Beyond files forensic OWADE cloud based forensic Elie Bursztein - - PowerPoint PPT Presentation

▶
beyond files forensic owade cloud based forensic
SMART_READER_LITE
LIVE PREVIEW

Beyond files forensic OWADE cloud based forensic Elie Bursztein - - PowerPoint PPT Presentation

Mar 02, 2024 118 likes •1.84k views

Beyond files forensic OWADE cloud based forensic Elie Bursztein Stanford University Ivan Fontarensky Cassidian Matthieu Martin Stanford University Jean Michel Picod Cassidian Wednesday, August 3, 2011 The world is moving to the cloud E.

slide-1
SLIDE 1

Beyond files forensic OWADE cloud based forensic

Elie Bursztein Stanford University Ivan Fontarensky Cassidian Matthieu Martin Stanford University Jean Michel Picod Cassidian

Wednesday, August 3, 2011

slide-2
SLIDE 2
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The world is moving to the cloud

Wednesday, August 3, 2011

slide-3
SLIDE 3
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

2.7 millions photos are uploaded to Facebook every 20 minutes

Wednesday, August 3, 2011

slide-4
SLIDE 4
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

100 millions new files are saved on Dropbox every day

Wednesday, August 3, 2011

slide-5
SLIDE 5
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive

Wednesday, August 3, 2011

slide-6
SLIDE 6
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails

Wednesday, August 3, 2011

slide-7
SLIDE 7
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Cloud

Wednesday, August 3, 2011

slide-8
SLIDE 8
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail Cloud

Wednesday, August 3, 2011

slide-9
SLIDE 9
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail contacts Cloud

Wednesday, August 3, 2011

slide-10
SLIDE 10
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail contacts Social sites Cloud

Wednesday, August 3, 2011

slide-11
SLIDE 11
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail contacts Social sites photos Cloud

Wednesday, August 3, 2011

slide-12
SLIDE 12
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail contacts Social sites photos Cloud Photo sites

Wednesday, August 3, 2011

slide-13
SLIDE 13
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Data are moving to multiple services

Hard drive emails Webmail contacts Social sites photos Cloud Photo sites

Wednesday, August 3, 2011

slide-14
SLIDE 14

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Impact on the forensic field

  • There are more data which

are harder to reach

  • Dealing with cloud data

force us to reinvent forensic

Wednesday, August 3, 2011

slide-15
SLIDE 15

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Let’s do cloud forensics

Wednesday, August 3, 2011

slide-16
SLIDE 16
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

What is cloud forensics ?

Wednesday, August 3, 2011

slide-17
SLIDE 17
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook

Wednesday, August 3, 2011

slide-18
SLIDE 18
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook credentials IE DPAPI Blob

Wednesday, August 3, 2011

slide-19
SLIDE 19
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook

DPAPI blob-key

DPAPI master-key credentials IE DPAPI Blob

Wednesday, August 3, 2011

slide-20
SLIDE 20
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook

DPAPI blob-key

DPAPI master-key

Windows User Password

SAM (hash) credentials IE DPAPI Blob

Wednesday, August 3, 2011

slide-21
SLIDE 21
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook

DPAPI blob-key

DPAPI master-key

Windows User Password

SAM (hash) Registry credentials IE DPAPI Blob Syskey

Wednesday, August 3, 2011

slide-22
SLIDE 22
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Facebook credentials as a use case

Facebook

DPAPI blob-key

DPAPI master-key

Windows User Password

SAM (hash) Registry credentials IE DPAPI Blob Syskey

Getting Facebook credentials require to bypass 4 layers of encryption

Wednesday, August 3, 2011

slide-23
SLIDE 23
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Focus of this talk

  • xw

Show you how to bypass the encryption layers and get the data you want

Wednesday, August 3, 2011

slide-24
SLIDE 24

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Introducing OWADE

  • Dedicated to cloud

forensics

  • Decrypt / recovers
  • DPAPI secrets
  • Browsers history and

websites credentials

  • Instant messaging creds
  • Wifi data
  • Free and open-source

http://owade.org

Wednesday, August 3, 2011

slide-25
SLIDE 25

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

OWADE in action

Wednesday, August 3, 2011

slide-26
SLIDE 26
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

Wednesday, August 3, 2011

slide-27
SLIDE 27
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk

Wednesday, August 3, 2011

slide-28
SLIDE 28
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image

Wednesday, August 3, 2011

slide-29
SLIDE 29
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry

Wednesday, August 3, 2011

slide-30
SLIDE 30
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files

Wednesday, August 3, 2011

slide-31
SLIDE 31
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files Windows credentials

