011 Harris Corporation
GOOD THINGS TO KNOW
© 2011 Harris Corporation
Dates
¨ Many use Absolute Time ¤ Seconds from 1/1/2001 00:00:00 GMT
¨ Tools: ¤ Mac: CFAbsoluteTimeConverter
n (hsoi.com/hsoishop/socware/) ¤ Windows: Dcode
n (digital-‐detec;ve.co.uk/freetools/decode.asp)
¨ …or add 978307200 and use date -ur
© 2011 Harris Corporation
Popular File Formats -‐ Plist
¨ Property List ¤ XML or Binary
¨ Tools ¤ Property List Editor
n Mac Only n Xcode n Free! (w/ Mac OS)
¤ Ibackupbot Plist Editor n Windows Only n icopybot.com/download.htm n Free!
© 2011 Harris Corporation
Popular File Formats -‐ SQLite
¨ SQL-‐based rela;onal database ¨ Tools ¤ SQLite Database Browser
n Mac & Windows n sqlitebrowser.sourceforge.net n Free!
© 2011 Harris Corporation
NOW TO THE GOOD STUFF…
© 2011 Harris Corporation
SOCIAL NETWORKING
© 2011 Harris Corporation
Facebook v.3.3.3
© 2011 Harris Corporation
/Documents/friends.db
© 2011 Harris Corporation
Facebook Profile
¨ hZp://www.facebook.com/profile.php?id=<UID>
© 2011 Harris Corporation
User Picture (pic_square)
© 2011 Harris Corporation
com.facebook.Facebook.plist
© 2011 Harris Corporation
/Library/Three20
© 2011 Harris Corporation
¨ May contain: ¤ Profile Icons ¤ XML Text Files ¤ Album Photos ¤ Miscellaneous Pictures
/Library/Three20
¨ <fql_result> ¨ <name>checkins_activity<name>
¤ Contains User IDs & coordinates ¤ Lots of other data
© 2011 Harris Corporation
/Library/Three20
¨ <profile_response><user ¤ Contains profile data.
n User ID n Last Load Time n Birthday n Name n Hometown n Rela;onship Status n Friend Count n Email n Link to user picture n Etc.
© 2011 Harris Corporation
/Library/Three20
¨ <fql_result> ¨ <name>event<name>
¤ Contains Event data
© 2011 Harris Corporation
/Library/Three20
¨ <stream_post> ¤ Contains “Wall” pos;ngs for a par;cular user in <source_id>
¤ Includes n Message n Client post came from (Web, TwiZer, etc.) n User comments that include who and when. n Links to photo aZachments n Link to permalink
¨ hZp://www.facebook.com/<uid>/posts/<post_id> ¤ <post_id> is aZached to the User ID by an underscore.
© 2011 Harris Corporation
/Library/Three20
¨ <photos_response> ¤ Contains links to photos, including descrip;ons, comments and user data.
¨ <profile_response><album ¤ Contains photo album informa;on.
© 2011 Harris Corporation
LinkedIn v.3.5.2
© 2011 Harris Corporation
com.linkedin.LinkedIn.plist
© 2011 Harris Corporation
“user” Field (com.linkedin.LinkedIn.plist)
© 2011 Harris Corporation
/Documents/connections_<memberid>.plist
© 2011 Harris Corporation
/Documents/LinkedIn/
© 2011 Harris Corporation
member_<memberid>.plist
© 2011 Harris Corporation
member_<memberid>.plist
© 2011 Harris Corporation
network_update_*
© 2011 Harris Corporation
LinkedIn<GUID>.sqlite
¨ ZBUZZTOPICOBJECT
© 2011 Harris Corporation
LinkedIn<GUID>.sqlite
¨ ZLIMESSAGE
© 2011 Harris Corporation
LinkedIn<GUID>.sqlite
¨ ZLIMESSAGEMEMBER
© 2011 Harris Corporation
/Library/Caches/Three20/
© 2011 Harris Corporation
SHOPPING & FINANCIAL
