Shmoocon 2011 - Inside The App: All Your Data Are Belong To Me

INSIDE
THE APP: ALL YOUR DATA ARE BELONG TO ME

2011 Harris Corporation
Sarah Edwards oompa@csh.rit.edu, @iamevltwin Shmoocon January 2011
About Me
Digital Forensic Analyst with Harris Corporation Computer Intrusions
Free
time is used for iOS/Mac forensic research.
Works with the Feds

I
don t like wearing suits.
Not a hacker.
I
dont code/hack/exploit things. But I do like to get into things, Im nosy.

Objec;ves
iOS Applica;on Security Awareness

Inves;gators Users Developers Bad Guys?
What about Android/Blackberry/Windows?
Objec;ves
If you sit through this, youll get:

Contacts Pictures Documents Usernames Passwords Loca;onal Data much more.
It is so easy, almost too easy.
iOS Apps
Prevalence
iPhone iPad iPod Touch
How many Apps?

10 Billion downloads ~350,000 Apps
n
[hZp://www.buzzbiznews.com/035133/apple s-app-store-hits-10-billion-downloads/]
Recent News
viaForensics [viaforensics.com]
appWatchDog
Wall Street Journal

Current privacy lawsuit Data at Rest vs. Data in Transit
People vs. Diaz (California Supreme Court)

Gist: Pursuant to arrest, ocials can review your
cellphone.
Caveats
Third-party applications only. Redactionthis is a privacy talk after all. Lots of pictures Software Verification and Validation Evidence Admissibility Detailed acquisition techniques
ACCESSING THE DATA
State of Forensic Socware

There are many tools. Some are better than others. Some get only logical data. Some require the passcode. Most are expensive. rd Most do not auto-magically parse 3 party application data. Proprietary data output formats.
Backups vs. Physical vs. Logical

Backups Easy Access Historical Context Encryption Must have HDD Limited Data Physical Difficult to capture Up-to-date Access to physical device Potential to get EVERYTHING Encryption Logical Easy Access Up-to-date Access to physical device Limited to logical data
Backup Data Loca;ons
Windows
<APPDATA>\Apple
Computer\MobileSync
\Backup\ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup
Mac
~/Library/Application
Support/
MobileSync/Backup/
Backup Files (iOS 3.x)

mddata mdinfo Info.plist Manifest.plist Status.plist
Backup Files (iOS 4.x)

Info.plist Manifest.mbdb Manifest.mbdx Manifest.plist Status.plist
Socware for Backups
iPhone Backup Extractor

Mac only Available at supercrazyawesome.com Free! (Donations are welcome.)
Socware for Backups
iPhone Backup Extractor

Windows, Linux & Mac Available at:
n iphonebackupextractor.com
Free & Paid Versions
Socware for Backups
iBackupBot
Windows Only Available at:
n icopybot.com
Free Trial ($35)
Socware to Access Physical Device

Forensic Socware Jailbreak
SSH/DD/SCP
"Zdziarski" Method
NIST Approved LE/Military Only
Commercial Non-Forensic Socware

PhoneDisk PhoneView
PhoneDisk
Mac & Windows Available at: macroplant.com/phonedisk/ $20
PhoneView
Mac Available at: ecamm.com/mac/phoneview/ $20
Applica;on Directories
/private/var/mobile/Application (Actual Path, linked to /User/ Application) /User/Applications/########-####-####-####-############
Universally Unique ID
<Application_Home>/AppName.app Applica;on Bundle (Not Backed Up) <Application_Home>/Documents/ - Contains user documents and data les. (Backed Up) <Application_Home>/Library/ - Contains applica;on specic les. (Backed Up) <Application_Home>/Library/Preferences Applica;on Preference Files (Backed Up) <Application_Home>/Library/Caches Applica;on specic support les. Persistent between applica;on launches. (Not Backed Up) <Application_Home>/tmp/ - Temporary les, not persistent between applica;on launches. (Not Backed Up)
/User/Applica;ons Directory
Applica;on Directory
iTunesMetadata.plist
Contains informa;on such as:

Product Informa;on Purchase Data Apple Account Data
iTunesMetadata.plist
GOOD THINGS TO KNOW
Dates
Many use Absolute Time

