Introduction to Mobile Forensics. Dr. Darren Hayes Pace University

Transcription

1 Introduction to Mobile Forensics Dr. Darren Hayes Pace University

2 Computer Forensics is the scientific practice of using digital data in an investigation Mobile Forensics is scientific practice of using digital data, created by a mobile device, in an investigation Definition

3 To Prove Control Ownership Intent What is the Goal?

4 Computer Forensics is a Part of Security Computer Forensics is the Examination of Computers Computer Forensics is used to Solve Computer Crimes Computer Forensics is about Recovering Deleted Files Popular Myths

5 Scope of Mobile Forensics

6 Always On Personal Voice & Data Multimedia Internet Tracking GPS Importance

7 Communication through Embedded Chip Different File System Different Information Call Logs Text Messages Active Memory Storage Smaller Onboard Capacity Locational Data What s Different?

8 1875 Alexander Graham Bell Transmits Sounds 1876 Mr. Watson, come here! I want to see you! 1885 AT&T Founded 1919 First Rotary Telephone 1946 Area Codes Established 1961 Touch Tone Released to the Public 1963 Push-button Telephone History

9 1973 First Handheld Cellphone Call 1982 Caller ID 1984 New AT&T Formed 1991 GSM Created History

10 Radio Common Carrier 1960s 1980s Dr. Martin Cooper, Motorola, lbs Phone First Handheld Mobile Wall Street (1987) History

11 1983 DynaTAC Cellphone Released by Motorola 1 lb 9.5 Inches Tall 10 Hours to Charge 60 Mins. Talk Time $3,995 History

12 Push-to-talk (1993) Motorola StarTAC (1996) RIM BlackBerry (1999) Two-way Pager Motorola RAZR (2003) History

13 Hardware Cellebrite Universal Memory Exchanger (UME) Wireless Retailers Software Personal Investigations Cheating Spouses History Mobile Forensics

14 1995 Subscribers: 28.1 million Call Minutes: 31.5 billion 2011 Subscribers: million Call Minutes: 2.2 trillion (6 billion Call Mins. per Day) Text Msgs: 5.7 billion per Day Cell Towers: 250, % of Households are Wireless Only Statistics (Source: CTIA)

15 Case Studies

16 Higinio O. Ochoa Aged 30 Linux Administrator Accused of Being a Part of CabinCr3w Arrested by FBI EXIF Data from iphone Melbourne, Australia Led Investigators to Ochoa s Facebook Page iphone

17 Michael Jackson Murder Investigation

18 Conrad Murray Recorded Jackson s Last Words on iphone Judge Ruled that 4-Minute Audio File Was Admissible Conrad Murray Trial

19 Stolen iphone

20 April 2012 iphone Stolen on Disney Wonder Cruise Victim Katy McCaffrey Photos Automatically Uploaded to icloud Photo Stream Account Photos of Nelson & Co-workers Uploaded to McCaffrey s Facebook & Sent to Disney Stolen iphone

21 Times Square Shooting

22 August 18, 2012 Knife-wielding Man Runs through Time Square NYPD Runs after Suspect: Darrius Kennedy, 51 Bystanders Run Alongside Police with Cellphone Cameras Recording Action Suspect Shot Dead by Police Videos Uploaded to YouTube, Facebook, News Networks Smartphones Seized by Police Time Square Shooting

23 Precrime creeps closer to reality, with predictive smartphone location tracking Localscope App Smartphone Intelligence

24 Brooklyn Quality of Life App /new-smartphone-application-allows-people-toreport-crimes-to-authorities/ FBI Child ID App Law Enforcement Assistance

25 Forensic Computer Examiner Quick Reference Guide App International Association of Computer Investigative Specialists (IACIS) Forensics on Your Smartphone

26 Cellular Network Group of Cells Cell Geographic Area Cell Site Tower or Antenna Cellular Network

27 Cell Tower Radio Mast Often has 3 Sectors 200 Feet High Often Used by Multiple Carriers Transmits/Receives Radio Signals Encrypts/Decrypts Traffic Cell Sites

28 Receiver Transmitter Receiver Antenna Panel

29 Mobile Equipment (Handset) Security Identity Module (SIM) GSM Networks IMEI Identifies Mobile Equipment on GSM Cellular Network Mobile Station

30 Power On Cellphone On Keypad, Type *#06# Practical Locate IMEI

31 Open Browser URL: Type: 1600 Pennsylvania Ave NW Type: Washington, DC Type: Practical

32 Call & Mapping Analysis Using Cell Site Analysis Evidence in Criminal Trials pdf Request Data in Parsed Excel Format Request Keys to Tower Codes Free Mapping Cell Site Analysis (CSA)

33 Subscriber Records Call Detail Records (CDR) Phone Numbers Called/Received Duration Dates Times Cell Sites Quadrant Carrier Evidence

