Category Archives: Microsoft

High-tech sleuthing a geek’s dream for recently retired Victoria detective

Quote

Posted on by
Reply

An article from (http://www.timescolonist.com/) about Bob Elder one of the most knowledgeable Mobile Phone Forensic Examiners there is.

vka retire 344501 jpg High tech sleuthing a geeks dream for recently retired Victoria detective

In Bob Elder’s expert hands, a cellphone is a gold mine of crime-fighting information.

 

Elder recently retired from his job as a detective-constable with the Victoria Police Department. His last seven years on the force were spent with the Computer Forensic Unit, honing his ability to pull data from electronic devices.

 

The 51-year-old has developed such a knack for what he does that his knowledge is sought around the world — the result of a reputation gained from a regular travel schedule to teach his techniques to other professionals. As a result, he is often asked to weigh in on cases from far afield.

 

“I just did work on a homicide in Delaware,” Elder said, explaining that the case involved a man who killed his wife but claimed to have found her dead in the house.

 

“Based on using one of these advanced techniques, we were able to determine that he had actually been Googling the event from the time he killed her to the time it was reported to police. In that hour, he was Googling it to see if it had been reported, so that put him at the scene.”

 

Elder’s work has also meant dealing with child-pornography cases, including an investigation of a Victoria juvenile that took on international proportions. The juvenile turned out to be trading child pornography with people around the world, and Elder and others were able to delve into the operation by extracting chat logs and contact lists from a hard drive.

 

That led to a string of arrests in other locations over the next three or four years and the rescue of a number of children. Elder said the success and scope of the outcome makes it stand out among his cases.

 

Elder’s police career includes eight years as a Saanich reserve officer and 131Ú2 years with VicPD — time that also included a stint with the Strike Force, an undercover surveillance squad focused on drug cases. He said he jumped at the chance to work in computer forensics.

 

“I was always a geek from way back, so when the job came up to become part of the unit, I applied for it and got it.”

 

Elder’s role in cellphone-related investigations usually involves getting into the guts of the device, taking it apart and looking for data. He said criminals may lock their phones, but that won’t stop police.

 

“That’s where my expertise kind of comes in,” Elder said. “I deal mainly with the advanced mobile forensics at what we call the physical level, so I’m dealing with the actual memory chips on the [circuit] board as opposed to the device itself.”

 

Much of Elder’s knowledge has come from work done on his own time, and the results are considered groundbreaking, said Victoria police spokesman Bowen Osoko.

 

“I just had a passion for it,” Elder said.

 

Life beyond police work will involve transferring his skills to the private sector with Teel Technologies, an American mobile-device forensics company expanding into Canada. Elder will head up the company’s Canadian operations.

 

His new job will change his travel itinerary, which was previously confined to North America.

 

“Starting in June and July, I start teaching in the U.K., Germany, Brunei and other countries. All of these countries now are looking for that technology to be able to get into these phones.”

 

Following wider trends, police have been looking at fewer and fewer computers, and considerably more mobile devices, Elder said. Victoria police examine about 300 cellphones a year, he said.

 

“The trend is within five to seven years, they expect people won’t have computer towers in their house. It’ll all be smartphones or tablets, that kind of thing.”

 

Information gleaned from cellphones fits in well with the legal process, Elder said

 

“Things that we can find on them would include call logs, contacts, text messaging. Some of the cellphones now can hold up to 3,000 or 4,000 text messages, so that gives us pretty good evidence toward the file,” he said.

 

“If it’s a drug dealer and he’s got a thousand text messages, arranging buys and all of that kind of stuff, it’s really conclusive evidence when we take that to court.”

 

Elder’s retirement was accompanied by a Commendation for Meritorious Service from Victoria Police Chief Jamie Graham.

 

High-tech sleuthing a geek’s dream for recently retired Victoria detective – World – Times Colonist.

6 Persistent Challenges with Smartphone Forensics

Quote

Posted on by
Reply

smartphone040313 6 Persistent Challenges with Smartphone ForensicsSmartphones, the most popular mobile communications devices today, are also some of the most difficult to extract evidentiary data from. While many commercial forensic tools have made great strides in supporting data extraction, decoding, and analysis from iOS, Android, and BlackBerry devices, some challenges remain. What are they, and how are vendors responding?

1. A smartphone is never just a smartphone.
Vendors and operating systems can vary widely, particularly with Android, but also even within iOS and BlackBerry user groups. More than 40 iOS versions are commercially available, and are spread among six different iPhones, five iPads, and five iPod Touch devices.

