Shmoocon 2011 - Inside the App: All Your Data are Belong to Me

INSIDE THE APP: ALL YOUR DATA ARE BELONG TO ME Sarah Edwards [email protected], @iamevltwin Shmoocon – January 2011 © 2011 Harris Corporation

About Me

¨  Digital Forensic Analyst with Harris Corporation ¨  Computer Intrusions

¤ Free time is used for iOS/Mac forensic research.

¨  Works with the Feds ¤  I don’t like wearing suits.

¨  Not a hacker. ¤  I don’t code/hack/exploit things. ¤ But I do like to get into things, I’m nosy.

© 2011 Harris Corporation

Objec;ves

¨  iOS Applica;on Security Awareness ¤  Inves;gators ¤ Users ¤ Developers ¤ Bad Guys?

¨  What about Android/Blackberry/Windows?


Objec;ves

¨  If you sit through this, you’ll get: ¤ Contacts ¤ Pictures ¤ Documents ¤ Usernames ¤ Passwords ¤ Loca;onal Data ¤ …much more.

¨  It is so easy, almost too easy.


iOS Apps

¨  Prevalence ¤  iPhone ¤  iPad ¤  iPod Touch

¨  How many Apps? ¤ 10 Billion downloads ¤ ~350,000 Apps

n  [hZp://www.buzzbiznews.com/035133/apple’s-‐app-‐store-‐hits-‐10-‐billion-‐downloads/]


Recent News

¨  viaForensics [viaforensics.com] ¤ appWatchDog

¨  Wall Street Journal ¤ Current privacy lawsuit ¤ Data at Rest vs. Data in Transit

¨  People vs. Diaz (California Supreme Court) ¤ Gist: Pursuant to arrest, officials can review your cellphone.


Caveats

¨  Third-party applications only. ¨  Redaction…this is a privacy talk after all. ¨  Lots of pictures ¨  Software Verification and Validation ¨  Evidence Admissibility ¨  Detailed acquisition techniques


ACCESSING THE DATA


State of Forensic Socware


¨  There are many tools. ¨  Some are better than others. ¨  Some get only logical data. ¨  Some require the passcode. ¨  Most are expensive. ¨  Most do not auto-magically parse 3rd party

application data. ¨  Proprietary data output formats.

Backups vs. Physical vs. Logical

Backups

•  Easy Access •  Historical

Context •  Encryption •  Must have HDD •  Limited Data

Physical

•  Difficult to capture

•  Up-to-date •  Access to

physical device •  Potential to get

EVERYTHING •  Encryption

Logical

•  Easy Access •  Up-to-date •  Access to

physical device •  Limited to

logical data


Backup Data Loca;ons

¨  Windows ¤ <APPDATA>\Apple Computer\MobileSync\Backup\

¤ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup

¨  Mac ¤ ~/Library/Application Support/MobileSync/Backup/


Backup Files (iOS 3.x)

¨  mddata ¨  mdinfo ¨  Info.plist ¨  Manifest.plist ¨  Status.plist


Backup Files (iOS 4.x)

¨  Info.plist ¨  Manifest.mbdb ¨  Manifest.mbdx ¨  Manifest.plist ¨  Status.plist


Socware for Backups

•  iPhone Backup Extractor –  Mac only –  Available at supercrazyawesome.com –  Free! (Donations are welcome.)


Socware for Backups

¨  iPhone Backup Extractor ¤ Windows, Linux & Mac ¤ Available at:

n  iphonebackupextractor.com ¤ Free & Paid Versions


Socware for Backups

¨  iBackupBot ¤ Windows Only ¤ Available at:

n  icopybot.com ¤ Free Trial ($35)


Socware to Access Physical Device

¨  Forensic Socware ¨  Jailbreak

¤ SSH/DD/SCP

¨  "Zdziarski" Method ¤ NIST Approved ¤ LE/Military Only

¨  Commercial Non-‐Forensic Socware ¤ PhoneDisk ¤ PhoneView



¨  PhoneDisk ¤ Mac & Windows ¤ Available at: macroplant.com/phonedisk/ ¤ $20



¨  PhoneView ¤ Mac ¤ Available at: ecamm.com/mac/phoneview/ ¤ $20


Applica;on Directories

¨  /private/var/mobile/Application (Actual Path, linked to /User/Application)

¨  /User/Applications/########-####-####-####-############

¤  Universally Unique ID

¨  <Application_Home>/AppName.app – Applica;on Bundle (Not Backed Up)

