UFED Cloud Analyzer. Traces and changes. February Version 6.0

Transcription

1 UFED Cloud Analyzer Traces and changes February 2017 Version 6.0

2 Legal notices Copyright 2017 Cellebrite Mobile Synchronization Ltd. All rights reserved. This manual is delivered subject to the following conditions and restrictions: This manual contains proprietary information belonging to Cellebrite Mobile Synchronization Ltd. Such information is supplied solely for the purpose of assisting explicitly and properly authorized users of the UFED Cloud Analyzer. No part of this content may be used for any other purpose, disclosed to any person or firm, or reproduced by any means, electronic or mechanical, without the express prior written permission of Cellebrite Ltd. The text and graphics are for the purpose of illustration and reference only. The specifications on which they are based are subject to change without notice. Information in this document is subject to change without notice. Corporate and individual names and data used in examples herein are fictitious unless otherwise noted.

3 3 1. Introduction 6 2. Facebook Login traces Potential alerts to the account owner Login information validity Twitter Login traces Potential alerts to the account owner Login information validity Google services Login traces Gmail login traces Google Drive login traces Google Contacts login traces Google Location History login traces Google My Activity login traces Google Passwords 23 Contents Google Photos, Google Tasks and Google Calendar Potential alerts to the account owner Google drive changed metadata Login information validity Dropbox 31

4 Login traces Potential alerts to the account owner Login information validity Instagram Login traces IMAP Login traces Potential alerts to the account owner VK Login traces Potential alerts to the account owner Kik Login traces One Drive Login traces Potential alerts to the account owner icloud Login traces Potential alerts to the account owner icloud Backup Login traces WhatsApp backup (Google Drive) 42

5 Contents Login traces Telegram Login traces 44

6 6 1. Introduction This document provides additional information regarding the traces and changes made by UFED Cloud Analyzer following successful and unsuccessful extraction attempts. It also includes the user alerts that the cloud account owner receives following extraction attempts. These user alerts are dependent on the account settings. UFED Cloud Analyzer does not make any changes to the content extracted from cloud data sources. In some extreme cases, UFED Cloud Analyzer may change the metadata of the content e.g., changing the time a file was open for specific file types in Google Drive. These are the types of changes that are explained in this document. UFED Cloud Analyzer does leave login traces and may generate user alerts depending on the extracted cloud data source, the user s account settings and the extraction method used. These traces and user alerts are described in detail in this document. Chapter 1

7 2. Facebook Login traces 1. The UFED Cloud Analyzer extraction is logged in the list of Facebook sessions when a user name and password are used as login credentials. UFED Cloud Analyzer appears as a Facebook for Android session. The following session information is logged by Facebook: Last access time The time that the extraction session started Location and IP address Device type used Facebook generates the session log after the credential verification step. Each extraction is logged, as each generates a session, therefore if several extractions are conducted using the same user name and password, the Facebook session list will contain several log records of Facebook for Android. Chapter 2 Figure: UFED Cloud Analyzer session logs within Facebook security settings 2. UFED Cloud Analyzer extractions performed using login keys from a mobile device do not appear as a new session in the Facebook sessions log. 3. Facebook allows the user to download a copy of the Facebook data. Accessed under Settings > General (

8 8 Figure: Facebook download account copy capability The downloaded content contains the list of sessions described above with the following additional information: browser and cookie identifier. Figure: UFED Cloud Analyzer logged session in downloaded Facebook data

9 Chapter 2: Facebook Potential alerts to the account owner 4. Account owners may receive login notifications from Facebook. By default, this option is not enabled. Figure: Facebook login alerts settings If login notifications are enabled, the account owner will receive the following alerts when UFED Cloud Analyzer tries to verify the credentials. The alert is generated when UFED Cloud Analyzer uses the user name and password to extract data. Figure: Facebook login alert as

10 10 Figure: Facebook login alert as SMS Figure: Facebook login alert as Facebook notification 5. Facebook users may set a login approval (two-step authentication) for new devices. By default, this option is not enabled. Figure: Facebook login approval settings When login approval is set by the account owner, attempts to verify login information by UFED Cloud Analyzer will result in a notification to the account owner requesting a verification code. These verifications are only sent when user name and password are used by UFED Cloud Analyzer.

