Instructor: Mobile Forensics. 2 2
Now, you may be wondering, 3 3
Why am I bringing up mobile technologies and forensics 4 4
inside of this section of the course when we're talking 5 5
about application related indicators of compromise? 6 6
Well, the reason is a lot of our applications these days 7 7
are being run on mobile devices, 8 8
and these mobile devices can be a vector 9 9
or a target for many of our incidents, 10 10
especially in an enterprise environment. 11 11
Another issue we have to consider here 12 12
when we're dealing with mobile devices 13 13
is the fact that many of them connect 14 14
to our corporate networks. 15 15
For example, if you use a VPN to connect your mobile device 16 16
back into your corporate network 17 17
and there's something wrong on your mobile device 18 18
that was already attacked, 19 19
you can now bring that into the corporate network as well. 20 20
And so this can actually lead to cases 21 21
where we have to conduct forensics 22 22
on your endpoint, your mobile device, 23 23
to find out exactly what the intrusion vector was. 24 24
Now, as we go through this section 25 25
we're going to talk about a couple of key areas. 26 26
We're going to talk about data collection, 27 27
extraction and analysis methods, 28 28
forensic software, and carrier logs, 29 29
and how we're going to relate all of these 30 30
to mobile device forensics. 31 31
First, let's talk about data collection. 32 32
We're going to have to have tools that facilitate the imaging 33 33
of a mobile device's system memory, the RAM inside of it, 34 34
as well as the flash memory that's used 35 35
for persistent storage that acts as its hard drive. 36 36
Even though mobile devices don't have hard drives 37 37
they have solid state devices, 38 38
this is really that flash memory we're talking about. 39 39
Now, how are we going to collect that information? 40 40
Because the data is stored on flash memory chips 41 41
that are soldered to the system board. 42 42
So it's not as easy as going into a laptop 43 43
and removing a hard drive. 44 44
We have this soldered on memory chip, 45 45
and that becomes really difficult for us to work with. 46 46
Yes, it's true that if we're dealing 47 47
with a law enforcement effort, 48 48
we can have experts who know how to desolder these boards 49 49
and collect them bit by bit using off-chip methods, 50 50
but for most of us, we are not going to have that capability. 51 51
And so instead, we're going to have to hook up these devices 52 52
and use something like a debugging port 53 53
or a joint test action group hardware interface 54 54
that allow us to get the information off of those devices. 55 55
Now, all modern iOS and Android devices 56 56
also have encryption enabled by default 57 57
for these solid state devices. 58 58
So the data on them is going to be encrypted. 59 59
So we better have a way to decrypt them as well. 60 60
The easiest way is if we have the password 61 61
or the user unlocks the device for us. 62 62
If we're working with somebody in our organization 63 63
that's cooperative as part of our investigation, 64 64
that will likely happen. 65 65
But if we're dealing with a law enforcement action, 66 66
again, that's unlikely to happen, 67 67
and we're going to have to use other methods 68 68
including something like a zero-day exploit 69 69
to get into that device. 70 70
Now, one other area that I want to bring up real quick 71 71
is if you're working for law enforcement 72 72
and you're worried about that device being remotely wiped, 73 73
you do want to collect your devices 74 74
and put them in a Faraday bag. 75 75
A Faraday bag is simply a device that allows you 76 76
putting your smartphones or tablets into that, 77 77
and it blocks any radio frequency from getting into that. 78 78
So if I had a device, for instance, an iPhone, 79 79
and I place it in the bag and seal up the bag, 80 80
it won't let the cellular signal get in or out of that bag. 81 81
That way an attacker can't remotely send a kill command 82 82
or a wipe command to that device once I have it in custody. 83 83
Again, this is something 84 84
that all law enforcement is trained on, 85 85
and they use this as one of their standard procedures 86 86
to ensure nobody can affect that device 87 87
after they've collected it. 88 88
Now, there is one other area that we have to touch on, 89 89
and I know that I have students from all around the world, 90 90
but here in the United States, 91 91
we have something known as the Fifth Amendment. 92 92
Now in the United States, the Fifth Amendment means 93 93
that a suspect cannot be compelled 94 94
to give you access to their devices. 95 95
For example, if I have my smartphone, 96 96
and I have evidence on there that's incriminating to me, 97 97
and you ask me to unlock my smartphone 98 98
by using my thumbprint, or my face, or even my PIN number, 99 99
I don't have to do that if that would give you access 100 100
to incriminating evidence on my device. 101 101