Wednesday, August 3, 2011

slide-32
SLIDE 32
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files Windows credentials WiFi info

Wednesday, August 3, 2011

slide-33
SLIDE 33
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files Windows credentials WiFi info Hardware info

Wednesday, August 3, 2011

slide-34
SLIDE 34
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files Windows credentials WiFi info Hardware info Credentials and data

Wednesday, August 3, 2011

slide-35
SLIDE 35
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE overview

disk disk image Registry Files Windows credentials WiFi info Hardware info Credentials and data Cloud data

Wednesday, August 3, 2011

slide-36
SLIDE 36
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

Wednesday, August 3, 2011

slide-37
SLIDE 37
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher

Wednesday, August 3, 2011

slide-38
SLIDE 38
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system

Wednesday, August 3, 2011

slide-39
SLIDE 39
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system
  • Wifi data and Geo-location

Wednesday, August 3, 2011

slide-40
SLIDE 40
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system
  • Wifi data and Geo-location
  • Recovering browser data

Wednesday, August 3, 2011

slide-41
SLIDE 41
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system
  • Wifi data and Geo-location
  • Recovering browser data
  • Recovering instant messaging data

Wednesday, August 3, 2011

slide-42
SLIDE 42
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system
  • Wifi data and Geo-location
  • Recovering browser data
  • Recovering instant messaging data
  • Acquiring cloud data

Wednesday, August 3, 2011

slide-43
SLIDE 43
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Outline

  • File base forensics refresher
  • The Windows crypto eco-system
  • Wifi data and Geo-location
  • Recovering browser data
  • Recovering instant messaging data
  • Acquiring cloud data
  • Demo

Wednesday, August 3, 2011

slide-44
SLIDE 44

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

File based forensic refresher

Wednesday, August 3, 2011

slide-45
SLIDE 45
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Not all files are born equal

Type of file how to recover it

Standard copy In the trash undelete utility Deleted file carving Wiped call the NSA :)

Wednesday, August 3, 2011

slide-46
SLIDE 46

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Windows registry

  • .dat files
  • Hardware information
  • Softwares installed with

their versions and serials

  • Windows credentials

(encrypted)

Wednesday, August 3, 2011

slide-47
SLIDE 47

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Some Registry Information Extracted

Wednesday, August 3, 2011

slide-48
SLIDE 48

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Windows crypto

Wednesday, August 3, 2011

slide-49
SLIDE 49
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Why do we care about Windows crypto ?

Wednesday, August 3, 2011

slide-50
SLIDE 50
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Windows crypto eco-system

Crypto API

Wednesday, August 3, 2011

slide-51
SLIDE 51
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Windows crypto eco-system

Crypto API SAM

Wednesday, August 3, 2011

slide-52
SLIDE 52
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Windows crypto eco-system

Crypto API DPAPI SAM

Wednesday, August 3, 2011

slide-53
SLIDE 53
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Windows crypto eco-system

Crypto API DPAPI

Credential Manager

SAM

Wednesday, August 3, 2011

slide-54
SLIDE 54
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Windows Crypto API

  • Basic cryptographic blocks
  • Cipher: 3DES, AES
  • Hash functions: SHA-1 SHA256, HMAC
  • PKI: public keys and certificates (X.509)

Wednesday, August 3, 2011

slide-55
SLIDE 55
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Security Account Manager (SAM)

  • Store Windows user credentials
  • Located in the registry
  • Encrypted with the SYSKEY
  • Passwords are hashed

Wednesday, August 3, 2011

slide-56
SLIDE 56
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Windows Password Hashing functions

  • Two hash functions used
  • LM hash function (NT, 2K, XP

, VISTA) weak

  • NTLM (XP

, Vista, 7)

  • Passwords are not salted

Wednesday, August 3, 2011

slide-57
SLIDE 57

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

LM hash weakness

  • Use only upper-case
  • Hash password in chunk
  • f 7 characters

mypassword LMHash(MYPASSW) + LMHash(ORD) Password key-space: 69^7 (at most)

