Tag Archive for Security

iPhone Forensics – Part 1

As with anything else its important to really understand the inner working of the iPhone before attempting to recover any data from it, as two things may happen: the device may be rendered useless or the data on it become contaminated which is just as bad when you are looking for evidence.

The iPhone runs a custom version of Mac OS X 10.5 (Leopard) with several differences which include:

  1. an ARM architecture as opposed to the Intel x86 architecture used on desktop machines
  2. special hardware including an accelerometer, proximity sensor, multi-touch capable screen and several radios including GSM, Wi-Fi and Bluetooth
  3. a user interface framework built around the iPhone to accommodate the proprietary hardware
  4. a signed kernel designed to prevent tampering

What can be recovered:

Information stored on the iPhone includes keyboard caches containing usernames, passwords, searches, and some history of what was ever typed on the phone.

Sections of map images from the phone’s Google Maps application, location searches and their coordinates can be found on the phone.

Browser cache and deleted items identifying what websites the user has visited.

Deleted voicemails, email and SMS messages can also be recovered.

A cache of screenshots of the user’s last activities which are kept to improve the experience of opening and closing applications.

Deleted images, address book entries, contacts, calendar events and other personal information can be recovered.

A very detailed call history list beyond what is visibly on the iPhone as well as deleted items from the history.

Disk Layout:

The iPhone uses a solid state NAND flash which is treated as a disk by storing a partition table and a formatted file system. Generally the iPhone will be configured with 2 partitions as shown below.

The first partition is the root which houses the operating system and all the preloaded applications on the iPhone. This partition is read-only and designed to stay like that. The size of the root partition varies depending on the version of the phone (size of the flash).

The remaining space is assigned to the user and is mounted as /private/var as shown above. This allows Apple to upgrade firmware of the devices without in theory touching the user data on the device.

To perform forensics on this type of environment we would need to make the root partition writable  to install forensics software in order to maintain the integrity of the data on the user’s data partition.


The iPhone can communicate in multiple ways including the serial port, 802.11 Wi-Fi and Bluetooth. AFC or Apple File Connection is a serial protocol used by iTunes to connect to the iPhone and transfer everything from music to software upgrades.

iTunes is not allowed access to the whole iPhone but is rather placed in a jailed environment. People familiar with Linux will understand the term “jailed”, which in general terms mean restricting access and operations to a specific area within the target device.

The hacker community coined the term “jailbreaking” after successfully breaking out of this restricted environment allowing pirated apps to be installed on the phone and unlocking it to be used with other carriers.

The Firmware:

Apple provides firmware updates on a periodic basis which update the operating system, radio baseband and other device firmware. Although these updates have not resulted in loss of user data, it is not recommended that the firmware be upgraded during the forensics process.

Reblog this post [with Zemanta]

Mobile Forensics

With the explosion of mobile devices there is little doubt that the number of security incidents were a mobile device is involved will also increase exponentially.

My next couple of posts will look at what is takes to perform forensics on mobile devices targeting specifically the iPhone, the Blackberry and the Android platforms.

Some interesting statistics on the iPhone in particular and the number of them that AT&T activated in the last couple of years. As can be seen below the number of iPhones activated in the 3rd quarter 2009 was 3.2 millions devices in the US alone.

This doesn’t equate to iPhone’s sold because activations would also count dad’s giving their iPhone to their daughter and buying a new one for themselves, which would mean 2 activations but just one iPhone bought.

According to AT&T they added 2 million subscribers to that quarter. Nevertheless the evidence is there on an upward trend.

The graph below shows the how activations for the 1st quarter of 2010 rose by 50% over the previous quarter.

Reblog this post [with Zemanta]

Conficker Gets Ready To Strike

Without a doubt the whole security professional community have their eyes on the Conficker.C variant which is designed to do something on April 1st.

So what is that something? We’ll find out within 24 hours.

What we do know is that this variant of Conficker has become better at preventing removal and others from taking control of the network of worm infected computers.

The Conficker worm will begin to poll 500 different domain names every day looking for updates to download doubling its current rate.

Interestingly enough one of my most popular posts is on the removal of the Conficker worm from a network environment here and over the last couple of days visitors have exploded exponentially.

In my two other posts in which I talk about the Microsoft flaw and the Social Engineering components of the worm, I take a rather passive approach to the problem which is based on having contingency plans to prevent, contain and remove the worm from infected computers.

