FinFireWire / Release Notes. FINFISHER: FinFireWire 3.5 Release Notes

Transcription

1 1 FINFISHER: FinFireWire 3.5 Release Notes

2 2 Copyright 2013 by Gamma Group International, UK Date Release information Version Date Author Remarks pk Initial version pk Version Pk Version Pk Update for release version Pk Update for release version 3.5

3 3 Table of Content 1 Overview ChangeLog Limitations... 7

4 4 1 OVERVIEW FinFireWire is a tactical kit that enables the operator to quickly and covertly bypass the passwordprotected Login-Screen or Screensaver. No modifications are done on the actual Target System and no reboot is required so all essential forensic evidence can be recovered live from the running system.

5 5 2 CHANGELOG Version: 1.3 Target Windows XP / Vista / 7 Windows Logon & Screensaver Bypassing + Restore Function Generic Graphical User Interface Point-And-Click Interface for Bypassing locked systems Version: 2.0 Target (Windows) Windows XP / Vista / 7 (32bit & 64bit) Windows Logon & Screensaver Bypassing + Restore Function Target (MAC) Mac OSX Logon & Screensaver Bypassing + Restore Function Target (Linux) SuSE/Ubuntu/Backtrack/ Debian/Fedora/FreeBSD Gnome / KDE Logon & Screensaver Bypassing + Restore Function Auto Detection OS type and RAM size Detect the running Operation System and installed Memory size Memory Dump Generate RAM Dump Generate a Memory Dump for Forensic Analysis GUI Multiple Language Support GUI can be translated into different languages Device Name Bugfix FireWire Device Name could not be changed in the prior release. Benchmark Test Test transfer rate A performance test can be initiated before a Memory Dump GUI Improvement Improve GUI / Wizard

6 6 Version: 2.1 RAM-Dump Advanced Configuration New Feature 32bit Limitation Checkbox New Feature Add Patchlevel & Language selection A new checkbox for 32bit target OS will limited maximum RAM to 3072MB Better Target Specification can speed up the Unlocking process. Target (Linux) add more Linux Targets - SuSE 11.4, 11.3 KDE 32 & 64bit - SuSE 11.3 Gnome 32bit - Debian 6.0 Gnome 32bit - Ubuntu 10.10, 11.04, Gnome 32bit - Fedora 14,15 Gnome 32bit - CentOS 5.4, 5.6, 6 Gnome 32bit - - Backtrack 5, 5R1 KDE 32/64bit Target (Windows) add more Windows Targets (Vista & W7 64Bit) - AR, CN, RU, EN Unlock New Feature Calculate real max. estimated time for the unlock process. Memory Dump Advanced Configuration Bug Fix Stop Process doesn t work. New Feature Adapter Information Dialog Press the Stop Button will terminate the Dump Process immediately. The firewire adapter information will be shown in a separate adapter information window. Unlock Advanced Configuration Advanced Configuration Changes Manual Lock / Restore Changes RAM Value Bug Fix RAM min/max/steps dependency If the unlock process was successfully, the Unlock button will be changed into a Lock button. Target needs to be locked manually, by pressing the Lock button! Increase Maximum RAM Values. RAM(min) --> 8GB RAM(max) --> 16GB Fix some calculation bugs, which could crash the Target. Auto Detection Improvement Improve a more secure maximum RAM value if an auto detection was successful.

7 7 Version: 2.2 GUI Full Multiple Language Support GUI can be translated into different languages Version: 3.0 New Module Image Search added New Module String Search added New Module Other Filetypes Search added New Module Truecrypt Recovery added FinFireWire carve and extract image files from a memory dump file. Support file types are: *.png, *.jpg, *.bmp, *.gif. A preview of the image is implemented. FinFireWire carve and extract strings from a memory dump file. A minimal / maximal string length can be defined. An integrated preview function will show the text in the dump file. Strings can be extracted word-by-word or line-by-line. Duplicates can be removed. FinFireWire carve and extract Word and PDF files from a memory dump file. FinFireWire is able to recover the TrueCrypt keys from memory dumps gathered from linux systems. The keys will used to decrypt the volume. The Truecrypt container must be mounted on the target system, when the memory dump was done. Target (Windows) add Windows Target - Windows 8 32bit - Windows Vista 32bit Target (Linux) add more Linux Targets - SuSE Gnome + KDE - Debian Gnome - Ubuntu Gnome - Fedora Gnome - CentOS Gnome - Backtrack / Kali Linux Gnome Target (Mac) add Mac Target - OSX 10.6 / 10.8