As of 2012, the Google-owned Android is the rising star in the mobile industry. In the third quarter it was reported to have nearly 75% market share compared to less than 20% for iOS and less than 10% for BlackBerry. Based on a Linux kernel and able to run Java apps, each Android device family has a different operating system and architecture, and thus requires a dedicated solution. Complicating matters, some manufacturers—among them Alcatel, Huawei, and Motorola—have begun to use nonstandard Chinese chipsets, particularly MTK, in their Android devices.

Unlike iPhone users, it’s unusual for Android users to upgrade their operating systems. (Currently, the “old” Gingerbread, Android v2.3, remains the most popular OS; it’s installed on nearly half of all Android devices compared to Android 4.1, “Jelly Bean,” which runs on only about 10% of devices. Android 4.0, “Ice Cream Sandwich,” is installed on just under 30% of Android devices.) It’s also not possible to upgrade from just any version.

2. Data protection: passwords and encryption
Not only does data storage vary from device to device and OS to OS, but devices may also be passcode-protected and/or encrypted.

Obviously, it is easy to extract data from a smartphone with no passcode. iPhone passcodes fall into two categories: simple and complex. A mobile data extraction tool should be able to reveal a simple passcode automatically for all devices through iPhone 4; owing to improved Apple security measures, passcode extraction and bypass are not yet supported for iPhone 4s or iPhone 5. Following the passcode extraction process, it will be possible to extract and decrypt all data including protected files.

A complex iPhone passcode, however, takes more effort. The investigator needs to know, and manually insert, this type of passcode in order to extract and decrypt all data. This may take interviewing the subject or the subject’s close contacts. If the investigator cannot figure out what the passcode is, no mobile forensic tool exists that can bypass it. Some data can be extracted and decrypted, but not protected files.

Keychains are another important element of iOS password protections. The vault that stores passwords for any variety of services—social media accounts, WiFi connections, and so forth—the keychain is encrypted and protected. It should be possible for a mobile forensics tool to decrypt the keychain and thus provide the examiner with access to additional data, which may not be otherwise possible.

Like iPhones, Android devices can also be user-locked. Unlike iPhones, they often use a pattern lock which is typically not complex. Rooting the device, even temporarily, cannot be done with a locked device unless debug mode is enabled. This operation takes considerable expertise on the examiner’s part.

Bypassing the pattern lock altogether is optimal. A file system or physical extraction, once decoded, will provide the correct pattern or PIN code used to lock the device. Alternatively, if decoding is unsupported within the extraction tool, it should be possible to carve the PIN lock.

Following a physical extraction, a file system extraction using the pattern lock and ADB mode should be possible. However, not all physical extractions from every Android are also supported for decoding. That’s because chipsets and hardware can vary from device to device, which affects whether a forensic tool can reconstruct the file system.

In some cases, when the passcode or pattern lock cannot be bypassed, it may be possible to reveal the lock code, then turn on ADB debugging and perform a file system extraction. This effectively eliminates the need to reconstruct the file system from a physical extraction.

Encrypted content is a different matter. The BlackBerry, for example, requires codes to lock the device and then encrypt the content. The device lock is associated with encryption: the user can’t encrypt the content without first locking the device.

Although it may therefore be possible to extract some unencrypted data from before the device was locked, it is usually not possible to decrypt BlackBerry content without access to the password. Often, the examiner must get the user to provide the password and encryption key.

When the device belongs to an organization—the user’s employer—it may be possible to ask IT staff to reset the encryption key through the BlackBerry Enterprise Server (BES). The content will still be encrypted, but the device will be using a generic key. On devices running OS 4, 5, and 6, it may then be possible to decrypt the content on the fly, analyzing and then showing the data in readable format.

3. Prepaid “burner” phones
Prepaid phones have been a problem for some time, and continue to be a problem for law enforcement in particular. That’s because the disabled data port on these devices cannot be enabled, and vendors don’t make the devices’ APIs—the normal mode by which logical and file system extractions are completed—available to commercial forensic extraction tools’ developers.

File system extractions have the dual benefit of making more data—including some deleted data—available quickly. However, because it extracts only data from allocated space on a device’s memory, it still remains limited in some ways. It also requires a higher degree of expertise on the examiner’s part because it requires decoding.

Physical extraction, the bit-for-bit copy of the device’s internal flash memory, provides the fullest amount of accurate data because it obtains information from both allocated and unallocated space. However, it can be time consuming even with a good forensic tool; it requires decoding, and therefore demands the examiner to have explicit training or expertise.

4. There’s no app for that
Apps, not just available for iPhone or Android but also through device vendors like Samsung, Nokia, and LG—as well as from mobile carriers like T-Mobile and retailers like Amazon—are another challenge.

