Shmoocon 2011 - Inside the App: All Your Data are Belong to Me

About Me

¨  Digital Forensic Analyst with Harris Corporation ¨  Computer Intrusions

¤ Free time is used for iOS/Mac forensic research.

¨  Works with the Feds ¤  I don’t like wearing suits.

¨  Not a hacker. ¤  I don’t code/hack/exploit things. ¤ But I do like to get into things, I’m nosy.

Objec;ves

¨  iOS Applica;on Security Awareness ¤  Inves;gators ¤ Users ¤ Developers ¤ Bad Guys?

¨  What about Android/Blackberry/Windows?

Objec;ves

¨  If you sit through this, you’ll get: ¤ Contacts ¤ Pictures ¤ Documents ¤ Usernames ¤ Passwords ¤ Loca;onal Data ¤ …much more.

¨  It is so easy, almost too easy.

iOS Apps

¨  Prevalence ¤  iPhone ¤  iPad ¤  iPod Touch

¨  How many Apps? ¤ 10 Billion downloads ¤ ~350,000 Apps

n  [hZp://www.buzzbiznews.com/035133/apple’s-‐app-‐store-‐hits-‐10-‐billion-‐downloads/]

Recent News

¨  viaForensics [viaforensics.com] ¤ appWatchDog

¨  Wall Street Journal ¤ Current privacy lawsuit ¤ Data at Rest vs. Data in Transit

¨  People vs. Diaz (California Supreme Court) ¤ Gist: Pursuant to arrest, officials can review your cellphone.

Caveats

¨  Third-party applications only. ¨  Redaction…this is a privacy talk after all. ¨  Lots of pictures ¨  Software Verification and Validation ¨  Evidence Admissibility ¨  Detailed acquisition techniques

ACCESSING THE DATA

State of Forensic Socware

¨  There are many tools. ¨  Some are better than others. ¨  Some get only logical data. ¨  Some require the passcode. ¨  Most are expensive. ¨  Most do not auto-magically parse 3rd party

application data. ¨  Proprietary data output formats.

Backups vs. Physical vs. Logical

Backups

•  Easy Access •  Historical

Context •  Encryption •  Must have HDD •  Limited Data

Physical

•  Difficult to capture

•  Up-to-date •  Access to

physical device •  Potential to get

EVERYTHING •  Encryption

Logical

•  Easy Access •  Up-to-date •  Access to

physical device •  Limited to

logical data

Backup Data Loca;ons

¨  Windows ¤ <APPDATA>\Apple Computer\MobileSync\Backup\

¤ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup

¨  Mac ¤ ~/Library/Application Support/MobileSync/Backup/

Backup Files (iOS 3.x)

¨  mddata ¨  mdinfo ¨  Info.plist ¨  Manifest.plist ¨  Status.plist

Backup Files (iOS 4.x)

¨  Info.plist ¨  Manifest.mbdb ¨  Manifest.mbdx ¨  Manifest.plist ¨  Status.plist

Socware for Backups

•  iPhone Backup Extractor –  Mac only –  Available at supercrazyawesome.com –  Free! (Donations are welcome.)

Socware for Backups

¨  iPhone Backup Extractor ¤ Windows, Linux & Mac ¤ Available at:

n  iphonebackupextractor.com ¤ Free & Paid Versions

Socware for Backups

¨  iBackupBot ¤ Windows Only ¤ Available at:

n  icopybot.com ¤ Free Trial ($35)

Socware to Access Physical Device

¨  Forensic Socware ¨  Jailbreak

¤ SSH/DD/SCP

¨  "Zdziarski" Method ¤ NIST Approved ¤ LE/Military Only

¨  Commercial Non-‐Forensic Socware ¤ PhoneDisk ¤ PhoneView

¨  PhoneDisk ¤ Mac & Windows ¤ Available at: macroplant.com/phonedisk/ ¤ $20

¨  PhoneView ¤ Mac ¤ Available at: ecamm.com/mac/phoneview/ ¤ $20

Applica;on Directories

¨  /private/var/mobile/Application (Actual Path, linked to /User/Application)

¨  /User/Applications/########-####-####-####-############

¤  Universally Unique ID

¨  <Application_Home>/AppName.app – Applica;on Bundle (Not Backed Up)

¨  <Application_Home>/Documents/ -‐ Contains user documents and data files. (Backed Up)

¨  <Application_Home>/Library/ -‐ Contains applica;on specific files. (Backed Up)

¨  <Application_Home>/Library/Preferences – Applica;on Preference Files (Backed Up)

¨  <Application_Home>/Library/Caches – Applica;on specific support files. Persistent between applica;on launches. (Not Backed Up)

¨  <Application_Home>/tmp/ -‐ Temporary files, not persistent between applica;on launches. (Not Backed Up)

