The BBC website identifies a report by MPs that presents findings that many see as the chaotic forensic landscape in Britain today: http://www.bbc.co.uk/news/science-environment-23436303.
But there are other issues needing to be addressed, too.
Marketplace
In some ways the situation reminds me when I responded back in 2005, along with many others I should add, to a public consultation document on legal aid and engagement of consultants and experts in the UK. There is only so much that one can put into a document with the natural expectation that further questions would be asked of the author about its content in order to undestand the minutiae operating behind any opinion or solutions put forward. The solution I put forward was to remodel and reduce or remove regional distortion with respect to the expert fees and the forensics landscape.
Specific Skillset Education (SSE)
As many of you will know I have never pretended to come from an academic background, and despite many attempts by some to insult me due to their own fears that non-academics can know considerably more, I took their hostile approach and made positive of their negative approach by calling for academic qualifications in the area of forensics with which I am concerned - http://trewmte.blogspot.co.uk/2009/01/mobile-forensics-and-evidence-degrees.html. Germane and relevant then why, with the explosive growth and use of mobile communications, after four years there still no standalone academic qualifications in mobile forensics and evidence? There are some academic forensics courses that placed this important area into one-off mini-module to another degree course but it has been and still is plainly obvious that could never meet the standard automatically expected from proper academic skillsets qualifications that were and are needed. The current situation raises the notion that a person need not be academically qualified to intellectualise this subject, but would still require huge knowledge, skillsets and experience to get through. However, concerns about ready-made tools have given rise to what the professional community has called and is calling 'push button forensics' ( http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4906 ) that implants the notion qualifications are not necessary. Alternatively, it is also noted Universities simply may not possess the knowledge, skillsets and experience to impart what is needed to students. What is needed is specific skillset education (SSE) to avoid jack of all trades, master of none.
Possible Solution
Perhaps the House of Commons Science and Technology Committee could look at giving support to people (like me and others) and allow us together with Parliament to create qualifications directly linked to a Prize Degree coming from the House of Commons Science and Technology Committee enabling citizens of this country to re-connect with Parliament. This would create a cushion. In other words, people want more out of Parliament and not just to feel but actually enjoy the experience Parliament serves all areas. Having a Parliamentary Commitee qualification can help do that.
Of course, my observations maybe seen as a novel idea but it would actually fill the gaps being left open by Universities that are unable to deal with a fast changing society and technology revolution and where people with long term knowledge, skill and experience are not working as University lecturers.
Sunday, July 28, 2013
Tuesday, July 23, 2013
New SIM Card Exploit
On the 19th July I posted http://trewmte.blogspot.co.uk/2013/07/android-ddms-vulnerability.html about knowing exploits on and understanding originality and genuineness of a handset and (U)SIM Card.
Karsten Nohl on the 22nd July released details of an exploit for older type (no specifics as yet) SIM Cards using DES security. The exploit revealed a returned 'error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.' http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking
Importantly, the article goes on to identify possible exploits that may be caused when in possession of a decrypted key.
What isn't clear is whether the exploit leads to the creation of a cloned SIM Card that is operating live in the same network at the same time and whether the network detection techniques fail to pick that up? That means not just detect (VLR/HLR) but take decisive action such as call tear down, blocking and suspending IMSI subscriber etc.
Articles:
http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking
http://nakedsecurity.sophos.com/2013/07/22/rooting-sim-cards-blackhat-speaker-says-he-may-be-able-to-own-your-phone-with-a-text-message/
http://thehackernews.com/2013/07/sim-card-cloning-hack-affect-750.html
For some background research materials specific to GSM SIM regarding Java servers and updating SIM OTA:
GSM 11.11
GSM 11.13 (Java Applets)
GSM 11.14 STK
Karsten Nohl on the 22nd July released details of an exploit for older type (no specifics as yet) SIM Cards using DES security. The exploit revealed a returned 'error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.' http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking
Importantly, the article goes on to identify possible exploits that may be caused when in possession of a decrypted key.
What isn't clear is whether the exploit leads to the creation of a cloned SIM Card that is operating live in the same network at the same time and whether the network detection techniques fail to pick that up? That means not just detect (VLR/HLR) but take decisive action such as call tear down, blocking and suspending IMSI subscriber etc.