11 Chapter 2: Facebook 11 Figure: Facebook login approval alert After the login approval was requested from the user and the user did not provide the second login factor, the next login of the account owner from the web browser will result in an additional notification to the user to review the recent login activity. This is the current behavior with UFED Cloud Analyzer when login approval is enabled in Facebook. Figure: Additional notification following an unsuccessful UFED Cloud Analyzer extraction of account with login approval

12 12 When login keys from a mobile device are used by UFED Cloud Analyzer, no login approval alert is generated, because UFED Cloud Analyzer is disguised as the mobile device and is therefore approved Login information validity 6. Login keys from a mobile device are only valid if the account owner did not sign out from the mobile app. If the account owner logged out from the mobile app, the UFED Cloud Analyzer will not be able to authenticate the credentials provided from the mobile device. 7. Login keys from the mobile device are valid for 60 days. Every time the account owner accesses Facebook from the mobile device the count renews. 8. When an account owner changes their password, they may decide to continue allowing access from other authenticated devices. In such cases, the login information extracted from the mobile device may still be valid and access to the account is still allowed.

13 3. Twitter Login traces 1. UFED Cloud Analyzer extractions are logged in a list of devices connected to Twitter. UFED Cloud Analyzer appears as a Twitter for Android when user name and password are used as the login information. Only the first extraction is logged for all UFED Cloud Analyzer instances. New sessions will not create a new log in on Twitter. The log record is created during the first successful credential verification (part of the extraction wizard). Figure: UFED Cloud Analyzer session in Twitters applications log 2. UFED Cloud Analyzer extractions performed using login keys from the mobile device do not appear as a new session in the Twitter sessions log. Chapter 3

14 Potential alerts to the account owner 3. Twitter users can set a login verification (two-step authentication for their account). By default, this option is not enabled. Figure: Twitter login verifications settings When login verification is set by the account owner, every attempt to verify login information by UFED Cloud Analyzer will result in a notification to the account owner regarding the verification process. These notifications are only sent when user name and password are used for extraction by UFED Cloud Analyzer. Figure: Twitter login verification alert as SMS 3.3. Login information validity 4. Login keys from the mobile device are valid as long as the account owner did not revoke the access. The user may sign out from the Twitter mobile application and the login information will still be valid. 5. Twitter accounts are temporarily blocked after 48 successive login attempts. UFED Cloud Analyzer validation will fail in such a case.

15 Chapter 3: Twitter 15 Figure: Twitter account temporarily blocked alert 6. When an account owner changes their password, they may decide to keep access from other authenticated devices. In such a case, the login information extracted from the mobile device may still be valid and access to the account is still allowed.

16 16 4. Google services 4.1. Login traces The use of UFED Cloud Analyzer to extract Google information may be logged by Google. The activity information is accessible by the user through the Google My Account interface under the Sign-in & security section. The amount of traces generated by UFED Cloud Analyzer may differ among the Google services, and is also dependent on the extraction method used to access the Google service. The following sections describe the expected login traces the user may find after UFED Cloud Analyzer was used on the account Gmail login traces 1. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Gmail will update the last sync time of the Android device from which the cloud keys where decoded. The last sync is updated when the UFED Cloud Analyzer user starts the extraction and not during the cloud keys login verification process. Figure: Cloud keys from an Android device 2. When using cloud keys from an ios device or when using the account's user name and password, the UFED Cloud Analyzer extraction from Gmail will log a new ios device for each extraction under the Recently Used Devices section. The log information includes the last sync time, the last location used and sign-in information under Notifications & alerts. The log is created at the cloud keys verification step as part of the Extraction wizard. Chapter 4

17 Chapter 4: Google services 17 Figure: Cloud keys from an ios device In addition, an app named Project Default Service Account is added once to the list of Connected apps and sites. Future extractions from this account will not create another app. Figure: Cloud keys from an Android device Google Drive login traces 3. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google Drive does not include any traces.