© 2011 Harris Corporation
Amazon v1.3
© 2011 Harris Corporation
com.amazon.Amazon.plist
© 2011 Harris Corporation
Chase v.2.8.1202
© 2011 Harris Corporation
User IDs
© 2011 Harris Corporation
Mint v1.7.2
© 2011 Harris Corporation
/Documents/mint_gala.db
© 2011 Harris Corporation
E*Trade v1.8.4
© 2011 Harris Corporation
User ID
© 2011 Harris Corporation
Ebay v2.0.2
© 2011 Harris Corporation
com.ebay.iphone.plist
© 2011 Harris Corporation
Paypal v3.1
© 2011 Harris Corporation
com.yourcompany.PPClient.plist
© 2011 Harris Corporation
/Documents/PayPalUserDetailsCache
© 2011 Harris Corporation
v3.84 & v4.01
PageOnce – Personal Finance
© 2011 Harris Corporation
Difference between v3.84 & 4.01
© 2011 Harris Corporation
Difference between v3.84 & 4.01
© 2011 Harris Corporation
GMAIL
© 2011 Harris Corporation
iGmail v5.6.8
© 2011 Harris Corporation
com.idemfactor.iGmail.plist
© 2011 Harris Corporation
/Library/WebKit/Databases/https_mail.google.com_0/0000000000000001.db
© 2011 Harris Corporation
MultiG v1.3
© 2011 Harris Corporation
/Documents/MultiG/People.sqlite
© 2011 Harris Corporation
UTILITIES
© 2011 Harris Corporation
TouchTerm v2.4.2
© 2011 Harris Corporation
net.jbrink.mobile.TouchTerm.plist
© 2011 Harris Corporation
“connec;ons” Field
© 2011 Harris Corporation
/Documents/pinchmedia/*.sql
© 2011 Harris Corporation
Anonymous Web Browser v2.0
© 2011 Harris Corporation
/Documents/Cookies.plist
© 2011 Harris Corporation
/Library/WebKit/LocalStorage/http_www.google.com_0.localstorage
© 2011 Harris Corporation
Quick Password Manager v2.2
© 2011 Harris Corporation
com.yourcompany.passwd.plist
© 2011 Harris Corporation
Passwords
© 2011 Harris Corporation
MobileRSS HD Free v3.0
© 2011 Harris Corporation
/Documents/<username>@gmail.com.sewng
© 2011 Harris Corporation
/Documents/<username>@gmail.com.sqlite
© 2011 Harris Corporation
com.nibirutech.MobileRSSHDFree.plist
© 2011 Harris Corporation
OpenTable v3.2
© 2011 Harris Corporation
com.contextop;onal.OpenTable.plist
© 2011 Harris Corporation
BLOGGING
© 2011 Harris Corporation
Tumblr v1.2.2
© 2011 Harris Corporation
/Documents/userData.mxdata
© 2011 Harris Corporation
Unencrypted Password
/Documents/textPost.details
© 2011 Harris Corporation
WordPress v2.6.4
© 2011 Harris Corporation
/Documents/wordpress/blogs.archive
© 2011 Harris Corporation
/Documents/wordpress/<blog>.wordpress.com/<blogid>/comment.1.archive
© 2011 Harris Corporation
/Documents/wordpress/<blog>.wordpress.com/<blogid>/post.1.archive
© 2011 Harris Corporation
org.wordpress.plist
© 2011 Harris Corporation
TRAVEL
© 2011 Harris Corporation
TripIt v2.2.1
© 2011 Harris Corporation
/Documents/TripIt.sqlite
© 2011 Harris Corporation
/Documents/TripIt.sqlite
© 2011 Harris Corporation
/Documents/TripIt.sqlite
© 2011 Harris Corporation
/Documents/TripIt.sqlite
© 2011 Harris Corporation
Navigon v1.7
© 2011 Harris Corporation
com.navigon.NavigonNorthAmerica.plist
¨ Program Preferences ¤ Audio ¤ Terrain ¤ POIs ¤ Speed Warnings ¤ Traffic ¤ Etc.