Wednesday, August 3, 2011

slide-58
SLIDE 58
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Rainbow Tables

  • Pre-compute all the possible passwords
  • Time-Memory trade-off
  • Rainbow tables of all the LM hash are available

Wednesday, August 3, 2011

slide-59
SLIDE 59
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

How OWADE Works

  • Extract Usernames and password hashes
  • LM hashes available ?
  • use John/Rainbow tables to get the pass in uppercase
  • use NTLM hashes to find the password cases
  • Try to crack the NTLM using John/Rainbow table

Wednesday, August 3, 2011

slide-60
SLIDE 60
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Windows Password recovered

Wednesday, August 3, 2011

slide-61
SLIDE 61
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

  • What if we can’t crack the NTLM hash :(
  • (need a sad baby face here)

If the password is too strong we can’t recover it

Wednesday, August 3, 2011

slide-62
SLIDE 62
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

  • Everything is not lost because of how DPAPI works
  • (smilling baby face)

but we can still decrypt DPAPI secret (sometime)

Wednesday, August 3, 2011

slide-63
SLIDE 63
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

The Data Protection API

  • Ensure that encrypted data can’t be decrypted

without knowing the user Windows password

  • Blackbox crypto API for developers:
  • Encrypt data DPAPI blob
  • Decrypt DPAPI blob data
  • Main point : tie the encryption to the user password

Wednesday, August 3, 2011

slide-64
SLIDE 64
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI derivation scheme

User pre-key SHA1(password)

Wednesday, August 3, 2011

slide-65
SLIDE 65
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI derivation scheme

User pre-key master-key SHA1(password)

Wednesday, August 3, 2011

slide-66
SLIDE 66
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI derivation scheme

User pre-key master-key blob key SHA1(password)

Wednesday, August 3, 2011

slide-67
SLIDE 67
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI derivation scheme

User pre-key master-key blob key SHA1(password) DPAPI blob

Wednesday, August 3, 2011

slide-68
SLIDE 68
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI derivation scheme

User pre-key blob key blob key master-key blob key SHA1(password) DPAPI blob DPAPI blob DPAPI blob

Wednesday, August 3, 2011

slide-69
SLIDE 69
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI Blob structure

struct wincrypt_datablob {

  • DWORD

cbProviders,

  • GUID

pbProviders[cbProviders],

  • DWORD

cbMasterkeys,

  • GUID

pbMasterkeys[cbMasterkeys],

  • DWORD

dwFlags,

  • DWORD

cbDescription,

  • BYTE

pbDescription[cbDescription],

  • ALG_ID algCipher,
  • DWORD

cbKey,

  • DWORD

cbData,

  • BYTE

pbData[cbData],

  • DWORD

dwUnknown,

  • ALG_ID algHash,
  • DWORD

dwHashSize,

  • DWORD

cbSalt,

  • BYTE

pbSalt[cbSalt],

  • DWORD

cbCipher,

  • BYTE

pbCipher[cbCipher],

  • DWORD

cbCrc,

  • BYTE

pbCrc[cbCrc] } ;

Wednesday, August 3, 2011

slide-70
SLIDE 70
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI master-key structure

struct wincrypt_masterkey_masterkeybloc { DWORD dwRevision, BYTE pbSalt[16], DWORD dwRounds, ALG_ID algMAC, ALG_ID algCipher, BYTE pbEncrypted[] };

Header Structure Footer Structure

Wednesday, August 3, 2011

slide-71
SLIDE 71
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob

Wednesday, August 3, 2011

slide-72
SLIDE 72
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID

Wednesday, August 3, 2011

slide-73
SLIDE 73
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key

Wednesday, August 3, 2011

slide-74
SLIDE 74
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password)

Wednesday, August 3, 2011

slide-75
SLIDE 75
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password) Master key

Wednesday, August 3, 2011

slide-76
SLIDE 76
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password) Master key Cipher + key

Wednesday, August 3, 2011

slide-77
SLIDE 77
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password) Master key Cipher + key blob key

Wednesday, August 3, 2011

slide-78
SLIDE 78
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password) Master key Cipher + key blob key I V + S a l t

Wednesday, August 3, 2011

slide-79
SLIDE 79
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI blob Master-key GUID pre-key Master key User SHA1(password) Master key Cipher + key blob key I V + S a l t Additional entropy Software

