Proactive Forensic Support to Android Device

Transcription

1 A Framework June 18, 2016 Department of Cyber Security Amrita Vishwa Vidyapeetham Coimbatore

2 Smartphone OS Market Share, 2015 Q2 1 Figure: Smartphone OS Market Share, 2015 Q2

3 Android, in recent, are Very powerful - 5GB RAM, 2.3GHz Quad Processor 1 Cheaper - from 899 2, Well equipped Play Store - over 1.43 million apps, Customization facilities, Android Community, etc. 2 1 Galaxy S7 2

4 There is a growing need for mobile forensics due to several reasons. Some of the prominent reasons are: Use of mobile phones to store personal information Increased use of mobile phones to perform online activity Use of mobile phones in several crimes Android is designed for general purpose and not for forensics. Experienced user(criminal) can wipe out the forensically sound 3 data from the mobile device. 3 3 forensically sound is often used in the digital forensics community to clarify the correct use of a particular forensic technology or methodology

5 To Catch a Thief, Think Like a Thief If criminals and crime organizers use smart phones, what would they do? Will they browse? If so which browser? What site? How to predict the next move? 4

6 Limitations of Existing Forensic Tools: 1. Real-time monitoring and analysis is not possible 2. Deleted and obsolete data are hard to retrieve 3. Data gathered may not be enough 4. Encrypted and VPN history are hard to recover We are including a proactive forensic support to Android that use cloud to store collected data. 5

7 Timeline Analysis The Sleuth Kit File System Analysis adb shell mount File Carving Smart Craving scalpel Strings strings -all radix=x <Phone.dd> Hex Android used YAFFS2 previously now uses Ext4 6

8 Android Stores data on 1. Shared preferences /data/data/com.android.phone/shared_prefs 2. Internal Storage /data/data 3. External Storage /mnt/sdcard/android/data 4. SQLlite /data/data/<package_name>/database 5. Network java.net android.net 7

9 Adding a support service to Android ROM This service pro-actively identifies and collects forensically sound data Data are stored on a Stealth file system 4 within the device Opportunistic upload of data to cloud storage. 8 4 Forensic data is stored separately in the partition /forensic and it is hidden from the users.

10 - Data Collection The data are gathered from All the user activities get which gets logged and stored, Deleted data which can also be tracked, Files, folder from Real time, Provenance of data. 9

11 10 Figure: Forensic Service Architecture

12 11 Figure: Forensic Service Architecture-User side

13 12 Figure: Forensic Service Architecture-Investigator side

14 User Interface The proposed system is capable of User Specific Data Call Logs Contacts SMS /MMS Application data including alarms SIM card details Organizer data dictionary words Photos, videos, audio files, playlists and voice records Passwords Network Specific Browser Artifacts Search Keywords s Cell towers, Wi-Fi networks information, bluetooth information Geo location based on the apps Smart phone specific Social Network Data Facebook, Twitter, LinkedIn, etc GPS Locations and Maps history APK Details System logs and information Event logs Sensor data Key logger Call tapping 13

15 Location Figure: GPS trail of the user Figure: GPS data on text file 14 Figure: Location

16 recorder.setaudiosource (MediaRecorder.AudioSource.VOICE_CALL); recorder.setoutputformat (MediaRecorder.OutputFormat.THREE_GPP); recorder.setaudioencoder (MediaRecorder.AudioEncoder.AMR_NB); 15