¨  <Application_Home>/Documents/ -‐ Contains user documents and data files. (Backed Up)

¨  <Application_Home>/Library/ -‐ Contains applica;on specific files. (Backed Up)

¨  <Application_Home>/Library/Preferences – Applica;on Preference Files (Backed Up)

¨  <Application_Home>/Library/Caches – Applica;on specific support files. Persistent between applica;on launches. (Not Backed Up)

¨  <Application_Home>/tmp/ -‐ Temporary files, not persistent between applica;on launches. (Not Backed Up)


/User/Applica;ons Directory


Applica;on Directory


iTunesMetadata.plist

¨  Contains informa;on such as: ¤ Product Informa;on ¤ Purchase Data ¤ Apple Account Data


iTunesMetadata.plist


GOOD THINGS TO KNOW


Dates

¨  Many use Absolute Time ¤ Seconds from 1/1/2001 00:00:00 GMT

¨  Tools: ¤ Mac: CFAbsoluteTimeConverter

n  (hsoi.com/hsoishop/socware/) ¤ Windows: Dcode

n  (digital-‐detec;ve.co.uk/freetools/decode.asp)

¨  …or add 978307200 and use date -ur


Popular File Formats -‐ Plist

¨  Property List ¤  XML or Binary

¨  Tools ¤  Property List Editor

n Mac Only n  Xcode n  Free! (w/ Mac OS)

¤  Ibackupbot Plist Editor n Windows Only n  icopybot.com/download.htm n  Free!


Popular File Formats -‐ SQLite

¨  SQL-‐based rela;onal database ¨  Tools ¤  SQLite Database Browser

n Mac & Windows n  sqlitebrowser.sourceforge.net n Free!


NOW TO THE GOOD STUFF…


SOCIAL NETWORKING


Facebook v.3.3.3


/Documents/friends.db


Facebook Profile

¨  hZp://www.facebook.com/profile.php?id=<UID>


User Picture (pic_square)


com.facebook.Facebook.plist


/Library/Three20


¨  May contain: ¤ Profile Icons ¤ XML Text Files ¤ Album Photos ¤ Miscellaneous Pictures

/Library/Three20

¨  <fql_result> ¨  <name>checkins_activity<name>

¤ Contains User IDs & coordinates ¤ Lots of other data


/Library/Three20

¨  <profile_response><user ¤ Contains profile data.

n User ID n  Last Load Time n Birthday n Name n Hometown n Rela;onship Status n  Friend Count n  Email n  Link to user picture n  Etc.


/Library/Three20

¨  <fql_result> ¨  <name>event<name>

¤ Contains Event data


/Library/Three20

¨  <stream_post> ¤  Contains “Wall” pos;ngs for a par;cular user in <source_id>

¤  Includes n Message n  Client post came from (Web, TwiZer, etc.) n  User comments that include who and when. n  Links to photo aZachments n  Link to permalink

¨  hZp://www.facebook.com/<uid>/posts/<post_id> ¤ <post_id> is aZached to the User ID by an underscore.


/Library/Three20

¨  <photos_response> ¤ Contains links to photos, including descrip;ons, comments and user data.

¨  <profile_response><album ¤ Contains photo album informa;on.


LinkedIn v.3.5.2


com.linkedin.LinkedIn.plist


“user” Field (com.linkedin.LinkedIn.plist)