Wednesday, August 3, 2011

slide-80
SLIDE 80

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Bypassing the user password cracking

  • If we can’t crack the

password we need its SHA1

  • This SHA1 is stored in

the hibernate file

  • OWADE uses Moonsols

to recover it

Wednesday, August 3, 2011

slide-81
SLIDE 81
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

DPAPI additional entropy

  • Software can supply an additional entropy
  • Act as a “key” (needed for decryption)
  • Force us to understand how it is generated for each

software

  • Can be used to tie data to a specific machine (i.e

Netbios name)

Wednesday, August 3, 2011

slide-82
SLIDE 82
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Credential Manager

  • Built on top of DPAPI
  • Handle transparently the encryption and storage of

sensitive data

  • Used by Windows, Live Messenger, Remote desktop...

Wednesday, August 3, 2011

slide-83
SLIDE 83
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Credstore type of credentials

Type of credential Encryption Example of application

Generic password DPAPI + fixed string Live messenger HTTP auth (IE) Domain password In clear Netbios Domain certificate Hash of certificate Certificate Domain visible password DPAPI + fixed string Remote access .NET passport

Wednesday, August 3, 2011

slide-84
SLIDE 84

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

WiFi data

Wednesday, August 3, 2011

slide-85
SLIDE 85
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Wifi data

  • Info stored for each access point
  • Mac address (BSSID)
  • Key (encrypted)
  • Last time of access
  • Wifi data are stored in
  • Registry (XP)
  • XML file and Registry (Vista/7)

Wednesday, August 3, 2011

slide-86
SLIDE 86

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting WiFi password

  • Encrypted with DPAPI
  • Access point shared

among users

  • Encrypted with the

System account

  • But the system account

has no password...

What is my DPAPI key ???

Wednesday, August 3, 2011

slide-87
SLIDE 87

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting WiFi password

  • Use a LSASecret as

DPAPI key

  • Array of credentials
  • HelpAssistant password

in clear

  • DPAPI_SYSTEM
  • “Encrypted”

Wednesday, August 3, 2011

slide-88
SLIDE 88
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Where are you ?

  • We’ve recovered access

point keys but where are they ?

Wednesday, August 3, 2011

slide-89
SLIDE 89
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Where are you ?

  • We’ve recovered access

point keys but where are they ? There is an app for that !

Wednesday, August 3, 2011

slide-90
SLIDE 90
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

HTML5 Geo-location protocol

Wednesday, August 3, 2011

slide-91
SLIDE 91
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

HTML5 Geo-location protocol

Wednesday, August 3, 2011

slide-92
SLIDE 92
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

HTML5 Geo-location protocol

Wednesday, August 3, 2011

slide-93
SLIDE 93
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Behind the curtain

Wednesday, August 3, 2011

slide-94
SLIDE 94

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Nothing is ever easy

  • Google started to

restrict queries in June

  • So we started to look

for other API

Wednesday, August 3, 2011

slide-95
SLIDE 95

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Entering Microsoft

  • Live service
  • “Documented” in the

Windows mobile MSDN

  • After sniffing the traffic:
  • Use a big SOAP request
  • Does not check any ID

fields

  • Allows to supply one

MAC

<GetLocationUsingFingerprint xmlns="http:// inference.location.live.com"> <RequestHeader> <Timestamp>2011-02-15T16:22:47.0000968-05:00 </Timestamp> <ApplicationId>e1e71f6b-2149-45f3-b298-a20XXXXX5017 </ApplicationId> <TrackingId>21BF9AD6-CFD3-46B2-B042-EE90XXXXXX </TrackingId> <DeviceProfile ClientGuid="0fc571be-4622-4ce0-b04e- XXXXXXeb1a222" Platform="Windows7" DeviceType="PC" OSVersion="7600.16695.amd64fre.win7_gdr.101026-1503" LFVersion="9.0.8080.16413" ExtendedDeviceInfo="" /> <Authorization /> </RequestHeader> <BeaconFingerprint> <Detections> <Wifi7 BssId="00:BA:DC:0F:FE:00" rssi="-25" /> </Detections> </BeaconFingerprint> </GetLocationUsingFingerprint>

Wednesday, August 3, 2011

slide-96
SLIDE 96

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Blog post and demo released !

