ceic 2011 - ios application forensics

iOS Applica*on Forensics Sarah Edwards

[email protected] @iamevltwin

CEIC -‐ May 2011

© 2011 Harris Corporation

About Me �  Digital Forensic Analyst with Harris Corpora*on

�  Computer Intrusions

�  Free *me is used for iOS/Mac forensic research


Objec*ves �  If you sit through this, you’ll get:

�  Contacts �  Pictures �  Documents �  Usernames �  Passwords �  Loca*onal Data �  …much more.

�  It is so easy, almost too easy.

�  iOS Applica*on Security Awareness �  What about Android/Blackberry/Windows?


iOS Apps �  Prevalence

�  iPhone �  iPad �  iPod Touch

�  How many Apps? �  10 Billion downloads �  ~350,000 Apps

�  [hZp://www.buzzbiznews.com/035133/apple’s-‐app-‐store-‐hits-‐10-‐billion-‐downloads/]


Caveats �  Third-‐party applica*ons only. �  Redac*on…lots of personal informa*on in Apps.

�  Lots of pictures �  So^ware Verifica*on and Valida*on �  Evidence Admissibility

�  Detailed acquisi*on techniques �  Applica*ons Versions


ACCESSING THE DATA


State of Forensic So^ware �  There are many tools.

�  Some are beZer than others.

�  Some get only logical data.

�  Some require the passcode.

�  Most are expensive.

�  Most do not auto-‐magically parse 3rd party applica*on data.

�  Proprietary data formats


Backups vs. Physical vs. Logical


Backups

• Easy Access • Historical Context

• Encryp*on • Must have HDD • Limited Data

Physical

• Difficult to capture

• Up-‐to-‐date • Access to physical device

• Poten*al to get EVERYTHING

• Encryp*on

Logical

• Easy Access • Up-‐to-‐date • Access to physical device

• Limited to logical data

Backup Files


Backup File Loca*ons �  Windows

�  <APPDATA>\Apple Computer\MobileSync\Backup �  \Users\<user>\AppData\Roaming\Apple Computer

\MobileSync\Backup

�  Mac �  ~/Library/Applica*on Support/MobileSync/Backup/


Backup Files (iOS 4.x) �  Info.plist

�  Manifest.mbdb

�  Manifest.mbdx

�  Manifest.plist

�  Status.plist


Backup Files (iOS 4.x) – Info.plist �  Build Version �  Device Name �  Last Backup Date �  Serial Number �  Device Iden*fier �  Device Type �  iOS Version �  ICCID �  IMEI �  Phone Number �  List of applica*ons:

�  In Library �  Synced


Backup Files (iOS 4.x) – Manifest.plist

�  Contains applica*on versions.


Backup Files (iOS 4.x) �  Manifest.mbdb & Manifest.mbdx

�  Database files of the backup contents.

© 2011 Harris Corporation http://code.google.com/p/iphonebackupbrowser/wiki/MbdbMbdxFormat

Backup Files (iOS 3.x) �  *.mddata

�  *.mdinfo

�  Info.plist

�  Manifest.plist

�  Status.plist


Backup Files (iOS 3.x) �  *.mddata

�  *.mdinfo


So^ware for Backups •  iPhone Backup Extractor

–  Mac only –  Available at supercrazyawesome.com –  Free! (Dona*ons are welcome.)


So^ware for Backups �  iPhone Backup Extractor

�  Windows, Linux & Mac �  Available at:

�  iphonebackupextractor.com

�  Free & Paid Versions


So^ware for Backups �  iBackupBot

�  Windows Only �  Available at:

�  icopybot.com

�  Free Trial ($35)


So^ware to Access Physical Device �  Forensic So^ware �  Jailbreak

�  SSH/DD/SCP

�  "Zdziarski" Method �  NIST Approved �  LE/Military Only

�  Commercial Non-‐Forensic So^ware (For Research Purposes) �  PhoneDisk �  PhoneView


So^ware to Access Physical Device �  PhoneDisk

�  Mac & Windows �  Available at: macroplant.com/phonedisk/ �  $20


So^ware to Access Physical Device �  PhoneView

�  Mac �  Available at: ecamm.com/mac/phoneview/ �  $20


What am I looking at?