34 Mobile Equipment (Handset) Subscriber Identity Module (SIM) International Mobile Equipment Identity (IMEI) Analysis of IMEI: & trackimei.com Dial *#06# on Cellphone Type Allocation Code (TAC) Initial 6 to 8 Digits of IMEI Mobile Station (GSM)

35 Mobile Equipment (Handset) Electronic Serial Number (ESN) 2005: Mobile Equipment Identifier (MEID) Subsidy Lock (SPC) Confines User to One Network Mobile Station (CDMA)

36 Mobile Equipment (ME) FCC-ID Federal Communication Commission (FCC) Mobile Station

37 SIM Card Identifies Subscriber on a Network Contains IMSI GSM

38 GSM & iden (Motorola) Swapped Out with Unlocked Phones International Mobile Subscriber Identity (IMSI) Mobile Country Code (MCC) First 3 Digits of IMSI Mobile Network Code (MNC) Next 2 to 3 Digits Mobile Subscriber Identity Number (MSIN) Last 10 Digits SIM

39 Integrated Circuit Card ID (ICCID) 19 to 20 Digits Printed on SIM Major Industry Identifier (MII) First 2 Digits SIM

40 Code Division Multiple Access (CDMA) Developed during WWII Patented by Qualcomm Users Share a Band of Frequencies Verizon & Sprint No SIM Same Phone Model: GSM or CDMA Motorola RAZR CDMA

41 Code Division Multiple Access (CDMA) Spread-Spectrum Communications Protocol Wide Band Width Multiplexing Techniques Fiber Optic Verizon Sprint CDMA2000 3G CDMA

42 Mobile Network Operator (MNO) Owns an RF Spectrum License 4 Carriers AT&T/Cingular (GSM) T-Mobile (GSM) Verizon (CDMA) Sprint/Nextel (CDMA) Mobile Phone Network Operators

43 Mobile Virtual Network Operator (MVNO) Provides Mobile Phone Service No Licensed Frequency of Radio Spectrum Purchase Minutes of Use (MOU) Do Not Own SIM Cards Example: Virgin Mobile USA (Sprint Nextel) 100+ Carriers Mobile Phone Network Operators

44 90% of the World has No Cellular Coverage Solution Satelite Phones DeLorme Satelite Phones

45 Apple ios Google Android Nokia Symbian Samsung Bada Research In Motion RIM OS Microsoft Windows 7 Operating Systems

46 2011: Tablet Sales 60 Million Units Worldwide 2012: Tablet Sales 119 Million Units Worldwide Statistics (Gartner)

47 180, , , , ,000 80,000 60,000 40,000 20, ios Android Microsoft Tablet Sales Projections

48 Q1: Million Mobile Phone Units Sold Statistics (Gartner)

49 120, , , , , , Q Q 2012 Statistics (Gartner)

50 Samsung Galaxy S III 2012 Estimated Sales 30+ Million Units Samsung

51 January 2010 Nexus One (N1) Released Developed by HTC Unlocked Sold Directly by Google Nexus S Developed by Samsung WiFi Hotspot Capability Internet Calling Near Field Communication (NFC) Galaxy Nexus Coming Soon with Jelly Bean 4.1 Google Nexus

52 Close Proximity Radio Communication Based on RFID Standards Formed by Sony, Nokia, Philips Google Wallet Credit Cards Loyalty Cards MasterCard PayPass Public Transportation Ticketing Near Field Communication (NFC)

53 Usage: Payment System Social Media Hotel Keys Near Field Communication (NFC)

54 8.7% 7.0% 2.7% 1.9% 23.1% 56.6% Android Symbian Bada ios Research In Motion Microsoft Q OS Market Share

55 Networks: GSM iden CDMA Devices: Smartphones Tablets ereaders App Market 700,000+ Android

56 Samsung, LG, Motorola, etc. Samsung Galaxy Tab Amazon Kindle Android Devices

57 Cache.wifi Captures WiFi Connections Do Not Need to Connect to Record Can Be Mapped Fb.db Facebook Contacts Chat Logs Messages Photos Searches Evidence

58 provider.db Path: /data/data/com.android. /databases/ provider.db Exchange Login & Password in Plaintext HostAuth Gmail Login & Password in Plaintext Evidence

59 Da_destination.db Turn-by-Turn Navigation.WAV Files Stored Evidence

60 SMS& MMS Path: /data/data/com.android.providers.telephony Contains: Sender & Recipient Read Status Pictures Audio/Video MMS Path: /data/data/com.android.mms Evidence

61 PIN-Protect Numeric Password Alpha/Numeric/Character Pattern Lock Gesture Device Security

62 gesture.key Pattern-Lock Protection Finger Swipe Path: data/system/gesture.key Encrypted with SHA-1 Hash Algorithm Decrypt with Online Tools or Rainbow Tables Security

63 pc.key Password Protection Path: data/system/pc.key Decrypt with Brute Force or Dictionary Attack Most Difficult to Break Security

64 PIN Maximum of 8 Digits After Unsuccessful Attempts Enter Gmail Login & Password Security

65 Questions