Wednesday, August 3, 2011

slide-97
SLIDE 97

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Just fixed

  • Fixed last weekend
  • No longer return

location for a single address

Wednesday, August 3, 2011

slide-98
SLIDE 98

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Just fixed

  • Fixed last weekend
  • No longer return

location for a single address There is a patch for that !

Wednesday, August 3, 2011

slide-99
SLIDE 99
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Geo-location API restrictions

Requires 2 MAC close from each other The MAC and IP location need to be “close” Requires multiples MAC addresses

see http://elie.im/blog/ for more information

Wednesday, August 3, 2011

slide-100
SLIDE 100
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

WiFi Information Extracted By OWDE

Wednesday, August 3, 2011

slide-101
SLIDE 101

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Browsers

Wednesday, August 3, 2011

slide-102
SLIDE 102
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Firefox > 3.4

  • Passwords
  • Location: signons.sqlite
  • Encryption: 3DES + Master password
  • History
  • URLs: places.sqlite
  • Forms fields: formhistory.sqlite

Wednesday, August 3, 2011

slide-103
SLIDE 103

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password

Wednesday, August 3, 2011

slide-104
SLIDE 104

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password User pass

Wednesday, August 3, 2011

slide-105
SLIDE 105

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass

Wednesday, August 3, 2011

slide-106
SLIDE 106

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass user key: HMAC-SHA1(salt, pass)

Wednesday, August 3, 2011

slide-107
SLIDE 107

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass user key: HMAC-SHA1(salt, pass) encrypted key + key salt key3.db

Wednesday, August 3, 2011

slide-108
SLIDE 108

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass user key: HMAC-SHA1(salt, pass) master key: 3DES(userkey, enckey) encrypted key + key salt key3.db

Wednesday, August 3, 2011

slide-109
SLIDE 109

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass user key: HMAC-SHA1(salt, pass) master key: 3DES(userkey, enckey) signon.sqlite encrypted pass encrypted key + key salt key3.db

Wednesday, August 3, 2011

slide-110
SLIDE 110

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Firefox password key3.db Global salt User pass user key: HMAC-SHA1(salt, pass) master key: 3DES(userkey, enckey) signon.sqlite encrypted pass Site password: 3DES (master key, enc pass) encrypted key + key salt key3.db

Wednesday, August 3, 2011

slide-111
SLIDE 111

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Shopping at Amazon ?

Wednesday, August 3, 2011

slide-112
SLIDE 112

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

How about a nice kindle ?

Wednesday, August 3, 2011

slide-113
SLIDE 113

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

How about a nice kindle ?

Wednesday, August 3, 2011

slide-114
SLIDE 114

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Every form field is recorded

Wednesday, August 3, 2011

slide-115
SLIDE 115

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Configuring a Linksys ?

Wednesday, August 3, 2011

slide-116
SLIDE 116

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Again the key is recorded

Wednesday, August 3, 2011

slide-117
SLIDE 117

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Form history leak a lot of information

  • Shipping address
  • Wifi key
  • Credit card information
  • Email
  • Search history

Wednesday, August 3, 2011

slide-118
SLIDE 118
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Preventing field recording

To tell the browser to not record a field use the tag autocomplete=”off”

Wednesday, August 3, 2011

slide-119
SLIDE 119

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

  • Passwords
  • Location: registry
  • Encryption: DPAPI + URL as salt
  • History
  • URLs: Index.dat

Internet Explorer

Wednesday, August 3, 2011

slide-120
SLIDE 120
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Wednesday, August 3, 2011

slide-121
SLIDE 121
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Registry SHA1(URL)

Wednesday, August 3, 2011

slide-122
SLIDE 122
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Registry SHA1(URL) URL List URL

Wednesday, August 3, 2011

slide-123
SLIDE 123
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Registry SHA1(URL) URL List URL SHA1(URL) URL (dpapi entropy)

Wednesday, August 3, 2011

slide-124
SLIDE 124
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Registry SHA1(URL) URL List URL SHA1(URL) URL (dpapi entropy) DPAPI Blob Registry

Wednesday, August 3, 2011

slide-125
SLIDE 125
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Decrypting Internet Explorer passwords

Registry SHA1(URL) URL List URL SHA1(URL) URL (dpapi entropy) Site password DPAPI Blob Registry

Wednesday, August 3, 2011

slide-126
SLIDE 126
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Maximizing our recovery

