ios Forensics: Overcoming Data Protection

Size: px

Start display at page:

Download "ios Forensics: Overcoming Data Protection"

Brett Gilbert
5 years ago
Views:

ios Forensics: Overcoming Data Protection Best Practices for Acquiring

2 Andrey Belenko Sr. Security Engineer M. Sc. in Computer Security CISSP 2010: itunes Backup decryption 2011: ios Data Protection Decryption 2012: icloud Backup Download 2013: icloud Keychain Analysis

3 Covering Today Basics ios Security ios Forensics

5 Why Bother? ios DEVICES SOLD AS OF NOV 2014

6 Why Bother? Many, many devices out there Corporate deployments Government deployments Contain lots and lots of valuable information Apple is taking device security and privacy seriously

7 Forensics 101 Acquire Analyse Report Extract as much data as practical Leave as little traces as possble

8 ios Forensics 101 LOGICAL icloud Uses external interfaces itunes backup Backdoor services Needs Apple ID and password Get icloud Backup and documents No encryption PHYSICAL NAND Needs code execution Can image disk Can bruteforce passcode Needs code execution Extension on physical May recover deleted files

10 Chain of Trust Boot ROM iboot Kernel Apps Read- only Programmed at the factory Cannot be patched Verified by Boot ROM Can be updated Verified by iboot Verified by kernel Must be signed Sandboxed

11 Jailbreak Boot ROM Disables verification of next stages iboot Kernel Apps Unverified Can be malicious Unverified Can be malicious Unverified Can be unsigned Sandbox not enforced

12 Jailbreak Boot ROM iboot Read- only Programmed at the factory Cannot be patched Disables verification of next stages Kernel Unverified Can be malicious Apps Unverified Can be unsigned Sandbox not enforced

13 Jailbreak Boot ROM iboot Kernel Read- only Programmed at the factory Cannot be patched Verified by Boot ROM Can be updated Disables code signing Disables sandboxing Apps Unverified Can be unsigned Sandbox not enforced

14 Jailbreaks 101 TETHERED BOOT- LEVEL Needs host to boot into jailbreak Does not persist across reboots Usually few traces left Exploits Boot ROM or iboot Boots patched kernel Boot ROM exploits are permanent UNTETHERED USER- LEVEL Device jailbreaks on each boot Persist across reboots Permanent traces left Exploits already running kernel Usually imposes limitations: no passcode, no backup password, etc

ios Security Cryptographic co- processor ios devices embed an AES co- processor. Group hardware key Hardware key shared by all devices of same type, used to decrypt firmware.

15 ios Security Cryptographic co- processor ios devices embed an AES co- processor. Group hardware key Hardware key shared by all devices of same type, used to decrypt firmware. Unique hardware key Hardware key unique for every device, used to create various device keys. Those device keys are used to encrypt various data. Introduced in the original iphone

16 ios Data Protection Protection classes Files and keychain records assigned a protection class that defines how data is encrypted. Passcode protection Passcode derived from unique device key and participates in data encryption. Storage and keychain encryption Each file and keychain record is encrypted with unique key. New itunes backup format Better backup password protection and keychain records can be exported into backup. Introduced in ios 4 Works on iphone 3GS and above

17 ios Data Protection iphone 4S iphone 5 iphone 5c

18 ios Data Protection Secure Enclave Dedicated co- processor with separate OS dedicated to security- related operations. Touch ID Relieves users from entering passcode every time and facilitates stronger passcode. Introduced in iphone 5s Works with ios 7 and above.

19 Protection Classes: Files NSFileProtectionNone NSFileProtectionComplete No special protection Access file at any time Encrypted with filesystem key Encrypted, key depends on passcode Access file only when unlocked Key purged from memory when locked NSFileProtectionComplete AfterFirstAuthentication NSFileProtectionComplete UnlessOpen Encrypted, key depends on passcode Access file only after first unlock Key lives in memory until shutdown Encrypted, key depends on passcode Create files while locked Open files only when unlocked

20 Protection Classes: Keychain ksecattraccessiblealways ksecattraccessiblewhenunlocked ksecattraccessibleafterfirstunlock Access record at any time Key does not depend on passcode Access record only when unlocked Key depends on passcode Key purged from memory on lock Access record only after first unlock Key depends on passcode Key lives in memory until shutdown ksecattraccessiblealways ThisDeviceOnly ksecattraccessiblewhenunlocked ThisDeviceOnly ksecattraccessibleafterfirstunlock ThisDeviceOnly Same as AccessibleAlways Cannot migrate to new device Same as AccessibleWhenUnlocked Cannot migrate to new device Same as AccessibleAfterFirstUnlock Cannot migrate to new device

21 PROTECTION CLASSES DETERMINE WHAT CAN OR CANNOT BE ACCESSED WITHOUT A PASSCODE

Device Pairing Key negotiation Establishes keys so that host can access services on the device. Device must be unlocked Escrow keys are created during pairing so all content keys must be available.

22 Device Pairing Key negotiation Establishes keys so that host can access services on the device. Device must be unlocked Escrow keys are created during pairing so all content keys must be available. Pairing must be confirmed by the user Since ios 7 device prompts user whether she or he wants to grant pairing host access. Pairing record can effectively unlock device Pairing record contains escrow keys that grant access to all files and keychain records. Pairing record only works after unlock If you seized device and pairing record, do not turn it off.