Articles:
http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking
http://nakedsecurity.sophos.com/2013/07/22/rooting-sim-cards-blackhat-speaker-says-he-may-be-able-to-own-your-phone-with-a-text-message/
http://thehackernews.com/2013/07/sim-card-cloning-hack-affect-750.html
For some background research materials specific to GSM SIM regarding Java servers and updating SIM OTA:
GSM 11.11
GSM 11.13 (Java Applets)
GSM 11.14 STK
Friday, July 19, 2013
Android DDMS Vulnerability
Android DDMS Vulnerability
A suggested in-memory patch solution to the DDMS vulnerability is reported in this article:
https://securityledger.com/2013/07/security-start-up-university-team-on-android-patch-app/
The article states "The flaw is located in an Android component known as the Dalvik Debug Monitor Service (or DDMS), the virtual machine that runs software on Android devices. The vulnerability affects almost all Android devices in use, could allow a malicious actor to modify a legitimate, signed Android application without affecting the application’s cryptographic signature. That would prevent Android from noticing the changes when the application is installed."
So to prevent any new threat occuring ReKey can help you do this. However, what is the solution where threat already existed on the Android phone prior to the in-memory patch being installed? Are there any known affects (exploits that add or alter data or cause call events etc)? Could those 'affects' impact on the weight given to evidence extracted and harvested from a particular smart phone?
How relevant is the above to device examination? Computer forensic examiners spend hours and days sifting through data and studing how a program installs, executes and stores activity generated by use of a program. Smart phones are now highly complex radio communication and electronic devices running a multitude of internal operating programs, user access programs fashioned to the device, interfaces to connect to other devcies and, all importantly, programs to communicate using radio transmission/receiver technologies GSM, W/CDMA, LTE, Wi-Fi, Bluetooth/IRDA, RFID/NFC.
In the early days of mobile phone examination the SIM Card was the focus of attention as little occurred by way of the handset itself. Evolved feature handsets have transformed mobile phones to smart phones and processes of acquiring data have largely become mechanical with plug-in tools pumping out data in production line fashion. Invariably examiners cannot rely simply one one tool but require a toolbag of tools. These tools in themselves are still not enough as the art and skill of interpretation as to the cause and effect and meaning of data are not present in the tools. Sure, tools may show e.g. a (static/active) graph of internet activity of a smart phone once data has been harvested from it but does the tool confirm whether the smart phone automated that process or whether it involved human intervention to cause the intenet activity?
Evolved, too, has the (U)SIM. Which means understanding of what is actually stored on it and applications that run from it, the (U)SIM, cannot be ignored when it comes to automated processes and human intervention.
Image - SIM Toolkits (STKs): Proactive SIM enables and allows a SIM to issue commands and action responses and thus may be susceptable to generating events in a manner and form that needs to be understood (see: GSM11.14).
The DDMS vulnerability reminds us that over-reliance on a tool simply to extract and harvest data and then present the data in a eye-pleasing format is not enough. Understanding the program/s and apps on a smart phone and in a USIM, its genuineness and originality, how data and records are caused to be generated and the interpretation of the records and data is now where we are at. Production line (bang it on, bang it out) recordings of only call activity, phonebooks, texts, IM messages, graphics, internet etc is fast becoming an incomplete methodology for smart phone and USIM examination.
A suggested in-memory patch solution to the DDMS vulnerability is reported in this article:
https://securityledger.com/2013/07/security-start-up-university-team-on-android-patch-app/
The article states "The flaw is located in an Android component known as the Dalvik Debug Monitor Service (or DDMS), the virtual machine that runs software on Android devices. The vulnerability affects almost all Android devices in use, could allow a malicious actor to modify a legitimate, signed Android application without affecting the application’s cryptographic signature. That would prevent Android from noticing the changes when the application is installed."
So to prevent any new threat occuring ReKey can help you do this. However, what is the solution where threat already existed on the Android phone prior to the in-memory patch being installed? Are there any known affects (exploits that add or alter data or cause call events etc)? Could those 'affects' impact on the weight given to evidence extracted and harvested from a particular smart phone?
How relevant is the above to device examination? Computer forensic examiners spend hours and days sifting through data and studing how a program installs, executes and stores activity generated by use of a program. Smart phones are now highly complex radio communication and electronic devices running a multitude of internal operating programs, user access programs fashioned to the device, interfaces to connect to other devcies and, all importantly, programs to communicate using radio transmission/receiver technologies GSM, W/CDMA, LTE, Wi-Fi, Bluetooth/IRDA, RFID/NFC.