Apps are diverse, ranging from travel tools like navigation, traffic information, and weather; to social networking and location sharing; to banking and finance; to communications tools such as chat, instant messaging, and voiceover IP; to entertainment tools like video, television and radio broadcasting, and gaming. Hundreds of thousands of apps exist; billions of downloads have occurred.

Forensic tools’ support for mobile apps has only just begun in the past year or so, and covers only the most popular apps. iOS apps are sandboxed, so all of a single app’s data will be in its particular folder. With Android, however, this is not the case. At least some app data will be available with a logical or file system extraction.

However, obtaining app data through physical extraction means decoding. To decode app data, the mobile forensic tool must be able to perform a file system reconstruction. This is a challenging process owing to the way Flash file systems are implemented: designed to avoid delete cycles, they keep deleted information in the device’s memory. However, once the Flash file system has been reconstructed, it’s possible to start decoding the content, including locations, Bluetooth devices, device information, cookies, installed apps, Web history, and so on.

Because the SQLite databases that compose iOS and Android file systems can provide access to available and deleted databases, including deleted entries from a database, the ability to view tables and content—and search the data—can be of great evidentiary value.

5. Accurate data, forensic soundness
Boot loaders are currently considered the most forensically sound physical extraction method. While they do involve loading a piece of code onto the device, this happens before the forensic tool accesses any evidentiary data.

That’s because they replace the device’s normal boot loader, or the first set of operations that kick off the phone’s startup process and hand off to the main controlling program, like the operating system, which supports the main or major device operations. In addition, the operation they enable—the extraction—is read-only.

Boot loaders have the additional advantages of being generic and therefore applicable to entire device families—not specific devices. And they enable access to unallocated areas for a fully accurate extraction.

In some Android devices, however, boot loader use is not supported, and it may become necessary to temporarily root the device to perform physical extraction. A temporary root does not permanently change administrative permissions or other data on the device. Rather, it provides access to the operating system so that the examiner can enable ADB debugging and from there, image the device’s Flash memory for a full physical extraction. Following this process, upon reboot, the device is no longer rooted.

Temporary rooting is not as forensically sound as a boot loader because it does load the device’s operating system, which may be logged within the device. Examiners using this method should plan to thoroughly document each step they take throughout the process, and their results, in order to maintain a record of their actions to which they can comfortably testify at trial.

6. Some smartphone extractions remain unsupported.
What happens when a smartphone is locked and unsupported by forensic tools? Flasher box, JTAG, or chip-off extraction methods become necessary. All three enable physical extraction—a logical examination cannot be performed on an unsupported locked device. However, even this capability can be limited. For example, although it’s possible to use the chip-off process on an iPhone locked with a complex passcode, the data will be encrypted and thus not much use.

Both JTAG and flasher box methods are device-specific, and JTAG processes are only minimally documented, so they require an examiner to be well trained. Flasher boxes also require training, as they can be destructive and were made to write data; thus, in the hands of an untrained examiner, they may not be forensically sound. Chip-off extraction, meanwhile, is always destructive, as it physically removes residual data from the memory chip.

This is often the case with BlackBerry devices that are locked with unknown passwords. Until recently, BlackBerry chip-off data format was proprietary, and no commercial tools could decode it. Ongoing research and development in this area has enabled some vendors to provide decoding support for chip-off extractions.

Indeed, smartphone forensics is the result of years of research by many dozens of professionals, both commercial and freelance. That research can range from reverse engineering the device’s hardware, firmware, and communication protocols; to exploiting vulnerabilities within the device’s firmware, operating system, or encryption algorithms (often the result of programming oversights).

As smartphones evolve, so will their persistent forensic challenges. Analysis skills like data carving, programming that can add functionality to commercial tools, and labor-intensive techniques such as JTAG, chip-off, and flasher box procedures will continue to be necessary—as will the tools that can support these efforts.

As Cellebrite USA’s Engineering Product Manager, Ronen Engler ensures that Cellebrite’s forensics-focused R&D teams issue new features and releases to meet customer needs. Having worked in Fortune 1000 companies as well as startups, Ronen has nearly 20 years of practical electrical engineering experience and an M.S.E.E degree from NYU-Poly.

Christa M. Miller is the Director of Mobile Forensics Marketing for Cellebrite USA. Christa has worked for more than 10 years as a journalist, specializing in digital forensics and other high tech topics for public safety trade magazines including Law Enforcement Technology, Police & Security News, NW3C’s The Informant, and others. Christa is based in South Carolina.