/User/Applica;ons Directory

Applica;on Directory

iTunesMetadata.plist

¨  Contains informa;on such as: ¤ Product Informa;on ¤ Purchase Data ¤ Apple Account Data

iTunesMetadata.plist

GOOD THINGS TO KNOW

¨  Many use Absolute Time ¤ Seconds from 1/1/2001 00:00:00 GMT

¨  Tools: ¤ Mac: CFAbsoluteTimeConverter

n  (hsoi.com/hsoishop/socware/) ¤ Windows: Dcode

n  (digital-‐detec;ve.co.uk/freetools/decode.asp)

¨  …or add 978307200 and use date -ur

Popular File Formats -‐ Plist

¨  Property List ¤  XML or Binary

¨  Tools ¤  Property List Editor

n Mac Only n  Xcode n  Free! (w/ Mac OS)

¤  Ibackupbot Plist Editor n Windows Only n  icopybot.com/download.htm n  Free!

Popular File Formats -‐ SQLite

¨  SQL-‐based rela;onal database ¨  Tools ¤  SQLite Database Browser

n Mac & Windows n  sqlitebrowser.sourceforge.net n Free!

NOW TO THE GOOD STUFF…

SOCIAL NETWORKING

Facebook v.3.3.3

/Documents/friends.db

Facebook Profile

¨  hZp://www.facebook.com/profile.php?id=<UID>

User Picture (pic_square)

com.facebook.Facebook.plist

/Library/Three20

¨  May contain: ¤ Profile Icons ¤ XML Text Files ¤ Album Photos ¤ Miscellaneous Pictures

/Library/Three20

¨  <fql_result> ¨  <name>checkins_activity<name>

¤ Contains User IDs & coordinates ¤ Lots of other data

/Library/Three20

¨  <profile_response><user ¤ Contains profile data.

n User ID n  Last Load Time n Birthday n Name n Hometown n Rela;onship Status n  Friend Count n  Email n  Link to user picture n  Etc.

/Library/Three20

¨  <fql_result> ¨  <name>event<name>

¤ Contains Event data

/Library/Three20

¨  <stream_post> ¤  Contains “Wall” pos;ngs for a par;cular user in <source_id>

¤  Includes n Message n  Client post came from (Web, TwiZer, etc.) n  User comments that include who and when. n  Links to photo aZachments n  Link to permalink

¨  hZp://www.facebook.com/<uid>/posts/<post_id> ¤ <post_id> is aZached to the User ID by an underscore.

/Library/Three20

¨  <photos_response> ¤ Contains links to photos, including descrip;ons, comments and user data.

¨  <profile_response><album ¤ Contains photo album informa;on.

LinkedIn v.3.5.2

com.linkedin.LinkedIn.plist

“user” Field (com.linkedin.LinkedIn.plist)

/Documents/connections_<memberid>.plist

/Documents/LinkedIn/

member_<memberid>.plist

network_update_*

LinkedIn<GUID>.sqlite

¨  ZBUZZTOPICOBJECT

¨  ZLIMESSAGE

¨  ZLIMESSAGEMEMBER

/Library/Caches/Three20/

SHOPPING & FINANCIAL

Amazon v1.3

com.amazon.Amazon.plist

Chase v.2.8.1202

User IDs

Mint v1.7.2

/Documents/mint_gala.db

E*Trade v1.8.4

User ID

Ebay v2.0.2

com.ebay.iphone.plist

Paypal v3.1

com.yourcompany.PPClient.plist

/Documents/PayPalUserDetailsCache

v3.84 & v4.01

PageOnce – Personal Finance

Difference between v3.84 & 4.01

iGmail v5.6.8

com.idemfactor.iGmail.plist

/Library/WebKit/Databases/https_mail.google.com_0/0000000000000001.db

MultiG v1.3

/Documents/MultiG/People.sqlite

UTILITIES

TouchTerm v2.4.2

net.jbrink.mobile.TouchTerm.plist

“connec;ons” Field

/Documents/pinchmedia/*.sql

Anonymous Web Browser v2.0

/Documents/Cookies.plist

/Library/WebKit/LocalStorage/http_www.google.com_0.localstorage

Quick Password Manager v2.2

com.yourcompany.passwd.plist

Passwords

MobileRSS HD Free v3.0

/Documents/<username>@gmail.com.sewng

/Documents/<username>@gmail.com.sqlite

com.nibirutech.MobileRSSHDFree.plist

OpenTable v3.2

com.contextop;onal.OpenTable.plist

BLOGGING

Tumblr v1.2.2

/Documents/userData.mxdata

Unencrypted Password

/Documents/textPost.details

WordPress v2.6.4

/Documents/wordpress/blogs.archive

/Documents/wordpress/<blog>.wordpress.com/<blogid>/comment.1.archive

/Documents/wordpress/<blog>.wordpress.com/<blogid>/post.1.archive

org.wordpress.plist

TRAVEL

TripIt v2.2.1

/Documents/TripIt.sqlite

Navigon v1.7

com.navigon.NavigonNorthAmerica.plist

¨  Program Preferences ¤ Audio ¤ Terrain ¤ POIs ¤ Speed Warnings ¤ Traffic ¤ Etc.