© 2011 Harris Corporation
/Library/Preferences/com.navigon.NavigonNorthAmerica.plist
© 2011 Harris Corporation
/Documents/LastSearchResult.dat
© 2011 Harris Corporation
/Documents/Favourite.targets
© 2011 Harris Corporation
/Documents/Recent.targets
© 2011 Harris Corporation
FourSquare v2.2.2
© 2011 Harris Corporation
/Documents/foursquare.sqlite
© 2011 Harris Corporation
/Documents/foursquare.sqlite
© 2011 Harris Corporation
DOCUMENTS & FILES
© 2011 Harris Corporation
Evernote v3.4.2
© 2011 Harris Corporation
com.evernote.iPhone.Evernote.plist
© 2011 Harris Corporation
Evernote2.sqlite.md
© 2011 Harris Corporation
Library/Caches/www.evernote.com
© 2011 Harris Corporation
applog.txt
© 2011 Harris Corporation
Evernote2.sqlite ZENSERVICEENTITY Table
© 2011 Harris Corporation
Evernote2.sqlite
© 2011 Harris Corporation
Dropbox v1.3.1
© 2011 Harris Corporation
/Documents/Dropbox.sqlite
© 2011 Harris Corporation
com.getdropbox.Dropbox.plist
© 2011 Harris Corporation
com.getdropbox.Dropbox.plist
¨ Content from “DefaultsAccountInfoKey” in bplist format, can be viewed by extracting into separate file – shown below.
© 2011 Harris Corporation
/Library/Caches/FavoriteFiles.plist
© 2011 Harris Corporation
/Library/Caches/cache.db
© 2011 Harris Corporation
/Library/Caches/cache.db
© 2011 Harris Corporation
/Library/Caches/cache.db
© 2011 Harris Corporation
/Library/Caches/cache.db
© 2011 Harris Corporation
Private Photo Lite v1.3
© 2011 Harris Corporation
/Documents/
© 2011 Harris Corporation
/Documents/photodb.sqlite
© 2011 Harris Corporation
cn.mmxd.privatephotoslite.plist
© 2011 Harris Corporation
© 2011 Harris Corporation
Echofon v3.1.8
© 2011 Harris Corporation
/Preferences/net.naan.TwiZerFon.plist
© 2011 Harris Corporation
db3.1.5.db
¨ “users” Table ¤ Contains user details:
n TwiZer User ID n Name & Screen Name n User entered loca;on, descrip;on and website. n Count of followers/friends/favorites/tweets n Is the account protected or verified? n Link to profile icon (hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg)
© 2011 Harris Corporation
/Library/profile_images ¨ hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg
© 2011 Harris Corporation
db3.1.5.db
¨ hZp://twiZer.com/statuses/user_;meline/105533433.rss
© 2011 Harris Corporation
db3.1.5.db
© 2011 Harris Corporation
db3.1.5.db
¨ “direct_messages” Table ¤ Contains direct messages.
n To & From (TwiZer IDs and Screen Names)
n Dates
© 2011 Harris Corporation
Library/Cookies/Cookies.plist
© 2011 Harris Corporation
HootSuite v2.0.2
© 2011 Harris Corporation
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
Twitteriffic v3.0.2
© 2011 Harris Corporation
/Documents/accounts.plist
© 2011 Harris Corporation
Timeline
© 2011 Harris Corporation
/Documents/searches.plist
© 2011 Harris Corporation
Search Databases
© 2011 Harris Corporation
Tweetdeck v1.4.1
© 2011 Harris Corporation
/Documents/tddb.0.2.sqlite3
© 2011 Harris Corporation
/Documents/column_cache_1
© 2011 Harris Corporation
/Documents/tddb.0.2.sqlite3
© 2011 Harris Corporation
COMMUNICATION
© 2011 Harris Corporation
Skype v3.0
© 2011 Harris Corporation
/Library/Preferences/com.skype.skype.plist
© 2011 Harris Corporation
Skype Logs
© 2011 Harris Corporation
Skype Logs
© 2011 Harris Corporation
Skype Logs
© 2011 Harris Corporation
Skype Logs
© 2011 Harris Corporation
Skype Logs (Windows)
¨ Skype Parsing Software ¤ SkypeLogView ¤ Nirsoft
n Available at: nirsoft.net/utils/skype_log_view.html n Free!
¤ Skype Parser n Redwolf Computer Forensics n Available at: redwolfcomputerforensics.com/downloads/
skype-log-installer-1.7.exe
© 2011 Harris Corporation
AIM (Free) v4.5.2
© 2011 Harris Corporation
com.aol.aim.plist
© 2011 Harris Corporation
/Documents/userAccounts/<GUID>.account
© 2011 Harris Corporation
/Documents/userAccounts/<GUID>.buddylist
© 2011 Harris Corporation
/Documents/userAccounts/<GUID>.history
© 2011 Harris Corporation
WRAPPING UP
© 2011 Harris Corporation