/Documents/connections_<memberid>.plist


/Documents/LinkedIn/


member_<memberid>.plist


member_<memberid>.plist


network_update_*


LinkedIn<GUID>.sqlite

¨  ZBUZZTOPICOBJECT



¨  ZLIMESSAGE



¨  ZLIMESSAGEMEMBER


/Library/Caches/Three20/


SHOPPING & FINANCIAL


Amazon v1.3


com.amazon.Amazon.plist


Chase v.2.8.1202


User IDs


Mint v1.7.2


/Documents/mint_gala.db


E*Trade v1.8.4


User ID


Ebay v2.0.2


com.ebay.iphone.plist


Paypal v3.1


com.yourcompany.PPClient.plist


/Documents/PayPalUserDetailsCache


v3.84 & v4.01

PageOnce – Personal Finance


Difference between v3.84 & 4.01


Difference between v3.84 & 4.01


GMAIL


iGmail v5.6.8


com.idemfactor.iGmail.plist


/Library/WebKit/Databases/https_mail.google.com_0/0000000000000001.db


MultiG v1.3


/Documents/MultiG/People.sqlite


UTILITIES


TouchTerm v2.4.2


net.jbrink.mobile.TouchTerm.plist


“connec;ons” Field


/Documents/pinchmedia/*.sql


Anonymous Web Browser v2.0


/Documents/Cookies.plist


/Library/WebKit/LocalStorage/http_www.google.com_0.localstorage


Quick Password Manager v2.2


com.yourcompany.passwd.plist


Passwords


MobileRSS HD Free v3.0


/Documents/<username>@gmail.com.sewng


/Documents/<username>@gmail.com.sqlite


com.nibirutech.MobileRSSHDFree.plist


OpenTable v3.2


com.contextop;onal.OpenTable.plist


BLOGGING


Tumblr v1.2.2


/Documents/userData.mxdata


Unencrypted Password

Email

/Documents/textPost.details


WordPress v2.6.4


/Documents/wordpress/blogs.archive


/Documents/wordpress/<blog>.wordpress.com/<blogid>/comment.1.archive


/Documents/wordpress/<blog>.wordpress.com/<blogid>/post.1.archive


org.wordpress.plist


TRAVEL


TripIt v2.2.1


/Documents/TripIt.sqlite








Navigon v1.7


com.navigon.NavigonNorthAmerica.plist

¨  Program Preferences ¤ Audio ¤ Terrain ¤ POIs ¤ Speed Warnings ¤ Traffic ¤ Etc.


/Library/Preferences/com.navigon.NavigonNorthAmerica.plist


/Documents/LastSearchResult.dat


/Documents/Favourite.targets


/Documents/Recent.targets


FourSquare v2.2.2


/Documents/foursquare.sqlite


/Documents/foursquare.sqlite


DOCUMENTS & FILES


Evernote v3.4.2


com.evernote.iPhone.Evernote.plist


Evernote2.sqlite.md


Library/Caches/www.evernote.com


applog.txt


Evernote2.sqlite ZENSERVICEENTITY Table


Evernote2.sqlite


Dropbox v1.3.1


/Documents/Dropbox.sqlite


com.getdropbox.Dropbox.plist


com.getdropbox.Dropbox.plist

¨  Content from “DefaultsAccountInfoKey” in bplist format, can be viewed by extracting into separate file – shown below.


/Library/Caches/FavoriteFiles.plist


/Library/Caches/cache.db








Private Photo Lite v1.3


/Documents/


/Documents/photodb.sqlite


cn.mmxd.privatephotoslite.plist


TWITTER


Echofon v3.1.8


/Preferences/net.naan.TwiZerFon.plist


db3.1.5.db

¨  “users” Table ¤  Contains user details:

n  TwiZer User ID n  Name & Screen Name n  User entered loca;on, descrip;on and website. n  Count of followers/friends/favorites/tweets n  Is the account protected or verified? n  Link to profile icon (hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg)


/Library/profile_images ¨  hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg


db3.1.5.db

¨  hZp://twiZer.com/statuses/user_;meline/105533433.rss


db3.1.5.db


db3.1.5.db

¨  “direct_messages” Table ¤  Contains direct messages.

n  To & From (TwiZer IDs and Screen Names)

n  Dates


Library/Cookies/Cookies.plist


HootSuite v2.0.2


com.hootsuite.hootsuitelite.plist






Twitteriffic v3.0.2


/Documents/accounts.plist


Timeline


/Documents/searches.plist


Search Databases


Tweetdeck v1.4.1


/Documents/tddb.0.2.sqlite3


/Documents/column_cache_1


/Documents/tddb.0.2.sqlite3


COMMUNICATION


Skype v3.0


/Library/Preferences/com.skype.skype.plist


Skype Logs


Skype Logs


Skype Logs


Skype Logs


Skype Logs (Windows)

¨  Skype Parsing Software ¤ SkypeLogView ¤ Nirsoft

n Available at: nirsoft.net/utils/skype_log_view.html n Free!

¤ Skype Parser n Redwolf Computer Forensics n Available at: redwolfcomputerforensics.com/downloads/

skype-log-installer-1.7.exe


AIM (Free) v4.5.2


com.aol.aim.plist


/Documents/userAccounts/<GUID>.account


/Documents/userAccounts/<GUID>.buddylist


/Documents/userAccounts/<GUID>.history


WRAPPING UP
