ZENA FORENSICS

When doing Mobile Forensics the first and usually the hardest step is to get access to user's data . It depends on the case type, but the so called physical  acquisition is the analyst object of desire. The reason is simple: iOS and Android native backups, respectively adb  and iTunes , contain a subset of user data, because they respect the various apps configurations where they can specify " you can't include me in backups ". Which leads to inconsistent situations like, for example, having WhatsApp data in iTunes backups and not having it in Android adb backups. Not considering WhatsApp, the majority of apps in iOS and Android do not allow their data to be included in backups . In the scenario where  device is unlocked or the lock  code is known (the only scenario considered in this post), the analyst could use the device itself to make the analysis of the installed applications. Anyone who did that at least once knows how uncomfortable is this a...

Few weeks ago I was contacted about how to decrypt Windows Dropbox DBX files and the same topic appeared on SANS DFIR mailing list too. So I decided to create an Open Source toolkit and this post to brush up on the DBX files create by the Dropbox client on a Windows machine. The Windows Dropbox client keeps its own files - user info, configuration, ' my dropbox ' files sync status and even more - inside the user profile: on the Windows 7 and Windows 10 machines I used for test they reside in ' \Users\%USERNAME%\AppData\Local\Dropbox\ ' and sub folders. Among them there are files with .DBX extension, which are the target of this post. When you take a raw  look at them, you see garbage, noise ... encryption  is in place. Without too much suspence , this is well-known. Nicolas Ruff and Florian Ledoux had a talk at hack.lu   2012 on the topic, “ A critical analysis of Dropbox software security ” ( here ). They discovered that the encryption key used for DBX fi...

The latest trends on the security threat landscape have mainly been Ransomware distributed via infected websites, and Banking Trojans distributed via malicious documents attached to phishing emails. In particular, Dridex banking trojan has been one of the most active threats. Last week the two threats merged and Dridex began distributing Locky ransomware as well. In this post we will go through the analysis of a malicious office document delivering Dridex banking Trojan, spreading just the day before it switched to Locky and we will the similarities between the two actors that make us believe the same is behind the two. Introduction On Friday February 12th, we observed a big wave of phishing attempts, over 700, which looked like the following: Sender: fpo.cc.XX@vosa.gsi.gov.uk Subject: DVSA RECEIPT Attachment: Fixed Penalty Receipt.docm MD5 Checksum: 50e1c94e43f05f593babddb488f1a2f9 Where XX are two random digits. Few days later, on Monday February 15th, we observed ...

Windows Vaults  and Credentials  allow the user to store sensitive information such as user names and passwords , that can be later used to log on web site, services and computers. In this post it will be shown how such data is protected and how you can decrypt it offline. This post is a very late debriefing of the talk I had at  SANS DFIR Summit Prague 2015  and it's the first of two posts. You can download the slides from  SANS Summit Archives  or from  SlideShare . introduction I've never used Vault/Credential facility on purpose, even if the system used it without my knowledge : it's worthwhile to know that Windows autonomously uses it almost every day. In any case, we can find sensitive information there, and this is the reason I started this research, as to have a little more strings to my ODI  ( Offensive Digital Investigations ) bow. Windows provides two utilities to manage such credentials, the graphical  Credential Mana...

I'm not really sure that everybody knows that Rekall memory forensics framework contains a Mimikatz   plugin: with this post I want to address this shortcoming, since the plugin has many good features and it can be easily extended. behind the scenes The act of rekall-ing Mimikatz started when I met Michael Cohen in Prague (SANS DFIR 2014) and a few months later in Dublin (DFRWS 2015). Despite the fact that I learnt so much by speaking with Michael, he deserves the credits to have pushed this plugin development: he released a first version on April 2015, based on what I did with Volatility (see et voilà le mimikatz offline ). So by hangout-ing during the night, we co-authored the actual Rekall mimikatz plugin : it was an awesome dive in Windows memory and Rekall internals, guided by Michael who truly has a talent for explaining complicated things in a simple way. Before going further credits and thanks must go to the awesome reverse engineering research made by Ben...

Windows Phone  8 and greater allows the user to lock/unlock the phone by using a numeric PIN code: it's even possible to use a complex  alphanumeric password. This post addresses how to obtain the simple  numeric PIN code by cracking the authenticator  kept in the SOFTWARE hive. an useless quest? Actually if you have a physical  access to a Windows Phone you don't need the user pincode to examine the user data: with the proper hardware you can usually get a whole dump of the un-encrypted device memory. To my current knowledge the pincode is not used anywhere if not for device locking, so it's almost useless to know it. If the device is under a properly configured MDM, you could face a fully encrypted phone with TPM: in this case you'll have no chance to crack the pincode, even if more testing should be done. This is exactly what I thought when my colleague Mattia Epifani tried to lure me with the Windows Phone PIN issue: he knows the curious monk...