8 8 Version: 3.5 Target (Windows) add/update Windows Target - Windows 8, /64bit - Windows 7 Target (Linux) add more Linux Targets - Ubuntu Gnome Target (Mac) add Mac Target - OSX 10.7 / 10.9 GUI Modified wizard Changes in the order of the wizard, which guides through each single step more efficient. GUI New Item Test Connection User can perform a benchmark test and reset the adapter if necessary.

9 9 3 LIMITATIONS This chapter covers current known limitations within the FinFireWire Software. Feature Full Hard-Disk Encryption Description A few products for full hard-disk encryption are known to prevent FinFireWire from unlocking the System. Known products that prevent the attack are: Safedisk "Protect Drive" Safeguard Enterprise Windows Domain Account Mac OSX FileVault Mac OSX Targets Linux Targets OS Auto Detection RAM Auto Detection Biometric Authentication Unsupported Target System - User Account which are registered and used in a Windows Domain Environment cannot be bypassed. FileVault uses encrypted file systems that are mounted when the user logs into the system. If this function is used, bypass will not work. Firewire/Thunderbolt interface will be automatically blocked as soon as the screen is locked (since Mac OSX 10.7). If the user doesn t made any chances in the settings, the interface cannot be used to unlock a target OS. Newer Linux operating systems blocking firewire modules by default through a blacklist file. If user doesn t modify this setting before the attack will be launched, firewire port cannot be used / are unavailable. If a firewire device like external HDD or camcorder will be used by the target, all necessary firewire modules should be available. Only Linux and Windows Operating System can be detected at the moment. No OS Version can be specified and it has to be selected manually. This function can freeze or crash Target PCs (especially older PCs). Some biometric identification products replace or patch system standard authentication functions and cannot be bypassed. In case the Operating System in its installed patch-level is

10 10 Crashes Unsupported Operation System Version Connection Support Truecrypt Container Target with > 4GB RAM Test Firewire Connection / Reset Adapter unsupported and more RAM than actually available has been specified in FinFireWire, the Target System might crash during the operation. Even though dozens of different patch-levels have been tested for each Operating System, no guarantee can be given that the Target System patch level is already included in the database. If the Target System does not have a connection for either FireWire IEEE1394, Express Card or PCMCIA the FinFireWire system cannot be connected and the product cannot function. Currently only Truecrypt keys from a Linux target can be recovered. Some extracted image files have to been modified / repaired before they can be shown. The data in the memory dump file will not be changed. A memory dump is just a snapshot. A lot of programs clean up the memory after they will be closed. The same situation exists for large files. In this case only chunks can be restored and beside picture files, most of the time the data is corrupted and cannot be used to do a complete recovery and the output files are corrupted (e.g. doc/pdf files). We recommend to split a memory dump file into small parts of 256/512/1024MB (use the split option of FinFireWire in the memory dump section). Larger memory dump files can cause some limitations (image search (especially *.png files) can stuck, string search / display filter can be slow). Firewire can only access memory up to 4GB RAM. If a target system has more than 4GB of RAM installed, it could happen, the search pattern cannot be found. In this case the installed memory has to be reduced (can only be done with switched off systems). FinFireWire system must be disconnected before the feature can be used (otherwise target system can crash during the operation). If adapter reset failed and target still cannot be reached via firewire, reboot (only) FinFireWire system and try it again.

11 11