A more pro-active approach would be to look for infected machines without waiting for the symptons to appear by actively scanning the network for computers which have been infected.

Locating computers which have been infected with Conficker using a network scan has kept me up multiple nights, until the guys at Honeynet.org came up with the tool here. Thanks to DShield.org for linking to it in their article on locating Conficker.



Reblog this post [with Zemanta]

Step by Step In Dealing With Conficker

This will turn out to be a “trojan horse” literally if actions are not taken to prevent it from spreading within the corporate network.

Below are step by step instructions on mitigating the risk of the threat that “Conficker”/”Downandup” poses.



Symptoms to help you determine if you are infected

  • Account lockout policies are being tripped
  • Automatic Updates, Background Intelligent Transfer Service, Windows Defender and Error Reporting Server Services are disabled
  • Errors related to SVCHOST
  • Domain Controllers are slow to respond to client requests
  • Network congestion
  • Various security related websites are not accessible including Windows Update.

For further details see the Microsoft Malware Protection Center write up for Win32/Conficker.b. or the Sekiur writeup here.



Ideally you want to not only automate the removal of the “Conficker”/”Downandup” worm from a large number of computers but also take steps to minimize the risk of them being infected again.

The following script will attempt to remove the “Conficker”/”Downandup” worm and prevent further infection by taking the following steps:

  1. Install patch KB958644 for MS08-067 if not installed
  2. Attempt to remove the “Conficker”/”Downandup” worm
  3. Enable Hidden Setting
  4. Delete all scheduled tasks
  5. Stop and disable services. (lanmanserver, schedule)
  6. Run MSRT – Malicious Software Removal Tool
  7. Install Autorun hotfix if not installed
  8. Install KB950582 for vulnerability MS08-038
  9. Re-enable TCP Receive Window Auto-tuning on Windows Vista and Windows Server 2008
  10. Remove Hidden Setting
  11. Enable Automatic Updates, Background Intelligent Transfer and Error Reporting Services
  12. Restart
  13. Install patch KB958644 for MS08-067 and restart

You will need to download the following files and batch script and drop them into the NetLogon share.

  • Getver.exe – contained in ConfickerClean-v10.3.zip here ==>  and script to remove “Conficker”/”Downandup” locally here ==> .
  • SC.EXE – contained in ConfickerClean-v10.3.zip
  • REG.exe – contained in ConfickerClean-v10.3.zip
  • windows-kb890830-v2.6.exe – x86 version of MSRT, available here.
  • windows-kb890830-x64-v2.6.exe – x64 version of MSRT, available here.
  • sleep.exe – contained in ConfickerClean-v10.3.zip
  • Hotfix update for Windows 2000, Windows XP and Windows 2003, download all updates listed in http://support.microsoft.com/kb/953252, except the Itanium update as this script does not support Itanium.
  • Place all 3 updates in the Netlogon directory.
  • Security update MS08-038 for Windows Vista and Windows Server 2008 – http://www.microsoft.com/technet/security/Bulletin/MS08-038.mspx
    This vulnerability is not being exploited, however, to disable Autorun properly this needs to be applied as it contains a fix related to autorun, same as the one listed above in KB953252.

Now you will proceed to create and push a Group Policy to the domain.

  1. Edit the <domain.com> values in the script.
  2. Rename it to .BAT and drop it in the \\%windir%\sysvol\sysvol\\scriptsfolder (aka, Netlogon share).
  3. Create a Startup Script policy and reference this batch file. This needs to be a Startup Script and not a Logon script, so that the script runs under the machine account.
  4. Link the GPO with the Startup Script to the OU and Groups where you want it to apply.


Its not recommend you use this on DC’s or critical servers, those should be cleaned manually so that the services disabled below do not need to be left disabled for an extended period of time.


Why disable the Server service?

This is due to Weak Passwords which the malware attempts to exploit. The password change will need to be accomplished via password policy for the domain, resetting any local and domain admin password to a complex password which includes at least 10 characters and contains, alpha-numeric characters and extended characters such as a question mark or exclamation point.

Why disable the Task Scheduler service?

This is because the malware creates several AT jobs that run every hour to reinfect the system.

Why install MS08-067?

This is the main attack vector of the malware.

Why disable Autorun?

This is because the malware drops a binary file called Autorun.inf on all removable drives.



All credit to Microsoft Support Engineering