2. Devices used –
Examples in this presentation are demonstrated on the following
devices:
Google Galaxy Nexus HTC Thunderbolt
(ICS 4.0.3, Samsung) (Gingerbread 2.3.4)
2
3. A quick overview of Android Devices –
Software :
§ A patched version of Linux OS kernel
§ Overhauled user space, bionic libc, utilities
§ Application security based uid, gid: 1 uid per application to protect each app’s
space from other apps
§ Permission model to access system resources (e.g. phone HW, databases, etc)
§ Run Java applications in Dalvik VM environment
§ Can run native applications through JNI
Hardware:
§ Mostly ARM based, x86 becoming more popular
§ Form factors: smartphones, tables, TVs, ebook readers, refrigerators, etc
4. Outline
Android System Acquisition and Analysis
Analyzing Android Applications
Other tools and references
4
5. The 3 levels of accessing data on an Android Device – Accessing the Device,
Physical Extraction, and Logical Extraction
Physical Data Logical Data
Device access Extraction Extraction
1 2 3
5
7. Bypassing Security – Bypassing pattern by Smudge Attack
__:
• There are research and proposals
that suggest that one can detect the
Android security pattern by examining
screen’s touch residue
• While there are some merits in these,
still it is pretty hard to do this
consistently.
Smudge pattern on a device: Before and
after contrast adjustment
Photography and Lighting setup
Source: Smudge Attacks on Smartphone Touch Screens, By: Adam J. Aviv, et al.
7
8. Bypassing Security – Bypassing security code
__: you can find user’s gmail account information, then Android will allow you to
• If
reset the pass code (after 5 attempts)
• If not:
• Reboot to bootloader mode (or press down-volume + power, etc)
$ adb reboot bootloader
• Using fastboot, load a different ROM (e.g. Clockwork recovery image)
• Remove the key file related to challenge
$ adb shell!
$ su
# cd /data/system!
# rm gesture.key!
Or in case of password or PIN:
# rm password.key!
!
Source: Smudge Attacks on Smartphone Touch Screens, By: Adam J. Aviv, et al.
8
9. Network isolation – Making device unreachable
A shielded box or tent (Faraday cage) can isolate the device and prevent it
from being manipulated remotely.
A
Faraday
tent
Don’t try
this at
Home!
A Faraday cage work desk
9
11. Android Mass Storage – MTD, FTL, MMC, eMMC
§ The Linux kernel is designed to deal with Block (sectorized) storage
devices
§ Raw flash storage is not a block device
§ SSD, MMC, eMMC, RS-MMC, SD, mini-SD, micro-SD, USB flash
drive, CompactFlash, MemoryStick, MemoryStick and other FTL
devices are block devices, not raw flash devices, meaning FTL is
built in to HW
§ To use a conventional file system – e.g. ext2, ext3,ext4, XFS, JFS,
FAT on top of a raw flash device an abstraction layer AKA “Flash
Translation Layer” or FTL is needed
Source: http://www.linux-mtd.infradead.org/faq/general.html
11
12. Android Mass Storage – MTD, FTL, MMC, eMMC
More recent Android devices use eMMC which is a block device and does not
require software FTL, hence no MTD
Applications
Applications
Files system
e.g. YAFFS2
Files system
FTL e.g. ext4
MTD (SW)
FTL
Raw Flash (HW) Raw Flash (HW)
Earlier Android devices More recent Android devices
12
13. Android Mass Storage – MTD, FTL, MMC, eMMC
§ MTD (Memory Technology Device) provides a very simple FTL:
Block interface, ECC, wear leveling and few other functions
§ Most current Android devices use the FTL that comes with MTD
(mtdblock)
§ Wear leveling writes rewritten logical blocks to avoid writing
physical blocks repeatedly until all blocks have been utilized
Stage 2 stage 1
Wear leveling in FTL
Source: http://lwn.net/Articles/428793/
13
14. Android Mass Storage – SD and eMMC
§ Android’s partitions: /dev/block, /dev/mtd, etc
# cat /proc/mtd!
dev: size erasesize name!
mtd0: 00100000 00001000 "w25q80"!
# shell@android:/dev/mtd # ls -l /dev/mtd!
crw-rw---- media media 90, 0 2012-05-10 02:54 mtd0!
crw------- root root 90, 1 2012-05-10 02:54 mtd0ro!
14
15. Physical data extraction– Write blockers
• When performing physical
extraction, use a write blocker to
protect the data on the device
against accidental / malfunction
writing
• The last option which often is USB Write Blocker
destructive to the device, is to un-
solder the flash chip and use
special tools to read its content
USB Write Blocker
15
17. Physical data extraction – dd, dc3dd
!
# dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/cache !
"of=/sdcard/cache.imgdd!
!
!
On the host:!
$ adb pull /sdcard/userdata.imgdd ./userdata.imgdd!
!
$ od –x userdata.imgdd!
!
$ strings userdata.imgdd | grep <desired pattern regex>!
!
!
17
18. JTAG, Chip-off – The last resorts
• If all other access methods fail,
JTAG access or chip-off (de-
soldering of the flash chip) can
provide access to the device’s
internal flash:
• With JTAG (and using a tool
such as Riff-Box) – it is possible
put the CPU in debug mode Samsung Galaxy S JTAG pin-outs
and dump the content of
internal flash
• The last option which often is
destructive to the device, is to
un-solder the flash chip and use
special tools to read its content
Connecting Galaxy S to Riff-Box
Source: http://www.bongozone.com/jtag-service-i9000-unbrick-others/
18
20. Getting ready for logical extraction: to Root or Not to Root –
n Rooting can potentially change the status of the data on the device, and
destroy information
Rooting an Android n Nonetheless, a rooted device provides full access, and for most of the
device techniques here, rooting is needed
n ROM is the collection of stuff that makes your device to work:
§ Kernel
§ The rest of the OS
§ Drivers
§ Configuration files
§ System apps
n ROMs are usually provided by the manufacturer and get customized by the
mobile operator
n There are also custom ROMs that enhance some functions of the standard
ROM that comes with the device and remove some of the limitations e.g.
CyonegenMod ROM
n Before you can run a custom ROM, you need to to recovery mode, flash the
ROM file
20
21. Three different ways to perform logical extraction on an Android device:
n Can be done recursively
adb pull n Use tar to create archive
n User gzip to compress
Logical extraction n Access to over sql databses on the devices including
in Android system apps
sqlite3! n No programming needed
n Can use familiar sql statements
Accessing n Can be done programmatically
Content n Can be used to build forensic data collection tools
Providers n Access to over 45+ Content Providers on the device
21
22. Getting ready for logical extraction – Busybox
n Get and install Busybox on the device
Busybox:
most commonly Unix
commands in Android
shell
22
23. Getting ready for logical extraction – BusyBox
# busybox!
BusyBox is a multi-call binary that combines many common Unix utilities into a single
executable. Most people will create a!
"link to busybox for each function they wish to use and BusyBox will act like whatever
it was invoked as.!
!
Currently defined functions:!
"[, [[, ash, awk, base64, basename, blkid, bunzip2, bzcat, bzip2, cal,!
"cat, chat, chattr, chgrp, chmod, chown, chroot, chrt, cksum, clear,!
"comm, cp, crond, crontab, cut, date, dd, depmod, devmem, df, diff,!
"dirname, dmesg, dnsd, dnsdomainname, dos2unix, du, echo, egrep, env,!
"ether-wake, expand, expr, fakeidentd, fdflush, fdformat, fdisk, fgrep,!
"find, fold, free, freeramdisk, fsck, fsync, ftpd, ftpget, ftpput,!
"getopt, grep, groups, gunzip, gzip, hd, head, hexdump, hostid,!
"hostname, httpd, hwclock, id, ifconfig, ifenslave, inetd, inotifyd,!
"insmod, install, ionice, iostat, ip, ipaddr, ipcalc, iplink, iproute,!
"iprule, iptunnel, kill, killall, killall5, less, ln, logname, losetup,!
"ls, lsattr, lsmod, lsof, lsusb, lzop, lzopcat, md5sum, microcom, mkdir,!
"mkdosfs, mke2fs, mkfifo, mkfs.ext2, mkfs.vfat, mknod, mkswap, modinfo,!
"modprobe, more, mount, mountpoint, mt, mv, nameif, nanddump, nandwrite,!
"nc, netstat, nice, nmeter, nslookup, ntpd, od, patch, pgrep, pidof,!
"ping, ping6, pkill, pmap, powertop, printenv, printf, ps, pscan, pwd,!
"rdate, rdev, readahead, realpath, renice, reset, rev, rfkill, rm,!
"rmdir, rmmod, route, run-parts, script, scriptreplay, sed, seq,!
"...!
"test, tftp, tftpd, time, timeout, top, touch, tr, traceroute,!
"traceroute6, tty, ttysize, tunctl, umount, uname, uncompress, unexpand,!
"uniq, unix2dos, unlzop, unzip, uptime, usleep, uudecode, uuencode,!
"vconfig, vi, watch, wc, wget, which, who, whoami, whois, xargs, zcat!