That's part of the Fifth Amendment. 102 102
This has been upheld in courts time and time again. 103 103
This may not apply in your region of the world 104 104
if you're outside of the United States, 105 105
but this is a big area of concern 106 106
inside the United States and for U.S. companies, 107 107
especially if you're doing something 108 108
like a Bring Your Own Device Policy where you allow users 109 109
to bring their own devices onto your corporate network. 110 110
Once they do that, 111 111
that doesn't automatically give you a right 112 112
to go and search their devices. 113 113
That would be an unlawful search and seizure. 114 114
And so this is an area you have to be thinking about 115 115
as you're dealing with different devices. 116 116
And if you're working with law enforcement, remember, 117 117
there are rules against what you can and cannot do. 118 118
And one of those things is you can't take the device 119 119
and hold it up to somebody's face to unlock it, 120 120
because that would be a violation of the Fifth Amendment. 121 121
Now, let's go into our second area. 122 122
Let's assume that we've gotten into the device. 123 123
Now, we need to extract and analyze the data. 124 124
And we're going to use extraction 125 125
and analysis methods for this. 126 126
These are analysis techniques for mobile devices, 127 127
and many of them are very similar to what we talked about 128 128
with Windows and Linux workstations. 129 129
Since most of our mobile devices actually rely 130 130
on Unix-like operating systems. 131 131
If you're using iOS, which is what iPhones use 132 132
that is a Unix-based operating system. 133 133
If you're using Android, 134 134
it's a Linux-based operating system. 135 135
If you're using one of those older Windows mobile devices, 136 136
that relies on a Windows-based operating system. 137 137
So again, all three of these still have roots 138 138
in the Windows and Linux and Unix world, 139 139
and therefore, it's going to use a lot 140 140
of the same type of techniques that we used before. 141 141
As we begin our extraction, 142 142
there are four different ways we can do this. 143 143
The first is manual extraction. 144 144
This means we're going to take the device 145 145
and simply scroll through the settings and the app screens 146 146
to find the information we need. 147 147
So if I'm part of a law enforcement team 148 148
and I find a device sitting on a counter 149 149
and it's already unlocked, I can actually pick it up 150 150
and start looking through that, 151 151
looking through the contacts, the call logs, 152 152
previous areas they've looked at on maps, 153 153
or different addresses they've navigated to, 154 154
and collect that information. 155 155
Now, if you're doing this, 156 156
you should have somebody over your shoulder 157 157
filming a video showing everything you're doing. 158 158
This way you can prove 159 159
there are no changes being introduced. 160 160
For instance, you're not making phone calls 161 161
that could then later be put in there and saying, 162 162
"Oh, this bad person had made a phone call 163 163
to this drug dealer," 164 164
and you were really the one who made the call. 165 165
So you need to make sure none of that happens. 166 166
Second, we can move into logical extraction. 167 167
Now, logical extraction refers to using different utilities. 168 168
They're supplied by the device or the vendor 169 169
to extract the data for later analysis. 170 170
For example, if you have somebody who has an iPhone, 171 171
you can do a data backup to iCloud. 172 172
And then from iCloud, 173 173
you could get that information you needed. 174 174
This is one of the ways to do it. 175 175
It's an easy way to get the information off the device, 176 176
into another area for later analysis. 177 177
Again, if your device was encrypted, that key, 178 178
if you don't have it, you're not going to get into the data. 179 179
Even if you back it up to iCloud, 180 180
iCloud's going to require that key to unlock that data 181 181
'cause it's going to do an encrypted backup. 182 182
If you're using an Android device, for example, 183 183
you can also do logical extraction 184 184
over the device's debug interface, 185 185
which is known as ADB, the Android Debug Bridge. 186 186
This will allow you to retrieve data off the device as well. 187 187
The third way we can do things 188 188
is by doing a file system extraction. 189 189
Now, a file system extraction is where we're going to start 190 190
making a copy of all the unencrypted data, 191 191
just like we did when we did an image before 192 192
of a desktop or a laptop, and then we would go 193 193
into something like EnCase or FTK to analyze it. 194 194
Now, that will work for these devices, 195 195
but again, remember, they're not Windows or Linux. 196 196
They are Android and iOS, 197 197
and so there are special tools you may need. 198 198