/User/Applica*ons Directory


Applica*on Directory


Applica*on Directories �  /private/var/mobile/Applica6on

�  (Actual Path, linked to /User/Applica6on)

�  /User/Applica6ons/########-‐####-‐####-‐####-‐############ �  Universally Unique ID

�  <Applica6on_Home>/AppName.app �  Applica*on Bundle (Not Backed Up)

�  <Applica6on_Home>/Documents/ �  Contains user documents and data files. (Backed Up)

�  <Applica6on_Home>/Library/ �  Contains applica*on specific files. (Backed Up)

�  <Applica6on_Home>/Library/Preferences �  Applica*on Preference Files (Backed Up)

�  <Applica6on_Home>/Library/Caches �  Applica*on specific support files. Persistent between applica*on launches. (Not Backed Up)

�  <Applica6on_Home>/tmp/ �  Temporary files, not persistent between applica*on launches. (Not Backed Up)


iTunesMetadata.plist �  Contains informa*on such as:

�  Product Informa*on �  Purchase Data �  Apple Account Data


iTunesMetadata.plist


hZp://itunes.apple.com/app/id321506742

/Library/Caches/Snapshots/ •  Might get lucky. •  This directory may

contain a screenshot of the screen when the device was screen locked.


Other System Files •  /var/mobile/Library/Caches/com.apple.mobile.installa5on.plist

•  Useful to map applica*on GUIDs to specific apps •  47328AE1-‐CB56-‐4FE4-‐8EEE-‐2A771109DC55 = com.aol.aim

•  Contains App Specific data

•  /var/mobile/Library/Preferences/com.apple.appstore.plist •  App Store – Last Search entry

•  /var/mobile/Library/Preferences/com.apple.loca5ond.plist •  List of Apps that use the Loca*on Services •  Binary seyng show if Loca*on Services are enabled

•  /var/mobile/Library/Preferences/com.apple.springboard.plist •  Contains the order of Applica*ons on each “screen”


com.apple.mobile.installa*on.plist


com.apple.appstore.plist


com.apple.loca*ond.plist


com.apple.springboard.plist


GOOD THINGS TO KNOW


Dates �  Many use Absolute Time

�  Seconds from 1/1/2001 00:00:00 GMT

�  Tools: �  Mac: CFAbsoluteTimeConverter

�  (hsoi.com/hsoishop/so^ware/) �  Windows: Dcode

�  (digital-‐detec*ve.co.uk/freetools/decode.asp) �  BlackBag’s Epoch Converter

�  (blackbagtech.com/resources/freetools/epochconverter.html)

�  …or add 978307200 and use date -ur


Blackbag’s Epoch Converter


Popular File Formats -‐ Plist �  Property List

�  XML or Binary

�  Tools �  Property List Editor

�  Mac Only �  Xcode �  Free! (w/ Mac OS)

�  Ibackupbot Plist Editor �  Windows Only �  icopybot.com/download.htm �  Free!


Popular File Formats -‐ SQLite �  SQL-‐based rela*onal database �  SQLite Database Browser �  Tools

�  Mac & Windows �  sqlitebrowser.sourceforge.net �  Free!


NOW TO THE GOOD STUFF…


SOCIAL NETWORKING


Facebook v.3.4


com.facebook.Facebook.plist


/Documents/friends.db


Facebook Profile �  hZp://www.facebook.com/profile.php?id=<UID>


User Picture (pic_square)


/Documents/analy*cs_buffer


/Library/Caches/Three20/ �  May contain:

�  Profile Icons �  XML Text Files �  Album Photos �  Miscellaneous Pictures


/Library/Caches/Three20/ �  <fql_result>

�  <name>checkins_ac*vity<name> �  Contains User IDs & coordinates �  Lots of other data


/Library/Caches/Three20/ �  <profile_response><user

�  Contains profile data. �  User ID �  Last Load Time �  Birthday �  Name �  Hometown �  Rela*onship Status �  Friend Count �  Email �  Link to user picture �  Etc.