23
24. Getting ready for logical extraction – sqlite3
n Get and install sqlite3
1. Only available on some development devices
Getting
sqlite3 e.g. Google Nexus series
2. You can get it from sqlite.org (source code), and compile/built/etc
3. Easiest way is to get from your emulator installation:
"$ cd /Applications/android-sdk-macosx/tools!
"$ adb push ./sqlite3 /system/xbin/sqlite3!
"$ adb shell !
"$ su!
"# cd /system/xbin!
"# chmod 755 sqlite3!
24
28. Logical extraction: snooping around with sqlite3 -
# shell@android:/ # find data -name "*.db" -print | wc -l !
74 (this is nonly for this device)!
# find data -name "*.db" –print /data/data/!
data/data/com.google.android.browser/app_appcache/ApplicationCache.db!
data/data/com.google.android.browser/app_databases/Databases.db!
data/data/com.google.android.browser/app_geolocation/CachedGeoposition.db!
data/data/com.android.providers.calendar/databases/calendar.db!
data/data/com.android.providers.contacts/databases/profile.db!
data/data/com.android.providers.contacts/databases/contacts2.db!
data/data/com.android.providers.downloads/databases/downloads.db!
data/data/com.google.android.email/databases/EmailProvider.db!
data/data/com.google.android.gm/databases/internal.mometan@gmail.com.db!
data/data/com.google.android.gm/databases/mailstore.mometan@gmail.com.db!
data/data/com.google.android.gm/databases/webviewCookiesChromium.db!
data/data/com.google.android.music/databases/music.db!
data/data/com.android.providers.telephony/databases/telephony.db!
data/data/com.android.providers.telephony/databases/mmssms.db!
data/system/accounts.db!
!
DISCLAIMER: Names and other information are fictional .All data is for presentation purposes only.
28
30. Logical extraction: snooping around with sqlite3 –
# sqlite3 /data/data/com.android.providers.contacts/databases/contacts2.db!
!
Sqlite> .schema accounts!
CREATE TABLE accounts (account_name TEXT, account_type TEXT, data_set TEXT);!
sqlite> select * from accounts;!
||tanabianmoe@gmail.com|!
!
sqlite> .mode line;!
sqlite> select data1 from data;!
||tanabianmoe@gmail.com|!
!
!
sqlite> select * from data;!
!
8448||9|1154|0|0|0|0||||||||||||||||https://www.google.com/m8/feeds/photos/media/tanabianmoe%40gmail.com/
595d6cef09539135|||0!
8449||7|1154|0|0|0|0|John Ford|John|Ford|||||||1|3||||||||10!
8450||11|1154|0|0|0|0|||||||||||||||||||10!
8451||3|1154|0|0|0|0|||||||||||||||||||10!
8452||12|1154|0|0|0|0||||||||4|5||||||||||10!
8453||1|1154|0|1|0|1|john.ford@myemail.com|1|||||||||||||||||10!
8454||8|1154|0|0|0|0|123 Spring Dale st.!
Beverly Hills, CA 90210!
USA|1||123 Spring Dale st.|||Beverly Hills|CA|90210|USA|||||||||10!
8455||10|1154|0|0|0|0|8||||||||||||||||||10!
8456||5|1154|0|0|0|0|+1-310-555-1876|2||+13105551876|||||||||||||||10!
8457||15|1154|0|0|0|0|www.johnfordontheweb.com|3|||||||||||||||||10!
8458||9|1155|0|0|0|0||||||||||||||||https://www.google.com/m8/feeds/photos/media/tanabianmoe%40gmail.com/
795ec48099e213e|||0!
8459||7|1155|0|0|0|0|Jenny Hackson|Jenny|Hackson|||||||1|3||||||||10
...!
DISCLAIMER: Names and other information are fictional .All data is for presentation purposes only.
30
31. Logical extraction: snooping around with sqlite3 –
!
#!
# sqlite3 /data/data/com.android.providers.telephony/databases/mmssms.db!
!
Sqlite> .mode column!
sqlite> .header on!
!
sqlite> select address, date, body from sms;!
!
address date body !
------------ ------------- -----------------------------------------------------!
+11113272608 1336592918275 AT&T Free Msg: Welcome to GoPhone! To learn more ...
310498xxxx 1336720180796 Hey, nice day today. Up for a hike?:-) !
+1310498xxxx 1336720230196 Hike sounds good:) kahuna beach canyon? !
310498xxxx 1336720272373 Laguna is good. See you at 5:30. !
!
sqlite>
Date: GMT: Fri, 11 May 2012 07:10:30 GMT
(ms since 1/1/1970)
... !
DISCLAIMER: Names and other information are fictional .All data is for presentation purposes only.
31
32. Logical extraction: snooping around with sqlite3 –
!
#!