  • Build a list of URL from others browsers and files
  • Use a list of known login URLs

Wednesday, August 3, 2011

slide-127
SLIDE 127

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

  • Passwords
  • Location: Login Data (sqlite)
  • Encryption: DPAPI
  • History
  • URLs: History (sqlite)
  • Forms fields: Web Data (sqlite)

Chrome

Wednesday, August 3, 2011

slide-128
SLIDE 128

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

  • Passwords
  • Location: keychain.plist (Property list format)
  • Encryption: DPAPI + fixed string as entropy
  • History
  • URLs: History.plist
  • Forms fields: Form

Value.plist

Safari

Wednesday, August 3, 2011

slide-129
SLIDE 129
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Browsers takeaway

  • Internet Explorer is the most secure.
  • If you don’t know the URL you can’t recover the

credentials

  • Firefox is the worst
  • Passwords encryption not tied to the Windows user

password (bug open for a while)

  • Login are encrypted in signons.sqlite not in

formhistory.sqlite

Wednesday, August 3, 2011

slide-130
SLIDE 130

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Private mode

  • Most bugs are fixed
  • Requires to be creative
  • SSL OCSP requests
  • File carving
  • Potential techniques
  • Analyze the hibernate

file

See: http://ly.tl/p16 for more information on private mode

Wednesday, August 3, 2011

slide-131
SLIDE 131

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

The browsers histories aggregated

Wednesday, August 3, 2011

slide-132
SLIDE 132

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Instant messaging

Wednesday, August 3, 2011

slide-133
SLIDE 133

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Skype

  • Encryption

custom

  • Difficulty

extreme

  • Location

registry + config.xml

Wednesday, August 3, 2011

slide-134
SLIDE 134

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

Wednesday, August 3, 2011

slide-135
SLIDE 135

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

Registry DPAPI Blob pre-key

Wednesday, August 3, 2011

slide-136
SLIDE 136

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

AES key: SHA1(pre-key) Registry DPAPI Blob pre-key

Wednesday, August 3, 2011

slide-137
SLIDE 137

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

AES key: SHA1(pre-key) config.xml encrypted credential Registry DPAPI Blob pre-key

Wednesday, August 3, 2011

slide-138
SLIDE 138

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

AES key: SHA1(pre-key) config.xml encrypted credential MD5(login\nskyper\npassword) Login pass cracking Registry DPAPI Blob pre-key

Wednesday, August 3, 2011

slide-139
SLIDE 139

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Decrypting Skype passwords

AES key: SHA1(pre-key) config.xml encrypted credential MD5(login\nskyper\npassword) Login pass cracking Registry DPAPI Blob pre-key

There is a John the ripper patch for that

Wednesday, August 3, 2011

slide-140
SLIDE 140

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Google Talk

  • Encryption

DPAPI + custom (salt)

  • Difficulty

Hard

  • Location

registry

Wednesday, August 3, 2011

slide-141
SLIDE 141
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Wednesday, August 3, 2011

slide-142
SLIDE 142
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

String: 0xBA0DA71D

Wednesday, August 3, 2011

slide-143
SLIDE 143
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name String: 0xBA0DA71D

Wednesday, August 3, 2011

slide-144
SLIDE 144
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name String: 0xBA0DA71D

Wednesday, August 3, 2011

slide-145
SLIDE 145
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name Registry computer Netbios name String: 0xBA0DA71D

Wednesday, August 3, 2011

slide-146
SLIDE 146
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name Registry computer Netbios name String: 0xBA0DA71D

Wednesday, August 3, 2011

slide-147
SLIDE 147
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name Registry computer Netbios name String: 0xBA0DA71D DPAPI Blob Registry

Wednesday, August 3, 2011

slide-148
SLIDE 148
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Salt derivation algorithm overview

Registry Windows account name Registry computer Netbios name String: 0xBA0DA71D DPAPI Blob Registry

Wednesday, August 3, 2011

slide-149
SLIDE 149

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Microsoft Messenger

  • Encryption

DPAPI or Credstore

  • Difficulty

Medium

  • Location

version dependent

Wednesday, August 3, 2011

slide-150
SLIDE 150

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Windows Messenger by version