/Library/Caches/Three20/ �  <fql_result>

�  <name>event<name> �  Contains Event data


/Library/Caches/Three20/ �  <stream_post>

�  Contains “Wall” pos*ngs for a par*cular user in <source_id>

�  Includes �  Message �  Client post came from (Web, TwiZer, etc.) �  User comments that include who and when. �  Links to photo aZachments �  Link to permalink

�  hZp://www.facebook.com/<uid>/posts/<post_id> �  <post_id> is aZached to the User ID by an underscore.


/Library/Caches/Three20/ �  <stream_post>


/Library/Caches/Three20/ �  <photos_response>

�  Contains links to photos, including descrip*ons, comments and user data.

�  <profile_response><album �  Contains photo album informa*on.


/Library/Caches/SDURLCache/ �  Another cache directory.

May contain: �  Javascript �  Pictures, complete with

origina*ng URL.


LinkedIn v.3.6


com.linkedin.LinkedIn.plist


“user” Field (com.linkedin.LinkedIn.plist)


/Documents/connec*ons_<memberid>.plist


/Documents/LinkedIn/


/Documents/LinkedIn/member_<memberid>.plist


/Documents/LinkedIn/network_update_*


/Documents/LinkedIn<GUID>.sqlite

�  ZBUZZTOPICOBJECT



�  ZLIMESSAGE



�  ZLIMESSAGEMEMBER


/Library/Caches/Three20/


SHOPPING & FINANCIAL


Amazon v1.4


com.amazon.Amazon.plist


Chase v.2.8.1202


User IDs


com.chase.plist

/Documents/localcache.dat

Mint v1.7.2


/Documents/mint_gala.db


“transaction_bankcc” Table

“account” Table

E*Trade v1.8.4


User ID


Ebay v2.1.1


com.ebay.iphone.plist


/Library/Caches/Seyngs/<userid>-‐X-‐0-‐user.cache

�  Contains User Informa*on �  Full Address �  Email Address �  Account Name �  Phone Number


Paypal v3.2


com.yourcompany.PPClient.plist


/Documents/PayPalUserDetailsCache


Street Address

Secure Merchant ID

PageOnce – Personal Finance v3.84 & v4.01


Difference between v3.84 & 4.01


Version 3.84

Difference between v3.84 & 4.01

© 2011 Harris Corporation Version 4.01

GOOGLE


iGmail v5.6.8


com.idemfactor.iGmail.plist


/Library/WebKit/Databases/hZps_mail.google.com_0/0000000000000001.db


Mul*G v1.3


/Documents/Mul*G/People.sqlite


La*tude v2.1.2


/Documents/loca*on.plist Library/Preferences/com.google.GoogleLa*tude.plist


CalenGoo v1.5.11


/Documents/gca.sqlite “DbProperty” Table


/Documents/gca.sqlite “Event” Table


/Documents/gca.sqlite “Times” Table


1305432000 = Sun May 15 00:00:00 EDT 2011 1305777600 = Thu May 19 00:00:00 EDT 2011

/Documents/gca.sqlite “GTasksTask” Table


CEIC q  Check on hotel Reservation q Make Changes to Presentation

UTILITIES


TouchTerm v2.4.2


net.jbrink.mobile.TouchTerm.plist


“connec*ons” Field


Item 1 & 3 = Hostname Item 4 = Username Item 6 = Password

/Documents/pinchmedia/*.sql


Anonymous Web Browser v2.0


/Documents/Cookies.plist


/Library/WebKit/LocalStorage/hZp_www.google.com_0.localstorage


Quick Password Manager v2.2


com.yourcompany.passwd.plist


Passwords


MobileRSS HD Free v3.2.1


/Documents/<username>@gmail.com.seyng


/Documents/<username>@gmail.com.sqlite

�  Unencrypted password!