Seconds from 1/1/2001 00:00:00 GMT
Tools:
Mac: CFAbsoluteTimeConverter
n (hsoi.com/hsoishop/socware/)
Windows: Dcode
n (digital-detec;ve.co.uk/freetools/decode.asp)
or add 978307200 and use date -ur
Popular File Formats - Plist
Property List
XML or Binary
Tools
Property List Editor
n Mac Only n Xcode n Free! (w/ Mac OS)
Ibackupbot Plist Editor

n Windows Only n icopybot.com/download.htm n Free!
Popular File Formats - SQLite
SQL-based rela;onal database
Tools
SQLite Database Browser
n Mac & Windows n sqlitebrowser.sourceforge.net n Free!
NOW TO THE GOOD STUFF
SOCIAL NETWORKING
Facebook v.3.3.3
/Documents/friends.db
Facebook Prole
hZp://www.facebook.com/prole.php?id=<UID>
User Picture (pic_square)
com.facebook.Facebook.plist
/Library/Three20
May contain:
Profile
Icons XML Text Files Album Photos Miscellaneous Pictures
/Library/Three20
<fql_result> <name>checkins_activity<name>
Contains User IDs & coordinates Lots of other data
/Library/Three20
<profile_response><user
Contains prole data.
n User ID n Last Load Time n Birthday n Name
n Hometown
n Rela;onship Status n Friend Count n Email n Etc.
n Link to user picture
/Library/Three20
<fql_result> <name>event<name>
Contains Event data
/Library/Three20
<stream_post>
Contains
Wall pos;ngs for a par;cular user in <source_id> Includes

Message n Client post came from (Web, TwiZer, etc.) n User comments that include who and when. n Links to photo aZachments n Link to permalink
n
hZp://www.facebook.com/<uid>/posts/ <post_id>
<post_id>
is aZached to the User ID by an underscore.
/Library/Three20
<photos_response>
Contains links to photos, including descrip;ons,
comments and user data.
<profile_response><album
Contains photo album informa;on.
LinkedIn v.3.5.2
com.linkedin.LinkedIn.plist
user Field (com.linkedin.LinkedIn.plist)
/Documents/connections_<memberid>.plist
/Documents/LinkedIn/
member_<memberid>.plist
member_<memberid>.plist
network_update_*
LinkedIn<GUID>.sqlite
ZBUZZTOPICOBJECT
ZLIMESSAGE
ZLIMESSAGEMEMBER
/Library/Caches/Three20/
SHOPPING & FINANCIAL
Amazon v1.3
com.amazon.Amazon.plist
Chase v.2.8.1202
User IDs
Mint v1.7.2
/Documents/mint_gala.db
E*Trade v1.8.4
User ID
Ebay v2.0.2
com.ebay.iphone.plist
Paypal v3.1
com.yourcompany.PPClient.plist
/Documents/PayPalUserDetailsCache
PageOnce Personal Finance

v3.84 & v4.01
Difference between v3.84 & 4.01
Difference between v3.84 & 4.01
GMAIL
iGmail v5.6.8
com.idemfactor.iGmail.plist
/Library/WebKit/Databases/ https_mail.google.com_0/0000000000000001.db
MultiG v1.3
/Documents/MultiG/People.sqlite
UTILITIES
TouchTerm v2.4.2
net.jbrink.mobile.TouchTerm.plist
connec;ons Field
/Documents/pinchmedia/*.sql
Anonymous Web Browser v2.0
/Documents/Cookies.plist
/Library/WebKit/LocalStorage/ http_www.google.com_0.localstorage
Quick Password Manager v2.2
com.yourcompany.passwd.plist
Passwords
MobileRSS HD Free v3.0
/Documents/<username>@gmail.com.sewng
/Documents/ <username>@gmail.com.sqlite
com.nibirutech.MobileRSSHDFree.plist
OpenTable v3.2
com.contextop;onal.OpenTable.plist
BLOGGING
Tumblr v1.2.2
/Documents/userData.mxdata
Unencrypted Password
Email
/Documents/textPost.details
WordPress v2.6.4
/Documents/wordpress/blogs.archive
/Documents/wordpress/<blog>.wordpress.com/ <blogid>/comment.1.archive
/Documents/wordpress/<blog>.wordpress.com/ <blogid>/post.1.archive
org.wordpress.plist
TRAVEL
TripIt v2.2.1
/Documents/TripIt.sqlite
Navigon v1.7
com.navigon.NavigonNorthAmerica.plist
Program Preferences
Audio Terrain POIs Speed Warnings Trac Etc.
/Library/Preferences/ com.navigon.NavigonNorthAmerica.plist
/Documents/LastSearchResult.dat
/Documents/Favourite.targets
/Documents/Recent.targets
FourSquare v2.2.2
/Documents/foursquare.sqlite
/Documents/foursquare.sqlite
DOCUMENTS & FILES
Evernote v3.4.2
com.evernote.iPhone.Evernote.plist
Evernote2.sqlite.md
Library/Caches/www.evernote.com
applog.txt
Evernote2.sqlite ZENSERVICEENTITY Table
Evernote2.sqlite
Dropbox v1.3.1
/Documents/Dropbox.sqlite
com.getdropbox.Dropbox.plist
com.getdropbox.Dropbox.plist
Content from DefaultsAccountInfoKey in bplist format, can be viewed by extracting into separate file shown below.
/Library/Caches/FavoriteFiles.plist
/Library/Caches/cache.db
Private Photo Lite v1.3
/Documents/
/Documents/photodb.sqlite
cn.mmxd.privatephotoslite.plist
TWITTER
Echofon v3.1.8
/Preferences/ net.naan.TwiZerFon.plist
db3.1.5.db
Contains user details:

n
users Table
TwiZer User ID n Name & Screen Name n User entered loca;on, descrip;on and website. n Count of followers/friends/favorites/tweets n Is the account protected or veried? n Link to prole icon (hZp://a2.twimg.com/prole_images/647123757/Muppet-Beaker_normal.jpg)
/Library/prole_images
hZp://a2.twimg.com/prole_images/ 647123757/Muppet-Beaker_normal.jpg
db3.1.5.db
hZp://twiZer.com/statuses/user_;meline/ 105533433.rss
db3.1.5.db
db3.1.5.db
Contains direct messages.

n
direct_messages Table
To & From (TwiZer IDs and Screen Names) n Dates
Library/Cookies/Cookies.plist
HootSuite v2.0.2
com.hootsuite.hootsuitelite.plist
Twitteriffic v3.0.2
/Documents/accounts.plist
Timeline
/Documents/searches.plist
Search Databases
Tweetdeck v1.4.1
/Documents/tddb.0.2.sqlite3
/Documents/column_cache_1
/Documents/tddb.0.2.sqlite3
COMMUNICATION
Skype v3.0
/Library/Preferences/com.skype.skype.plist
Skype Logs
Skype Logs
Skype Logs
Skype Logs
Skype Logs (Windows)
Skype Parsing Software

SkypeLogView Nirsoft
n Available n Free!
at: nirsoft.net/utils/skype_log_view.html
Skype
Parser
n Redwolf
Computer Forensics n Available at: redwolfcomputerforensics.com/downloads/ skype-log-installer-1.7.exe
AIM (Free) v4.5.2
com.aol.aim.plist
/Documents/userAccounts/<GUID>.account
/Documents/userAccounts/ <GUID>.buddylist
/Documents/userAccounts/<GUID>.history
WRAPPING UP

Shmoocon 2011 - Inside The App: All Your Data Are Belong To Me

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Shmoocon 2011 - Inside The App: All Your Data Are Belong To Me

Uploaded by

Copyright:

Available Formats

INSIDE

THE APP: ALL YOUR DATA ARE BELONG TO ME

time is used for iOS/Mac forensic research.

Works with the Feds

don t like wearing suits.

dont code/hack/exploit things. But I do like to get into things, Im nosy.

iOS Applica;on Security Awareness

What about Android/Blackberry/Windows?

2011 Harris Corporation

If you sit through this, youll get:

It is so easy, almost too easy.

2011 Harris Corporation

How many Apps?

2011 Harris Corporation

Wall Street Journal

People vs. Diaz (California Supreme Court)

2011 Harris Corporation

2011 Harris Corporation

ACCESSING THE DATA

2011 Harris Corporation

State of Forensic Socware

2011 Harris Corporation

Backups vs. Physical vs. Logical

2011 Harris Corporation

Backup Data Loca;ons

\Backup\ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup

2011 Harris Corporation

Backup Files (iOS 3.x)

2011 Harris Corporation

Backup Files (iOS 4.x)

2011 Harris Corporation

Socware for Backups

iPhone Backup Extractor

Mac only Available at supercrazyawesome.com Free! (Donations are welcome.)

2011 Harris Corporation

Socware for Backups

iPhone Backup Extractor

Free & Paid Versions

2011 Harris Corporation

Socware for Backups

Free Trial ($35)

2011 Harris Corporation

Socware to Access Physical Device

Commercial Non-Forensic Socware

2011 Harris Corporation

Socware to Access Physical Device

2011 Harris Corporation

Socware to Access Physical Device

2011 Harris Corporation

/private/var/mobile/Application (Actual Path, linked to /User/ Application) /User/Applications/########-####-####-####-############

2011 Harris Corporation

2011 Harris Corporation

2011 Harris Corporation

Contains informa;on such as:

2011 Harris Corporation

2011 Harris Corporation

GOOD THINGS TO KNOW

2011 Harris Corporation

Many use Absolute Time

or add 978307200 and use date -ur

2011 Harris Corporation

Popular File Formats - Plist