In the early days of mobile phone examination the SIM Card was the focus of attention as little occurred by way of the handset itself. Evolved feature handsets have transformed mobile phones to smart phones and processes of acquiring data have largely become mechanical with plug-in tools pumping out data in production line fashion. Invariably examiners cannot rely simply one one tool but require a toolbag of tools. These tools in themselves are still not enough as the art and skill of interpretation as to the cause and effect and meaning of data are not present in the tools. Sure, tools may show e.g. a (static/active) graph of internet activity of a smart phone once data has been harvested from it but does the tool confirm whether the smart phone automated that process or whether it involved human intervention to cause the intenet activity?
Evolved, too, has the (U)SIM. Which means understanding of what is actually stored on it and applications that run from it, the (U)SIM, cannot be ignored when it comes to automated processes and human intervention.
The DDMS vulnerability reminds us that over-reliance on a tool simply to extract and harvest data and then present the data in a eye-pleasing format is not enough. Understanding the program/s and apps on a smart phone and in a USIM, its genuineness and originality, how data and records are caused to be generated and the interpretation of the records and data is now where we are at. Production line (bang it on, bang it out) recordings of only call activity, phonebooks, texts, IM messages, graphics, internet etc is fast becoming an incomplete methodology for smart phone and USIM examination.
Sunday, June 23, 2013
Considering Clone Test SIM Card Tools
Considering Clone Test SIM Card Tools
There have been a few mentions about clone test Sim Cards at this blog raising observations as to possible issues that may be useful to know.
http://trewmte.blogspot.co.uk/2012/10/to-clone-or-not-to-clone.html
http://trewmte.blogspot.co.uk/2008/11/cloning-test-sim-cards.html
Yet further observations examiners may find useful to consider are whether it is necessary for a cloned test SIM Card tool to produce identical files, structure and format for every clone test card produced or whether the make/model of handset can influence e.g. the number of files etc necessary to gain access to a handset's memory? Cust_Files pre-generated on a cloned test card should be included or excluded from consideration regarding the number of GSM/3GPP EFs identified on a cloned test card? The importance, if any, of the evolution in a clone test card's development?
Below are two screen dumps, following examination using just one (U)SIM Card Reader, from two different clone test SIM Cards supplied by different manufacturer with their tools that provide a useful visual indicator when placed in context with the above observations. The observations above and the images below are not published to suggest a problem with a particular clone test SIM Card or tool. The observations are for the purpose should two different examiners use two different clone test SIM Cards and tools to generate evidence which one would be more pertinent for use when accessing memory on a particular handset etc?
There have been a few mentions about clone test Sim Cards at this blog raising observations as to possible issues that may be useful to know.
http://trewmte.blogspot.co.uk/2012/10/to-clone-or-not-to-clone.html
http://trewmte.blogspot.co.uk/2008/11/cloning-test-sim-cards.html
Yet further observations examiners may find useful to consider are whether it is necessary for a cloned test SIM Card tool to produce identical files, structure and format for every clone test card produced or whether the make/model of handset can influence e.g. the number of files etc necessary to gain access to a handset's memory? Cust_Files pre-generated on a cloned test card should be included or excluded from consideration regarding the number of GSM/3GPP EFs identified on a cloned test card? The importance, if any, of the evolution in a clone test card's development?
Below are two screen dumps, following examination using just one (U)SIM Card Reader, from two different clone test SIM Cards supplied by different manufacturer with their tools that provide a useful visual indicator when placed in context with the above observations. The observations above and the images below are not published to suggest a problem with a particular clone test SIM Card or tool. The observations are for the purpose should two different examiners use two different clone test SIM Cards and tools to generate evidence which one would be more pertinent for use when accessing memory on a particular handset etc?
Friday, June 21, 2013
PIN Enabled SIM Card
PIN Enabled SIM Card
A recent question raised the notion what data would be revealed if the SIM Card was read but had a PIN enabled. Using a free SIM Card reader the results are below. Do remember, using different readers their output can reveal different results dependent upon how the programmer wrote the software. The results are from an old Phase 2 GSM SIM Card.
Additional tests with the PIN Locked SIM Card conducted with different SIM Readers
A recent question raised the notion what data would be revealed if the SIM Card was read but had a PIN enabled. Using a free SIM Card reader the results are below. Do remember, using different readers their output can reveal different results dependent upon how the programmer wrote the software. The results are from an old Phase 2 GSM SIM Card.
Additional tests with the PIN Locked SIM Card conducted with different SIM Readers
Saturday, June 15, 2013
Android z7.logs
A SDcard logs examined from a:
1. Samsung Galaxy SII NFC
2. Android OS
3. z7logs
4. z7.log.x (x = 1 or 2)
The log examined z7.logs.2 using notepad reveals the sample of the data below:
- z7.log.2
3 Sep 2012 11:45:35 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape deactivated
3 Sep 2012 11:45:35 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:46:20 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape activated
3 Sep 2012 11:46:20 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Notifying Timescape to requery TimescapeProvider.