�  VERY large SQLite database �  Text of RSS Feeds �  Metadata about feeds


com.nibirutech.MobileRSSHDFree.plist


/Library/Caches/download/images/<username>@gmail.com


OpenTable v3.2


com.contextop*onal.OpenTable.plist


BLOGGING


Tumblr v1.2.2


/Documents/userData.mxdata


Unencrypted Password

Email

/Documents/textPost.details


WordPress v2.6.4


/Documents/wordpress/blogs.archive


Item 21 = Username Item 22 = BlogID Item 23 = Blog URL Item 24 = Blog name Item 25 = Blog URL

/Documents/wordpress/<blog>.wordpress.com/<blogid>/comment.1.archive


/Documents/wordpress/<blog>.wordpress.com/<blogid>/post.1.archive


org.wordpress.plist


Bing for iPad v1.0


/Library/Preferences/com.microso^.binghd.plist


/Documents/BingTab.sqlite


/Documents/weatherSearch


/Documents/MapsCache


TRAVEL


TripIt v2.4


/Documents/TripIt.sqlite




“ZTRAVELER” Table



“ZTRIPITOBJECT” Table

Navigon v1.7


com.navigon.NavigonNorthAmerica.plist �  Program Preferences

�  Audio �  Terrain �  POIs �  Speed Warnings �  Traffic �  Etc.


/Library/Preferences/com.navigon.NavigonNorthAmerica.plist


Last Posi*on & Angle

Metadata

/Documents/LastSearchResult.dat


/Documents/Favourite.targets


/Documents/Recent.targets


FourSquare v2.2.2


/Documents/foursquare.sqlite


“ZFSVENUE” Table

/Documents/foursquare.sqlite


http://foursquare.com/user/<userid>

“ZFSNOTIFICATIONOBJECT” Table

DOCUMENTS & FILES


Evernote v4.0.2


com.evernote.iPhone.Evernote.plist


Evernote2.sqlite.md


<IncomingEmail>@m.evernote.com

Library/Caches/www.evernote.com


applog.txt


Evernote2.sqlite ZENSERVICEENTITY Table


Evernote2.sqlite


“LOCALFILE” Table

Dropbox v1.3.1


/Documents/Dropbox.sqlite


“ZCACHEDFILE” Table

/Library/Caches/Dropbox/

com.getdropbox.Dropbox.plist


com.getdropbox.Dropbox.plist �  Content from “DefaultsAccountInfoKey” in bplist format,

can be viewed by extrac*ng into separate file – shown below.


/Library/Caches/FavoriteFiles.plist


/Library/Caches/cache.db


Private Photo Lite v1.3


/Documents/


/Documents/photodb.sqlite


cn.mmxd.privatephotoslite.plist


TWITTER


Echofon v3.1.8


/Preferences/net.naan.TwiZerFon.plist


db3.1.5.db �  “users” Table

�  Contains user details: �  TwiZer User ID �  Name & Screen Name �  User entered loca*on, descrip*on and website. �  Count of followers/friends/favorites/tweets �  Is the account protected or verified? �  Link to profile icon (hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg)


/Library/profile_images �  hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg


db3.1.5.db �  hZp://twiZer.com/statuses/user_*meline/105533433.rss


Fill in the twitter user ID to get their latest tweets

db3.1.5.db


“queries” Table:

“saved_search” Table:

db3.1.5.db �  “direct_messages” Table

�  Contains direct messages. �  To & From (TwiZer IDs and Screen

Names) �  Dates


Library/Cookies/Cookies.plist


HootSuite v2.1.0


com.hootsuite.hootsuitelite.plist


TwiZeriffic v3.0.2


/Documents/accounts.plist


Timeline


/Documents/searches.plist


Search Databases


Tweetdeck v1.4.1


/Documents/tddb.0.2.sqlite3


/Documents/column_cache_1


/Documents/tddb.0.2.sqlite3


COMMUNICATION


Skype v3.0.1


/Library/Preferences/com.skype.skype.plist


Skype Logs


Skype Logs (Windows) �  Skype Parsing So^ware

�  SkypeLogView �  Nirso^

�  Available at: nirso^.net/u*ls/skype_log_view.html �  Free!

�  Skype Parser �  Redwolf Computer Forensics �  Available at: redwolfcomputerforensics.com/downloads/skype-‐

log-‐installer-‐1.7.exe


AIM (Free) v4.5.2


com.aol.aim.plist


/Documents/userAccounts/<GUID>.account


/Documents/userAccounts/<GUID>.buddylist


/Documents/userAccounts/<GUID>.history


WRAPPING UP


ceic 2011 - ios application forensics

Documents

harris corporation applica

harris corporation backups

harris corporation com

harris corporation objec

harris corporation userapplica

harris corporation caveats

ios applica

plist manifest