6 Persistent Challenges with Smartphone Forensics | DFI News.

Incoming search terms:

  • forensic tool

How Hard is It to ‘De-anonymize’ Cellphone Data?

Quote

Posted on by
Reply
how 17 How Hard is It to De anonymize Cellphone Data? Rendering by Christine Daniloff/MIT of an original image by Yves-Alexandre de Montjoye et al.

The proliferation of sensor-studded cellphones could lead to a wealth of data with socially useful applications — in urban planning, epidemiology, operations research and emergency preparedness, among other things. Of course, before being released to researchers, the data would have to be stripped of identifying information. But how hard could it be to protect the identity of one unnamed cellphone user in a data set of hundreds of thousands or even millions?

According to a paper appearing in Scientific Reports, harder than you might think. Researchers at MIT and the Université Catholique de Louvain, in Belgium, analyzed data on 1.5 million cellphone users in a small European country over a span of 15 months and found that just four points of reference, with fairly low spatial and temporal resolution, was enough to uniquely identify 95 percent of them.

In other words, to extract the complete location information for a single person from an “anonymized” data set of more than a million people, all you would need to do is place him or her within a couple of hundred yards of a cellphone transmitter, sometime over the course of an hour, four times in one year. A few Twitter posts would probably provide all the information you needed, if they contained specific information about the person’s whereabouts.

The first author on the paper is Yves-Alexandre de Montjoye, a graduate student in the research group of Toshiba Professor of Media Arts and Science Sandy Pentland. He’s joined by César Hidalgo, an assistant professor of media arts and science; Vincent Blondel, a visiting professor at MIT and a professor of applied mathematics at Université Catholique; and Michel Verleysen, a professor of electrical engineering at Université Catholique.

Focusing the debate
Hidalgo’s group specializes in applying the tools of statistical physics to a wide range of subjects, from communications networks to genetics to economics. In this case, he and de Montjoye were able to use those tools to uncover a simple mathematical relationship between the resolution of spatiotemporal data and the likelihood of identifying a member of a data set.

According to their formula, the probability of identifying someone goes down if the resolution of the measurements decreases, but less than you might think. Reporting the time of each measurement as imprecisely as sometime within a 15-hour span, or location as imprecisely as somewhere amid 15 adjacent cell towers, would still enable the unique identification of half the people in the sample data set.

But while its initial application may be discouraging, de Montjoye and Hidalgo hope that their formula will provide a way for researchers and policy analysts to reason more rigorously about the privacy safeguards that need to be put in place when they’re working with aggregated location data.

“Both César and I deeply believe that we all have a lot to gain from this data being used,” de Montjoye says. “This formula is something that could be useful to help the debate and decide, OK, how do we balance things out, and how do we make it a fair deal for everyone to use this data?”

Everybody’s different
In the data set that the researchers analyzed, the location of a cellphone was inferred solely from that of the cell tower it was connected to, and the time of the connection was given as falling within a one-hour interval. Each cellphone had a unique, randomly generated identifying number, so that its movement could be traced over time. But there was no information connecting that number to the phone’s owner.

The researchers randomly selected a representative sampling from the set of 1.5 million cellphone traces and, for each trace, began choosing points at random. For 95 percent of the traces, just four randomly selected points was enough to distinguish them from all other traces in the database. In the worst (or, from another perspective, best) case, 11 measurements were necessary.

“There’s a concern with this data, to what extent can we preserve anonymity,” says Luis Bettencourt, a professor at the Santa Fe Institute who studies social systems. “What they are showing here, quite clearly, is that it’s very hard to preserve anonymity.”

But for Bettencourt, the uniqueness of people’s trajectories through cities is itself precisely the type of information that analysis of cellphone data is meant to uncover. “This is interesting, from a scientific point of view, to understand how people use urban space,” Bettencourt says. “It shows what kind of social systems cities are.”

The researchers suspect that similar relationships might hold for other types of data. “I would not be surprised if a similar result — maybe requiring more points — would, for example, extend to web browsing,” Hidalgo says. “The space of potential combinations is really large. When a person is, in some sense, being expressed in a space in which the total number of combinations is huge, the probability that two people would have the same exact trajectory — whether it’s walking or browsing — is almost nil.”

How Hard is It to ##Q##De-anonymize##Q## Cellphone Data? | DFI News.

Smartphone File Traces Sent to the Cloud

Quote

Posted on by
Reply

smartphone Smartphone File Traces Sent to the CloudWhen smartphone users upload files to cloud-based services, remnants of those files often remain on their handheld device, even if the data is meant to be stored only in the cloud, researchers have found.

