New Frontiers in Cyber Forensics

Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC
Principal Consultant
Hong Kong Seminar
April 12th 2016 @ Hong Kong

 Spoke at Black Hat, ACFE Asia Pacific Fraud
Conference, HTCIA Asia Pacific Forensics
Conference, and Economist Corporate Network.
 Risk Consultant for Banks, Government and Critical
Infrastructures.
 SANS GIAC Advisory Board Member.
 Co-designed the first Computer Forensics curriculum
for the Hong Kong Police Force.
 Former HKUST Computer Science lecturer.
Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN, GSNA, CISA, CISM, CRISC
Principal Consultant
albert@securityronin.com
2

Mobile Device Forensics
 Physical Acquisition
 Cracking iPhone Passcodes
Network Forensics
 Packet Capture
 IP & Domain Intelligence
 Email Analysis
3Copyright © 2016 Albert Hui

Potentially allows for determining:
1. SMS, WhatsApp, WeChat messages sent and received
2. Pictures taken
3. Previous locations
4. Deleted documents and pictures (with physical acquisition)
5. Etc.

Physical Acquisition


Physical Analysis
Copyright © 2016 Albert Hui 6
💣 Method very similar to
jailbreak, load custom firmware,
then unjailbreak
 Can and did brick phones!

💣 Physical acquisition requires
manual pre-Jailbreak!
 Might want to unjailbreak the phone afterwards 
 Or it might well be totally unacceptable after all

 iOS 1–3: no need
 iOS 4–7: yes, email, passwords and
some apps need passcode
 iOS 8–9: yes, most everything need
passcode
Copyright © Devon Ackeman http://goo.gl/UXt7Od

 (Mac) /private/var/db/lockdown
 (Windows) C:ProgramDataAppleLockdown
💣 Need access to a synced computer
💣 since iOS 8+, phone must not have been
turned off / restarted in the last 48 hours
can unlock phone with paring file on a synced computer:

 Can brute-force passcodes
 4-digit passcodes cracked under 40 minutes
 More complex passcodes can take a long long time
(dictionary attack)

💣 Only work for 4-digit passcodes
💣 No longer work for iOs 8.1.1+
Copyright © FoneFunShop
IP-BOX
 Brute-force passcodes
 Infinite retries via power off before
iPhone remembers a failed try

1. What parties are involved?
2. Involved parties’ affiliations?
3. What events happened?
4. When did events happen?
5. How did events happen?
6. Etc.

Copyright © Computer Desktop Encyclopedia
Ethernet

monitor session 1 source interface fastEthernet 0/1
monitor session 1 destination interface gigabitEthernet 0/1
Switch(config) #

💣 Must Swap Cables REAL Quick!
 in order to keep existing TCP connections up
(assuming switch port in PortFast mode)

Ethernet Hub
💣 Most hubs are actually switches!
 Test them!
Throwing Star
💣 Beware of Packet Drops!
 Use adequately powerful taps

Packet Capture

https://www.wireshark.org/
 TCPDump
(any modern UNIX)
Traffic Analysis
 NetworkMiner
http://www.netresec.com/?page=Networkminer
.pcap
File
💣 Need SSL private key for
decrypting https traffics!

Ethernet

💣 often inaccurate!
 Use of VPN / TOR / proxy/ anonymizer
 Address block used in another country
209.58.130.172

Ethernet

64.233.184.121

hkacfe.com

 DomainTools Whois
https://whois.domaintools.com
 MaxMind GeoIP2 Precision
https://www.maxmind.com/en/batch_lookup
 IP Intelligence Proxy / VPN Detection
https://getipintel.net/
 ExoneraTor Tor Relay Checker
https://exonerator.torproject.org/
 TCPIPUTILS.com Domain Neighbors
http://www.tcpiputils.com/domain-neighbors
 DomainTools Whois History
https://research.domaintools.com/research/whois-
history/
 Wayback Machine
https://archive.org/web/
💣 For IP geolocation, do not rely solely on:
 ASN Lookup
 “Visual Traceroute”
 Google 
or any single source for that matter

1. Who the sender is?
2. From what location was the email sent (home, office, café,
etc.)?
3. What ISP was used?
4. What email service was used?
5. What is the mail delivery path?
6. Any attempt to spoof?
7. Etc.

Taiwanese
Windows=

 IP Tracker Email Sender Finder
http://www.ip-tracker.org/find/email-finder.php

??

New Frontiers in Cyber Forensics

Recommended

Recommended

More Related Content

What's hot

What's hot (11)

Viewers also liked

Viewers also liked (18)

Similar to New Frontiers in Cyber Forensics

Similar to New Frontiers in Cyber Forensics (20)

More from Albert Hui

More from Albert Hui (11)

Recently uploaded

Recently uploaded (20)

New Frontiers in Cyber Forensics