Version Storage encryption

5 Registry Base64 encoded 6 Credstore Credstore 7 Registry x2 DPAPI x 2 Live Credstore Credstore

Wednesday, August 3, 2011

slide-151
SLIDE 151

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

aMSN

  • Encryption

DES

key: substr(login . “dummykey”, 8)

  • Difficulty

easy

  • Location

config.xml

Wednesday, August 3, 2011

slide-152
SLIDE 152

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

9talk

  • Encryption

XOR

key: 9

  • Difficulty

trivial

  • Location

user.config

Wednesday, August 3, 2011

slide-153
SLIDE 153

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Trillian

  • Encryption

Base 64 +XOR

key: fixed string

  • Difficulty

trivial

  • Location

user.config

Wednesday, August 3, 2011

slide-154
SLIDE 154

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Pidgin

  • Encryption

Clear aka encryt-what?

  • Difficulty

none

  • Location

account.xml

Wednesday, August 3, 2011

slide-155
SLIDE 155

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Pidgin

  • Encryption

Clear aka encryt-what?

  • Difficulty

none

  • Location

account.xml

Wednesday, August 3, 2011

slide-156
SLIDE 156

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk

  • Encryption

Custom

  • Difficulty

difficult (offline)

  • Location

registry

Wednesday, August 3, 2011

slide-157
SLIDE 157

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

Wednesday, August 3, 2011

slide-158
SLIDE 158

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567

Wednesday, August 3, 2011

slide-159
SLIDE 159

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567 Paltalk account name Registry myusername

Wednesday, August 3, 2011

slide-160
SLIDE 160

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567 Paltalk account name Registry myusername m0y1u2s3e4r5n6a7me x 3

Wednesday, August 3, 2011

slide-161
SLIDE 161

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567 Paltalk account name Registry myusername m0y1u2s3e4r5n6a7me x 3 Registry encrypted password yyyz yyyz yyyz yyyz

Wednesday, August 3, 2011

slide-162
SLIDE 162

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567 Paltalk account name Registry myusername m0y1u2s3e4r5n6a7me x 3 Registry encrypted password yyyz yyyz yyyz yyyz ci: yyyzi - asciiCode(S-BOXn-i)

Wednesday, August 3, 2011

slide-163
SLIDE 163

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Paltalk encryption algorithm

VolumeSerial Number 01234567 Paltalk account name Registry myusername m0y1u2s3e4r5n6a7me x 3 Registry encrypted password yyyz yyyz yyyz yyyz ci: yyyzi - asciiCode(S-BOXn-i)

Wednesday, August 3, 2011

slide-164
SLIDE 164
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Messenger take away

  • If your Skype password is strong we can’t recover it
  • Gtalk and Paltalk are the only ones to use computer

information

  • 3rd party software are the least secure

Wednesday, August 3, 2011

slide-165
SLIDE 165
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

All the credentials recovered by OWADE

Wednesday, August 3, 2011

slide-166
SLIDE 166

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Cloud based forensic

Wednesday, August 3, 2011

slide-167
SLIDE 167

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Cloud modules

  • Leverage the credentials

and history extracted to get cloud-data

  • Might be legal (or not)
  • Only LinkedIn currently

(more modules almost ready)

Wednesday, August 3, 2011

slide-168
SLIDE 168
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

OWADE status

  • Alpha stage
  • Tested on Ubuntu against XP windows
  • Roadmap
  • Stabilizing the code
  • modularize the code so you write your own modules
  • More cloud probes: Facebook, Flickr, Emails...
  • Windows

Vista and 7 integration

Wednesday, August 3, 2011

slide-169
SLIDE 169
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Conclusion

  • People moving to the cloud means more data that is

harder to get

  • Forensics needs to evolve to cope with this
  • OWADE is the first tool dedicated to cloud forensic
  • Decrypt the 4 major browsers data
  • Decrypt Instant messaging credentials
  • Open-source

Wednesday, August 3, 2011

slide-170
SLIDE 170
  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

Beyond files recovery: OWADE cloud based forensic http://owade.org

Please remember to complete your feedback form :)

Thank you !

Wednesday, August 3, 2011

slide-171
SLIDE 171

Beyond files recovery: OWADE cloud based forensic

  • E. Bursztein, I. Fontarensky, J.M. Picod, M. Martin

http://owade.org

Download OWADE http://owade.org Follow-us on Twitter @elie, @projectowade Donate to OWADE to support it !

Wednesday, August 3, 2011