The consequence is that hackers could potentially access files stored in the cloud, or get access to cloud accounts, using leftover data stored on your Android device, iPhone or other smartphone.

“That smartphones can essentially remember deleted information poses a huge risk to organizations that issue smartphones to employees and to organizations that don##Q##t explicitly disable the use of personal devices for work-related computing,” says Pravin Kothari, founder and CEO of CipherCloud, a maker of cloud encryption software.

The tracing of leftover data on smartphones is not for the layperson, Kothari says, but could be looked at as the modern-day equivalent of Dumpster-diving for personal information.

Smartphone File Traces Sent to the Cloud | DFI News.

Incoming search terms:

  • criminal and routine activities in online settings: gangs offenders and the internet

Microsoft got over 75,000 law enforcement info requests in 2012

Quote

Posted on by
Reply

Microsoft has decided to do something today it has never done before; it is revealing just how many requests it received for information about customer accounts from law enforcement authorities. The reveal comes in the form of Microsoft##Q##s first Law Enforcement Requests Report, which will apparently be released every six months from now on.

The report states that in 2012, the company received 75,378 law enforcement requests. That total included Microsoft##Q##s Skype division. Microsoft said the requests would have affected about 137,424 customer accounts. Microsoft added the number of requests impacted less than two one-hundredths of one percent of all of the accounts that are recorded by the company.

Microsoft said that 18 percent of the requests resulted in no information being given to law enforcement authorities, “either because Microsoft rejected the request or because no customer information was found.” Microsoft did disclose what it called “non content information” for 79.8 percent of the law enforcement requests in 2012. Actual content disclosures were given to authorities for 1,558 requests, which comprised 2.2 percent of the total law enforcement requests.

In a blog post, Microsoft said that of that small number of accounts that did have content disclosed, over 99 percent were in response to what the company called “lawful warrants from courts in the United States.” Only 14 account content disclosures were given outside the U.S. to the governments of Brazil, Ireland, Canada and New Zealand.

The Skype division received 4,713 requests from law enforcement but did not disclose any content from those requests. Microsoft stated that it did provide non-content data, ” .. such as a SkypeID, name, email account, billing information and call detail records if a user subscribed to the Skype In/Online service, which connects to a telephone number.” Microsoft says that it requires a “court order or warrant before we will consider releasing a customer’s content to law enforcement.”

Microsoft got over 75,000 law enforcement info requests in 2012 – Neowin.

Malware attack poses as security warning from Microsoft Digital Crimes Unit

Quote

Posted on by
Reply

Windows users – do you take your computer##Q##s security seriously?

If so, you might decide to take prompt action when you receive an email seemingly from the Microsoft Digital Crimes Unit.

But that would actually be a big mistake.

You may remember that the Digital Crimes Unit at Microsoft are the folks who have worked hard to bring down botnet servers, including those associated with Zeus, and investigated suspected malware authors.

Here##Q##s what today##Q##s spammed-out email, which uses the subject line “Security”, looks like:

Malware attack poses as security warning from Microsoft Digital Crimes Unit

Dear Email User,

Due to a new vulnerability which is exploited by hackers to steal your online details.

Microsoft Digital Crimes Unit in 2013 has hereby developed a new security measure.

All users of the Internet and Microsoft products are hereby required to validate there email account information irregardless of their Internet service provider or Host company.

To validate your email account and to prevent hackers from exploiting the new vulnerability.

Please download the "Microsoft_STF" file attached, extract the file on to your desktop and open.Once done you will updated on Microsoft security database.

Please note that if your email is not validated, your email will be at risk for hackers getting into your personal or business email account there by getting access to classified or privileged information.

2013 Microsoft Digital Crimes Unit

Attached to the email is a file called Microsoft_STF_install.zip. And, according to the above email, “all users of the internet” should run the program to validate “there” (sic) email account.

Sounds serious, right?

Well, hopefully most of you will be rightly suspicious (even if it didn##Q##t contain spelling mistakes) of the unsolicited email and too wise to blindly run a program just because of instructions which claim to come from Microsoft.

Sophos products detect the attached file as the Troj/Agent-AANA Trojan horse.

The irony of a cybercriminal attack posing as the Microsoft Digital Crimes Unit, and using the fear of vulnerabilities and malware infection to trick users into unwittingly compromising their Windows computers shouldn##Q##t be lost on any of us.

Sadly, these kind of scare tactics are exactly the kind which will fool some people.

Be careful out there.

PS. You can read about the real Microsoft Digital Crimes Unit here.

Malware attack poses as security warning from Microsoft Digital Crimes Unit | Naked Security.