18 18 4. When using cloud keys from an ios device or when using the account's user name and password, the UFED Cloud Analyzer extraction from Google Drive will log a new ios device for each extraction under the Recently Used Devices section. The log information includes the last sync time, the last location used and sign-in information under Notifications & alerts. The log is created at the cloud keys verification step as part of the Extraction wizard. Figure: Cloud keys from ios or account credentials Google Contacts login traces 5. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google Drive does not include any traces. 6. When using cloud keys from an ios device or when using the account user name and password, the UFED Cloud Analyzer extraction from Google Contacts will log an Android device for each extraction under the Recently Used Devices section. The log information includes the last sync time and the last location used. The log is created at the cloud keys verification step as part of the Extraction wizard and is also updated when the extraction begins.

19 Chapter 4: Google services 19 Figure: When using the cloud keys from an ios device Figure: When using account user name and password from an ios device Google Location History login traces 7. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google Location History will be logged as the Android device from which the cloud keys were decoded. The log information includes the last sync time and the last location used. The logs are created at the cloud keys verification step as part of the Extraction wizard.

20 20 Figure: Cloud keys from an Android device 8. When using cloud keys from an ios device, the UFED Cloud Analyzer extraction from Google Location History will be logged as a new ios device under the Recently Used Devices section. The log information includes the last sync time and the last location. The logs are created at the cloud keys verification step as part of the Extraction wizard. Figure: cloud keys from an ios device 9. When using user name and password, the UFED Cloud Analyzer extraction from Google Location History will log a new ios device under the Recently Used Devices section. The log information includes the last sync time and the last location used. The log is created at the user name and password verification step as part of the Extraction wizard.

21 Chapter 4: Google services 21 Figure: User credentials Google My Activity login traces 10. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google My Activity will be logged as a Windows device for each extraction and the Android device from which the cloud keys where decoded. The log information includes the last sync time, the last location used and Internet Explorer The logs are created at the cloud keys verification step as part of the Extraction wizard.

22 22 Figure: Cloud keys from an Android device 11. When using cloud keys from an ios device or when using the account's user name and password, the UFED Cloud Analyzer extraction from Google My Activity will log a Windows device and an ios device for each extraction under the Recently Used Devices section. The log information includes the last sync time, the last location used, Internet Explorer 11.0, and sign-in information under Notifications & alerts. The log is created at the cloud keys verification step as part of the Extraction wizard and is updated when the extraction begins.

23 Chapter 4: Google services 23 Figure: Cloud keys from an ios device or credentials Google Passwords 12. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google Password will be logged as an Android device for each extraction and the Android device from which the cloud keys where decoded. The log information includes the last sync time and the last location used. The logs are created at the cloud keys verification step as part of the Extraction wizard.

24 24 Figure: Cloud keys from an Android device 13. When using cloud keys from an ios device or when using the account user name and password, the UFED Cloud Analyzer extraction from Google Passwords will log an Android device for each extraction under the Recently Used Devices section. The log information includes the last sync time and the last location used. The log is created at the cloud keys verification step as part of the Extraction wizard and is also updated when the extraction begins. Figure: Cloud keys from an ios device

25 Chapter 4: Google services Google Photos, Google Tasks and Google Calendar 14. When using cloud keys from an ios device or when using the account user name and password, the UFED Cloud Analyzer extraction from Google Photos, Google Tasks and Google Calendar will log an Android device for each extraction under the Recently Used Devices section. Figure: Cloud keys from an ios device or user credentials 15. When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from Google Photos, Google Tasks and Google Calendar will be logged as an Android device for each extraction and the Android device from which the cloud keys where decoded.