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:46:29 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape deactivated
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:47:31 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape activated
3 Sep 2012 11:47:31 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Notifying Timescape to requery TimescapeProvider.
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:48:04 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:48:04 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action:
The history to this SDcard is that it is currently being used in :
- Samsung Galaxy SII NFC
It was used in a:
- Samsung Galaxy Ace2
- Android OS
The card originated from an:
- Song Ericsson Xperia X10 mini Fashion Edition
- Android OS
The last entry SDcard z7.log.2 file date is 08/09/2012 although the last record entry in the log is 03 September 2012. The 08/09/2012 date is correct because the Samsung Galaxy Ace2 was received on the 04/09/2012 but the SD card was migrated to the Samsung Galaxy Ace2 when it was first used 08/09/2012 and later again migrated to the Samsung Galaxy SII NFC on the 05/12/2012.
Just one thing the Xperia was never used for internet or email etc only calls and texts.
1. Samsung Galaxy SII NFC
2. Android OS
3. z7logs
4. z7.log.x (x = 1 or 2)
The log examined z7.logs.2 using notepad reveals the sample of the data below:
- z7.log.2
3 Sep 2012 11:45:35 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape deactivated
3 Sep 2012 11:45:35 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:46:20 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape activated
3 Sep 2012 11:46:20 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Notifying Timescape to requery TimescapeProvider.
3 Sep 2012 11:46:20 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:46:29 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape deactivated
3 Sep 2012 11:46:29 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action: com.sonyericsson.android.timescape.plugin.intent.action.ACTIVATE
3 Sep 2012 11:47:31 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Timescape activated
3 Sep 2012 11:47:31 WARNING[0][ANSharedCommon[Thread[main,5,main]]]Notifying Timescape to requery TimescapeProvider.
3 Sep 2012 11:47:31 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(-)
3 Sep 2012 11:48:04 INFO[0][ANSharedCommon[Thread[main,5,main]]]onReceive(+)
3 Sep 2012 11:48:04 INFO[0][ANSharedCommon[Thread[main,5,main]]]Intent action:
The history to this SDcard is that it is currently being used in :
- Samsung Galaxy SII NFC
It was used in a:
- Samsung Galaxy Ace2
- Android OS
The card originated from an:
- Song Ericsson Xperia X10 mini Fashion Edition
- Android OS
The last entry SDcard z7.log.2 file date is 08/09/2012 although the last record entry in the log is 03 September 2012. The 08/09/2012 date is correct because the Samsung Galaxy Ace2 was received on the 04/09/2012 but the SD card was migrated to the Samsung Galaxy Ace2 when it was first used 08/09/2012 and later again migrated to the Samsung Galaxy SII NFC on the 05/12/2012.
Just one thing the Xperia was never used for internet or email etc only calls and texts.
Thursday, June 13, 2013
Interest in The Rates of Pay
Do you remember I wrote a small piece back in October 2012 about The Rates of Pay - http://trewmte.blogspot.co.uk/2012/10/the-rates-of-pay.html? I also posted at Forensic Focus to allow for open discussion - http://www.forensicfocus.com/Forums/viewtopic/t=9747/. It is useful to see over six months down the line what interest there is on this subject, with over 26,000 viewers of discussion:
Saturday, June 01, 2013
Examples of cell site maps used in evidence
Here are another two examples of specifically generated cell site maps using network infrastructure and radio survey data from a particular mobile network operator, in this case orange PCS, which formed part of the jury bundle in an old murder case.
Equal Power Boundary Map
Character (Text) Composite Map
Tuesday, May 28, 2013
GSM Measurement Report/Response
A response I made to a question raised at Forensic Focus included the remark relting to a measurement report "(MEAS_RES/MEAS_REP message)" http://www.forensicfocus.com/Forums/viewtopic/t=10600/
I referred to this measurement report as it provide useful information in realtime. Knowledge of its existent and the content it holds is very useful for track and trace, law interception and historcially looking back at a switched ON mobile phones profiles returned to the mobile network based upon its particular location at a particular time.