A lot of the data that's stored on these devices is stored 199 199
inside of individual databases known as SQLite databases. 200 200
So if you download those, 201 201
that's not a file you can just easily open up 202 202
unless you have a specific tool to do that, 203 203
such as an SQL database browser 204 204
like you see here on the screen. 205 205
This will allow you to get the information out of that, 206 206
and a lot of these databases contain a lot of information, 207 207
such as logs and user-generated data. 208 208
All of that could be evidence in your investigation. 209 209
Our fourth method of extraction for mobile devices 210 210
is call data extraction. 211 211
Now, this is where you can use tools 212 212
to pull out information off of a SIM card. 213 213
This would give you things like outgoing calls, 214 214
text messages, and other things like that 215 215
that could be stored on that SIM card, 216 216
including their contacts. 217 217
All of this is data that could be possible evidence 218 218
in your investigation. 219 219
Now, the third main area we need to talk about 220 220
is mobile device forensic software. 221 221
As I said, lots of these devices are Unix-based 222 222
or Linux-based, but there are specific tools you can use 223 223
to collect this data a lot easier and then analyze it. 224 224
For example, Cellebrite is one of these tools. 225 225
This is a tool that's focused on evidence extraction 226 226
from smartphones and other mobile devices, 227 227
including older feature phones 228 228
and from cloud data and metadata 229 229
using a universal forensic extraction device, or UFED. 230 230
Now, what is a universal forensic extraction device? 231 231
Well, this is essentially a standalone device. 232 232
And you can just take the phone and plug it into it, 233 233
and this all in one device does all the hard work for you. 234 234
It does a forensically sound image, 235 235
and then allows you to analyze the data 236 236
from within this standalone workstation. 237 237
In addition to this, Cellebrite does sell a version 238 238
that is software-based that could be loaded onto a laptop, 239 239
but most people prefer to use the standalone solution. 240 240
Now, another tool you can use 241 241
is what's known as the Mobile Phone Examiner Plus, or MPE+. 242 242
This is a mobile device forensics tool 243 243
that's created by AccessData, 244 244
which is the developers of FTK. 245 245
Essentially, this is a tool that allows us 246 246
to do a lot of the features like FTK would, 247 247
but designed specifically for mobile phones. 248 248
Just like FTK has their version, EnCase has theirs. 249 249
And EnCase Portable is a mobile device forensic tool 250 250
created by Guidance Software, 251 251
the developers of EnCase, and again, 252 252
this is basically the mobile phone version of EnCase. 253 253
The fourth and final area we need to talk about 254 254
is carrier provided logs. 255 255
This is any records of device activity 256 256
that could be acquired 257 257
from the mobile device's cellular service provider 258 258
with the use of a warrant. 259 259
Now, this is really important because as a company, 260 260
we are not going to be able to do this, 261 261
but if you're working for law enforcement, you could. 262 262
As you go through, you're going to be able to find a lot 263 263
of information from these carriers 264 264
if you have the right warrant. 265 265
Now, one of the things to keep in mind here 266 266
is that a lot of the information 267 267
has a very short retention period. 268 268
For example, personal identifiable information, or PII, 269 269
has an extremely short retention period 270 270
due to different privacy laws. 271 271
And so if you're trying to go into an investigation 272 272
and ask for data from a year ago, 273 273
that company may not have it anymore. 274 274
Instead, you need to ask for things quickly 275 275
when you need it, using the appropriate warrants. 276 276
And again, this really only applies 277 277
to law enforcement professionals. 278 278
So what kind of information can you get 279 279
from carrier provided logs? 280 280
Well, you can get call details. 281 281
You can get voicemail details. 282 282
You can get text message, or SMS, details. 283 283
You can even get images sent over those text messages 284 284
using the MMS service. 285 285
You can get IP address destinations 286 286
of what they're trying to browse over the internet. 287 287
You can get session information, 288 288
and you can get geolocation data 289 289
such as where was that device, 290 290
at what time, and in what day. 291 291
This is all really important information that you can get 292 292
if you get it from your carrier provider. 293 293
But again, you are going to have to have a legal warrant 294 294
to be able to legally search and seize 295 295
that information from the carrier, 296 296
and they're not going to provide it to you 297 297
without that warrant.