26 26 Figure: Cloud keys from an Android device

27 Chapter 4: Google services Potential alerts to the account owner 12. Google allows users to receive or device notifications when there is unusual activity from their account. By default, notifications are generated unless the account owner provided a default phone number. In such a case, the account owner will also receive a notification on their mobile devices. Figure: Google notifications settings Gmail uses its own algorithm to detect unusual activities. When suspicious activity is detected, it will also be logged in the security setting pages. Figure: Google security alert example

28 28 Figure: Google security alert example in the device and activities page 13. Gmail users may set up a two-step verification for their account. By default, this option is not enabled. Figure: Google two steps verifications setting When login verification is set by the account owner, every attempt to verify login information by UFED Cloud Analyzer will result in a notification to the account owner regarding the verification

29 Chapter 4: Google services 29 process. These notifications are only sent when user name and password are used for extraction by UFED Cloud Analyzer. Figure: Google two-step verification code as SMS 4.3. Google drive changed metadata 14. The Google doc files last opened time is changed as a result of UFED Cloud Analyzer extraction from Google Drive. The rest of the file's properties are not changed. Figure: Google Drive changed properties after extraction for Google Docs files

30 Login information validity 15. Login keys from a mobile device are valid unless one of the following conditions are met: The account owner signed out from the mobile app. The account owner removed the access through the Gmail user interface. 6 months passed since the last login from the device that contains the mobile login information. More than 25 other devices used after the last login from the device that contains the mobile login information. 16. Gmail accounts are temporarily blocked after 40 successive login attempts. The UFED Cloud Analyzer validation will fail in such a case.

31 5. Dropbox Login traces 1. UFED Cloud Analyzer extractions are logged in the list of devices connected to Dropbox. UFED Cloud Analyzer appears as an Unknown Android device regardless of the type of login information provided (login keys from a mobile device, or user name and password). Dropbox generates log records only during the credential verification (part of the extraction wizard). Each extraction is logged, as each generates a new session, therefore if several extractions are conducted using the same user name and password the Dropbox session list will contain several log records of Unknown Android. Chapter 5 Figure: UFED Cloud Analyzer extraction log in Dropbox sessions and devices 2. Login keys from a mobile device are only valid if the account owner did not sign out from the mobile app. If the account owner logged out from the mobile app, the UFED Cloud Analyzer will not be able to authenticate the credentials provided from the mobile device.

32 Potential alerts to the account owner 3. The following Dropbox security notifications are enabled by default: A new device is linked to my Dropbox A new app is connected to my Dropbox Therefore, if a user name and password is used as login information the account owner will receive an notification that the mobile device is now connected to Dropbox. Figure: Dropbox notification following UFED Cloud Analyzer extraction using user name and password When login information extracted from the mobile device is used, the account owner will not receive any notification. 4. If the account owner did not install the Dropbox app on the mobile device, performing an extraction using user name and password will change the status of Install Dropbox on your mobile device within the Getting started page to Complete.

33 Chapter 5: Dropbox 33 Figure: Dropbox Getting started page 5.3. Login information validity 5. Login keys from the mobile device never expires unless the account owner signed out. 6. When an account owner changes their password, they may decide to continue allowing access from other authenticated devices. In such cases, the login information extracted from the mobile device may still be valid and access to the account is still allowed.

34 34 6. Instagram 6.1. Login traces 1. The Instagram user interface does not expose the account activity log, and therefore the extraction of content from Instagram using UFED Cloud Analyzer is not displayed to the user. 2. Instagram does not provide a mechanism for login alerts, nor a mechanism for two-step authentication. This reduces the concern related to the user receiving login traces when using UFED Cloud Analyzer to extract data from the user's Instagram account. Chapter 6

35 7. IMAP Login traces 1. UFED Cloud Analyzer utilizes the Internet Message Access Protocol (IMAP) to generically access a variety of services. The verification, if based on user name and password is therefore subject to login traces. Different services provide different security mechanisms that may log the time of access, IP, location etc. This document cannot describe all the services, and therefore the Cellebrite recommendation is to try these IMAP services using a test account, and identify if the traces left by the service fit the operational needs. For Yahoo.com and Outlook.com services, no login trace were identified when trying to collect s from these services using UFED Cloud Analyzer Potential alerts to the account owner 2. As the amount of services that support IMAP is extensive, this document cannot cover the list of potential alerts. Some services may offer a two-step authentication mechanism that generates additional alerts when using user name and password. The Cellebrite recommendation is to research the security setting in the user interface of these services, to identify the type of alerts that may be generated and whether two-step authentication is applicable to the service. Chapter 7