# sqlite3 /data/data/com.google.android.gm/databases/mailstore.mometan@gmail.com.db!
Sqlite> .schema messages!
.schema messages;!
!
CREATE TABLE messages (_id INTEGER PRIMARY KEY,messageId INTEGER,conversation
INTEGER,fromAddress TEXT,toAddresses TEXT,ccAddresses TEXT,bccAddresses
TEXT,replyToAddresses TEXT,dateSentMs INTEGER,dateReceivedMs INTEGER,subject TEXT,snippet
TEXT,listInfo TEXT,personalLevel INTEGER,body TEXT,bodyEmbedsExternalResources
INTEGER,joinedAttachmentInfos STRING,synced INTEGER,error TEXT, clientCreated INTEGER,
refMessageId INTEGER DEFAULT 0, forward INTEGER DEFAULT 0, includeQuotedText INTEGER DEFAULT
0, quoteStartPos INTEGER DEFAULT 0, bodyCompressed BLOB DEFAULT NULL, customFromAddress TEXT
DEFAULT NULL, queryId INTEGER DEFAULT 1, UNIQUE(messageId));!
!
Sqlite> select fromAddress, toAddresses, dateSentMs, subject from messages; !
!
fromAddress toAddresses dateSentMs subject !
------------------------------------------------- -------------------------- ------------- --------------------------!
"Google+ team" <noreply-daa26fef@plus.google.com> "" <tanabianmoe@gmail.com> 1336438677000 Getting started on Google+!
"Gmail Team" <mail-noreply@google.com> "Moe Tanabian" <tanabianmo 1336438616000 Customize Gmail with color!
"Gmail Team" <mail-noreply@google.com> "Moe Tanabian" <tanabianmo 1336438616000 Import your contacts and o!
"Gmail Team" <mail-noreply@google.com> "Moe Tanabian" <tanabianmo 1336438613000 Get Gmail on your mobile p!
!
!
Sqlite> !
Date: GMT: Tue, 08 May 2012 00:56:53 GMT
(ms since 1/1/1970)
DISCLAIMER: Names and other information are fictional .All data is for presentation purposes only.
32
33. Logical extraction: Content Providers – build a forensics data-collection tool
• Content Providers: A specialized type
of complex data store in Android to
standardize access and
manipulation of stored data
• Some useful Content Providers for
forensic purposes:
• Browser: bookmarks, browse
history, etc
• CallLog: missed calls, call
details, etc
• Contacts: Contact details
• MediaStore: Media files (audio,
video, images, etc)
Source: http://ofps.oreilly.com/titles/9781449390501/Main_Building_Blocks.html
33
34. Logical extraction: Content Providers – build a forensics data-collection tool
• The database of a content provider is always addressed via URI. URI is a
means to encapsulate exposing data:
• General URI format:
<standard_prefix>://<authority>/<data_path>/<id>
content://com.android.contacts/data/phones/2
• Content Providers allow CRUD operations to be performed on databases:
• Create, Read, Update, Delete
• They use a SQL like query called cursor object through managedQuery()
(deprecated but still usable)
34
35. Logical extraction: Content Providers – build a forensics data-collection tool
Steps to query a content provider:
Steps to query a content provider:
1. Identify URI of the desired content provider
2. Create a projection (String array which holding the names
of the columns to query)
3. Use managedQuery() to query the CP into a Cursor object
4. Add needed permissions to AndroidManifest.xml
35
36. Logical extraction: Content Providers – build a forensics data-collection tool
!
package com.example.ContentProvider; !
import com.example.ContentProvider.R;!
import android.app.ListActivity; !
2.Projection (columns)
import android.database.Cursor; !
import android.net.Uri; !
import android.os.Bundle; !
import android.provider.ContactsContract; ! Filtering
import android.widget.SimpleCursorAdapter; ! (WHERE)
!
public class ContentProviderActivity extends ListActivity { !
"/** Called when the activity is first created. */ !
Sorting
"@Override !
ORDER BY
"public void onCreate(Bundle savedInstanceState) { !
" "super.onCreate(savedInstanceState); !
"
1. URI "setContentView(R.layout.main); !
" "Uri allContacts = Uri.parse("content://contacts/people"); !
!
" "Cursor c= managedQuery(allContacts, null, null, null, null); !
" "String[] columns = new String[] { !
3. managedQuery()"
" "ContactsContract.Contacts.DISPLAY_NAME, !
" " "ContactsContract.Contacts._ID};!
" "int[] views = new int[] {R.id.contactName, R.id.contactID}; !
" "SimpleCursorAdapter adapter = !
" " "new SimpleCursorAdapter(this, R.layout.main, c, columns, views); !
" "this.setListAdapter(adapter); !
"}!
}!
36