17 SENSOR TYPE VALUE COUNT VALUE COMPOSITION TYPE_ACCELEROMETER 3 value[0] : X-axis(Lateral) value[1] : Y-axis(Longitudinal) value[2] : Z-axis(Vertical) TYPE_GRAVITY 3 value[0] : X-axis(Lateral) value[1] : Y-axis(Longitudinal) value[2] : Z-axis(Vertical) TYPE_AMBIENT_ TEMPERATURE 1 value[0] :Temperature TYPE_GYROSCOPE 3 value[0] : X-axis value[1] : Y-axis value[2] : Z-axis TYPE_LIGHT 1 value[0] : Illumination value[0] : X-axis(Lateral) TYPE_LINEAR_ 3 value[1] : Y-axis(Longitudinal) ACCELERATION value[2] : Z-axis(Vertical) value[0] : X-axis(Lateral) TYPE_MAGNETIC_FIELD 3 value[1] : Y-axis(Longitudinal) value[2] : Z-axis(Vertical) SensorManager. getorientation() 3 values[0]: azimuth values[1]: pitch axis values[2]: roll TYPE_PROXIMITY 1 value[0] : Distance TYPE_PRESSURE 1 value[0] :Atmospheric Pressure TYPE_STEP_DETECTOR TYPE_STEP_COUNTER 1 value[0]: Step counter TYPE_SIGNIFICANT_ MOTION 1 value[0] = 1.0 Table: Sensor Return Values 16

18 Figure: List of videos recorded Figure: Screenshot of captured video 17 Figure: screens

19 Figure: WiFi metadata Figure: SIM details Figure: with WiFi and Cell location 18

20 Figure: Call Log Figure: SMS Figure: Apps installed Figure: 19

21 inotifwait Figure: inotifywait in inotify :~#. / i n o t i f y 1 ~/tmp / r o o t Press ENTER key to terminate. L i s t e n i n g f o r events. IN_OPEN : / root / tmp [ d i r e c t o r y ] IN_OPEN : / r o o t / tmp / [ d i r e c t o r y ] IN_OPEN : / r o o t / tmp / a [ f i l e ] IN_CLOSE_NOWRITE: / r o o t / tmp / a [ f i l e ] IN_OPEN : / r o o t / tmp / b [ f i l e ] IN_CLOSE_NOWRITE: / r o o t / tmp / b [ f i l e ] IN_OPEN : / r o o t / tmp / c [ f i l e ] IN_CLOSE_NOWRITE: / r o o t / tmp / c [ f i l e ] IN_CLOSE_NOWRITE: / root / tmp [ d i r e c t o r y ] IN_CLOSE_NOWRITE: / root / tmp / [ d i r e c t o r y ] 20

22 Reactive Forensic Methodologies Forensic analysis of WhatsApp messenger on Android Smartphones ANDROPHSY - Forensic Framework for Android Methodologies Adding Support Framework to Android Automated data collection and reporting from a mobile device 21

23 We are providing a Framework on a custom ROM, that Tracks User Specific Data Network Specific Data Smartphone Specific Data Real-time Tracking 22

24 References [akarawita2015androphsy (2012)] [1]Akarawita, Indeewari U and Perera, Amila B and Atukorale, Ajantha (2015) ANDROPHSY Forensic Framework for Android. International Conference on Advances in ICT for Emerging Regions (ICTer), 250(258) [AIYYAPPAN P S (2015, June).] [2]AIYYAPPAN P S. (2015, June) Adding MTech Dissertation [Yaghmour, Karim (2013)] [3]Yaghmour, Karim(2013) Embedded Android: Porting, Extending, and Customizing. O Reilly Media, Inc.", [Hogg, Andrew (2012)] [4]Hogg, Yaghmour(2013) Android Forensics: Investigating, Analysis, and Mobile Security for Google Android. Elsevier, Inc.", 2012.

25 References [Justin Grovera] [5] Android forensics: Automated data collection and reporting from a mobile device. Digital Investigation, [anglano2014forensic] [6]Anglano, Cosimo (2014) Forensic analysis of WhatsApp messenger on Android Smartphones Digital Investigation, Elsevier, 11(3) [Rohit Tamma, Donnie Tindall] [7]Rohit Tamma, Donnie Tindall Learning Android Forensics. Packt Publishing Ltd., [ [8] Security Android Developers, [Artenstein, N. and Revivo, I Man in the binder: He who controls ipc, controls the droid.] [9] BlackHat Europe

26 Thank you!