36 36 8. VK 8.1. Login traces 1. UFED Cloud Analyzer extractions are logged in the activity history of VK. UFED Cloud Analyzer appears as a new Android application when user name and password are used. VK generates log records only during the credential verification (part of the extraction wizard). VK logs the time, country and IP address. Figure: VK activity history Chapter 8 2. When cloud login keys from a mobile device are used, there is no indication of UFED Cloud Analyzer in the activity history. 3. Cloud login keys from a mobile device are only valid if the account owner did not sign out from the mobile app, or did not terminate all active sessions. If the account owner logged out from the mobile app, or terminated all active session, UFED Cloud Analyzer will not be able to authenticate the credentials provided from the mobile device Potential alerts to the account owner 4. VK users can set a login verification (two-step authentication for their account). By default, this option is not enabled.

37 Chapter 8: VK 37 Figure: VK login verification settings When login verification is set by the account owner, every attempt to verify login information by UFED Cloud Analyzer will result in a notification to the account owner regarding the verification process. These notifications are only sent when the user name and password are used for extraction by UFED Cloud Analyzer. Figure: VK login verification alert as SMS

38 38 9. Kik 9.1. Login traces 1. There are no known logs or alerts that are exposed to the account owner that can indicate UFED Cloud Analyzer accessed the account. Chapter 9

39 10. One Drive Login traces 1. There are no traces for login keys from Android devices. 2. When using user name and password for extraction by UFED Cloud Analyzer, a "successful sign-in" is created with the following information: Figure: One Drive Recent activity Potential alerts to the account owner 2. When two-step authentication is used, tokens and credentials fail during the UFED Cloud Analyzer verification step. When trying to authenticate with an Android device, the token fails in UFED Cloud Analyzer, and a Security challenge entry is created in the Recent Activity page ( Chapter 10 Figure: One Drive Security challenge

40 icloud Login traces 1. Only credentials authentication (user name and password) is available for icloud. 2. There are no traces for itunes Purchases Potential alerts to the account owner 3. For icloud Drive, icloud Data and icloud (Real-Time Location), an is sent to the assigned account on each verification step in UFED Cloud Analyzer with the following information. Figure: icloud on verification step Chapter 11

41 12. icloud Backup Login traces 1. There are no traces when using login keys from the computer, icloud user credentials or two-factor authentication. Chapter 12

42 WhatsApp backup (Google Drive) Login traces The use of UFED Cloud Analyzer to extract WhatsApp Backups on Google Drive may be logged by Google. The activity information is accessible by the user through the Google My Account interface under the Sign-in & security section. This section describes the expected login traces the user may find after UFED Cloud Analyzer was used on the account. 1. When using the Google credentials, or Google credentials together with an account package without a valid token (i.e., device key only), the UFED Cloud Analyzer extraction from the WhatsApp Backups on Google Drive will be logged as an Android device for each extraction under the Recently Used Devices section. The log information includes the last sync time and the last location used. The log is created at the cloud keys verification step as part of the Extraction wizard and is also updated when the extraction begins. Figure: Google credentials Chapter When using cloud keys from an Android device, the UFED Cloud Analyzer extraction from the WhatsApp Backups on Google Drive will be logged as the Android device from which the cloud keys were decoded. The log information includes the last sync time and the last location used. The logs are created at the cloud keys verification step as part of the Extraction wizard.

43 Chapter 13: WhatsApp backup (Google Drive) 43 Figure: Cloud keys from Android

44 Telegram Login traces 1. When using the phone number credentials, a notification is displayed in Telegram during the verification step, if the app or web client are currently running. Figure: Phone credentials 2. After entering the received SMS code from Telegram, the user receives a notification in all their active Telegram apps (and Web clients). The device is indicated as an Android device for both Android and ios:

45 Chapter 13: WhatsApp backup (Google Drive) 45 Figure: User notification 3. When using cloud keys, Telegram does not send any notification.