/Library/Preferences/com.navigon.NavigonNorthAmerica.plist

/Documents/LastSearchResult.dat

/Documents/Favourite.targets

/Documents/Recent.targets

FourSquare v2.2.2

/Documents/foursquare.sqlite

DOCUMENTS & FILES

Evernote v3.4.2

com.evernote.iPhone.Evernote.plist

Evernote2.sqlite.md

Library/Caches/www.evernote.com

applog.txt

Evernote2.sqlite ZENSERVICEENTITY Table

Evernote2.sqlite

Dropbox v1.3.1

/Documents/Dropbox.sqlite

com.getdropbox.Dropbox.plist

¨  Content from “DefaultsAccountInfoKey” in bplist format, can be viewed by extracting into separate file – shown below.

/Library/Caches/FavoriteFiles.plist

/Library/Caches/cache.db

Private Photo Lite v1.3

/Documents/

/Documents/photodb.sqlite

cn.mmxd.privatephotoslite.plist

TWITTER

Echofon v3.1.8

/Preferences/net.naan.TwiZerFon.plist

db3.1.5.db

¨  “users” Table ¤  Contains user details:

n  TwiZer User ID n  Name & Screen Name n  User entered loca;on, descrip;on and website. n  Count of followers/friends/favorites/tweets n  Is the account protected or verified? n  Link to profile icon (hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg)

/Library/profile_images ¨  hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg

db3.1.5.db

¨  hZp://twiZer.com/statuses/user_;meline/105533433.rss

db3.1.5.db

¨  “direct_messages” Table ¤  Contains direct messages.

n  To & From (TwiZer IDs and Screen Names)

n  Dates

Library/Cookies/Cookies.plist

HootSuite v2.0.2

com.hootsuite.hootsuitelite.plist

Twitteriffic v3.0.2

/Documents/accounts.plist

Timeline

/Documents/searches.plist

Search Databases

Tweetdeck v1.4.1

/Documents/tddb.0.2.sqlite3

/Documents/column_cache_1

/Documents/tddb.0.2.sqlite3

COMMUNICATION

Skype v3.0

/Library/Preferences/com.skype.skype.plist

Skype Logs

Skype Logs (Windows)

¨  Skype Parsing Software ¤ SkypeLogView ¤ Nirsoft

n Available at: nirsoft.net/utils/skype_log_view.html n Free!

¤ Skype Parser n Redwolf Computer Forensics n Available at: redwolfcomputerforensics.com/downloads/

skype-log-installer-1.7.exe

AIM (Free) v4.5.2

com.aol.aim.plist

/Documents/userAccounts/<GUID>.account

/Documents/userAccounts/<GUID>.buddylist

/Documents/userAccounts/<GUID>.history

WRAPPING UP

Shmoocon 2011 - Inside the App: All Your Data are Belong to Me

Documents

Unit2 Fruitful Questions. Who Doesn’t Belong? What Doesn’t Belong?

Jew Belong

ShmooCON 2009 : Re-playing with (Blind) SQL Injection

Do you belong?

Attacking WCF Web Services-Holyfield-Shmoocon 2010

Shmoocon ERNW Attacking Mobile Telecommunication Networks Ger

Need to belong

I BELONG TO YOU I BELONG TO YOU By: Parachute Band

Adams ShmooCon Hack the Genome

I Belong, You Belong, We Belongbrowardedfoundation.org/wp-content/uploads/2015/01/... · I Belong, You Belong, We Belong . For information concerning IMPACT II opportunities, such

Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon 2015 Presentation

ShmooCon 2009 - (Re)Playing(Blind)Sql

How I “Earned” (Another) ShmooCon Barcode · 2019. 8. 14. · ShmooCon Slack Reddit LinkedIn GitHub Twitter Reddit YouTube Google Search for “#ShmooSecretSharing

Attacker Ghost Stories - ShmooCon 2014

I BELONG. YOU BELONG. WE BELONG · I BELONG. YOU BELONG. WE BELONG The theme for Catholic Schools Week gives us the chance to celebrate the sense of belonging we are building as we

Shmoocon - Beyond Nymwars

Believe and Belong

ShmooCon X Badge Contest - Darth Null · ShmooCon X Badge Contest Darth Null ... • Hex at the bottom — but it’s not ASCII • “EVEN MOOSE KNOW EBCDIC. EBCDIC.”

ShmooCon 8 Badge Puzzle - Darth Null · 2017. 8. 5. · ShmooCon 8 Badge Puzzle Darth Null, January 2012 I like crypto puzzles I’ve always liked puzzles. I used to do a lot of GeoCaching,

xbits mrash shmoocon · 2015. 7. 8. · Title: xbits_mrash_shmoocon Created Date: 1/16/2014 4:09:39 AM