24 ios Forensics 101 LOGICAL icloud Uses external interfaces itunes backup Backdoor services Needs Apple ID and password Get icloud Backup and documents No encryption PHYSICAL NAND Needs code execution Can image disk Can bruteforce passcode Needs code execution Extension on physical May recover deleted files

25 Logical Extraction BACKUP AFC, AFC2 Obtain a potentially encrypted backup Obtain media files or whole filesystem HOUSE ARREST, INSTALLATION PROXY FILE RELAY Obtain application data Obtain various files and data from the device

26 Logical Extraction Connect to services on the device and ask them to return data All but very basic requests require pairing record There are plethora of tools that can do logical libimobiledevice (open source) is often superior when it comes to extraction Copyright 2015 NowSecure, Inc. All Rights Reserved.

27 Logical Extraction: itunes Backup Proprietary format with mangled filenames May be encrypted and encryption is enforced by the device Backup password is saved in keychain There are password cracking tools that may help Keychain handling depends on backup encryption not encrypted: keychain records encrypted with device-specific key encrypted: keychain records encrypted with backup password, except records with ThisDeviceOnly protection class Copyright 2015 NowSecure, Inc. All Rights Reserved.

28 Logical Extraction: Apple File Conduit (AFC) Provides access to /var/mobile/media directory Jailbroken devices may expose whole filesystem through AFC2 service Copyright 2015 NowSecure, Inc. All Rights Reserved.

29 Logical Extraction: House Arrest and Installation Proxy List installed applications Access to application data (application containers) Access application files (application bundle) Copyright 2015 NowSecure, Inc. All Rights Reserved.

30 Logical Extraction: File Relay Backdoor service giving access to various sources Source is a list of hardcoded file name Returns files corresponding to requested sources, as.cpio.gz archive Disabled in ios 8: needs an Apple-signed profile to work Copyright 2015 NowSecure, Inc. All Rights Reserved.

31 Logical Extraction: File Relay Sources AppleTV Baseband Bluetooth Caches CoreLocation CrashReporter CLTM demod Keyboard Lockdown MobileBackup MobileInstallation MobileMusicPlayer Network Photos SafeHarbor SystemConfiguration Ubiquity UserDatabases AppSupport Voic VPN WiFi WirelessAutomation MapsLogs NANDDebugInfo IORegUSBDevice VARFS HFSMeta tmp MobileAsset GameKitLogs Device-O-Matic MobileDelete itunesstored Accounts AddressBook FindMyiPhone DataAccess DataMigrator EmbeddedSocial MobileCal MobileNotes Copyright 2015 NowSecure, Inc. All Rights Reserved.

33 Case # 2: Encrypted Backup iphone 5s without a passcode running ios 7 Backup can be acquired but is encrypted Password brute force yielded no results filerelaytest ideviceinstaller -l ifuse --container <bundle_id> Copyright 2015 NowSecure, Inc. All Rights Reserved.

34 Physical Extraction RAMDISK JAILBREAK Only for old device (iphone 4) Does tethered jailbreak (boot ROM) Loads pre- patched kernel Loads ramdisk with forensic tools Can image disk Can bruteforce passcode Can extract device keys For devices without Boot ROM exploit Manually jailbreak the device Copy/install forensic tools Tools patch kernel on- the- fly Can image disk Can bruteforce passcode if no SE Can extract device keys if no SE Secure Enclave is a major problem

36 icloud Extraction Use Apple ID and password (or token) to connect to icloud Download icloud backup and other data, not encrypted notification is sent to user s address Multiple vendors offer icloud extraction tools iphone-dataprotection and iloot are open source alternatives Copyright 2015 NowSecure, Inc. All Rights Reserved.

37 Case # 3: Recover Data from itunes Backup iphone 5 without passcode running ios Evidence deleted from the device icloud backup, without evidence Encrypted itunes backup with evidence, password unknown Copyright 2015 NowSecure, Inc. All Rights Reserved.

38 Case # 3: Recover Data from itunes Backup Jailbreak the device, read backup password from keychain Jailbreak worked but no password in keychain :( Extract device key (securityd) from the device Decrypt keychain from icloud backup using that key Decrypt itunes backup using decrypted password Find evidence Copyright 2015 NowSecure, Inc. All Rights Reserved.

39 Workflow Start iphone 4 or older? Passcode? Pairing record? Jailbroken? Can be jailbroken? icloud Backup enabled? Yes No Yes Yes Yes Yes Unlocked since reboot? Jailbreak icloud password known? Yes Yes Physical via ramdisk Logical Try SSH, AFC2 SSH, AFC2, etc Download icloud Backup Copyright 2015 NowSecure, Inc. All Rights Reserved.

40 Hardware- assisted Passcode Recovery Simple passcode Bruteforces 4- digit passcodes in around 4 days. Connects to battery On ios 8 it needs to cut device power after every ninth attempt. Works up to ios 8.1 Vulnerability is likely patched in ios 8.1.1

ios Forensics with Open-Source Tools Andrey Belenko

ios Forensics with Open-Source Tools Andrey Belenko AGENDA Basics ios Security ios Data Protection Hands-On! FORENSICS 101 Acquisition Analysis Reporting GOALS: 1. Assuming physical access to the device