Measurements Reports are obtained by the network for the purposes of allocation of radio resources. The Radio Resource Management (RRM) has responsibility for communicating the necessary messages to the mobile phone. It is important, however, due to the limited resources of radio that utilising control channel requires using shortform notation to send commands in order for the receiver (the MS) to provide responses. To do this a vocabulary was created for GSM and utilised by the RRM e.g. Skip Indicator/Protocol Discriminator = 06 (relevant to handover). The SI/PD message is predefined in a mobile phone's vocabulary (look-up table) to understand messages sent to it. For MEAS_REP the shortform message sent is known as ID (Hex) 15 [binary (00010101) Decimal digits (21)]. The verbose message translated from the shortform ID (Hex) 15 command requires:
MS - > BTS send MEASurement REPort.
This means MEAS_REP transfers the current measurement results of the MS to the BTS (uplink measurements). These measurements contain the sending levels of the serving cell and neighbouring cells. [It is important to remember there is a distinction to be made between a mobile phone switched ON (idle mode and camped on a cell), one that has already registered to the network (idle mode and ready for radio resources) and one that is actively involved with the radio network using resources. In the idle mode the mobile phone in a registered state can update its position either by commands made by the network, by moving to another radio area or using the periodic update parameter to found in the SIM Card elementary file e.g. EFHPLMN.].
In the case of an active connection, a MEAS_REP is sent to the BTS every 480ms via the SACCH. The BTS forwards the MEAS_REP to the BSC, embedded in its own measurement results (MEAS_RES). [In the active state the MEAS_REP assists the network control MS handovers and power output and the MEAS_RES assist with the building blocks for track and trace of an MS to a particular groups of cells and other surveillance tasks.]
With a single meas_rep sent every 480ms whilst the the MS is in dedicated mode this is very fast timing and the combined results from a number of reports/results obtained can be used with the other processes to locate an MS down to within tens of metres of a particular location. WCDMA and LTE also have similar capability/techniques. Where GPS coordinates are also included in the returned reports to the network it is possible to improve location positioning.
Below is an analysed MEAS_RES in more detail with a MEAS_REP included that was captured using a protocol tester on the Abis-interface (BTS/BSC) of a GSM900 PLMN. This example presents a useful opportunity to see a measurement report/response and equally provides a useful primer when looking more at subscriber track and trace and set up possible target-movements for lawful surveillance and interception.
The above can assists those involved in GSM cell site analysis, enabling an investigator to define in more detail the type of content information sought from an operator; as always subject to the type of case being investigated. The above material is not definitively or precisely accurate as each operator requires variation in content reports and uses varyng methods to harvest data, so care is needed before wading in with a list of requirements.
I referred to this measurement report as it provide useful information in realtime. Knowledge of its existent and the content it holds is very useful for track and trace, law interception and historcially looking back at a switched ON mobile phones profiles returned to the mobile network based upon its particular location at a particular time.
Measurements Reports are obtained by the network for the purposes of allocation of radio resources. The Radio Resource Management (RRM) has responsibility for communicating the necessary messages to the mobile phone. It is important, however, due to the limited resources of radio that utilising control channel requires using shortform notation to send commands in order for the receiver (the MS) to provide responses. To do this a vocabulary was created for GSM and utilised by the RRM e.g. Skip Indicator/Protocol Discriminator = 06 (relevant to handover). The SI/PD message is predefined in a mobile phone's vocabulary (look-up table) to understand messages sent to it. For MEAS_REP the shortform message sent is known as ID (Hex) 15 [binary (00010101) Decimal digits (21)]. The verbose message translated from the shortform ID (Hex) 15 command requires:
MS - > BTS send MEASurement REPort.
This means MEAS_REP transfers the current measurement results of the MS to the BTS (uplink measurements). These measurements contain the sending levels of the serving cell and neighbouring cells. [It is important to remember there is a distinction to be made between a mobile phone switched ON (idle mode and camped on a cell), one that has already registered to the network (idle mode and ready for radio resources) and one that is actively involved with the radio network using resources. In the idle mode the mobile phone in a registered state can update its position either by commands made by the network, by moving to another radio area or using the periodic update parameter to found in the SIM Card elementary file e.g. EFHPLMN.].
In the case of an active connection, a MEAS_REP is sent to the BTS every 480ms via the SACCH. The BTS forwards the MEAS_REP to the BSC, embedded in its own measurement results (MEAS_RES). [In the active state the MEAS_REP assists the network control MS handovers and power output and the MEAS_RES assist with the building blocks for track and trace of an MS to a particular groups of cells and other surveillance tasks.]
With a single meas_rep sent every 480ms whilst the the MS is in dedicated mode this is very fast timing and the combined results from a number of reports/results obtained can be used with the other processes to locate an MS down to within tens of metres of a particular location. WCDMA and LTE also have similar capability/techniques. Where GPS coordinates are also included in the returned reports to the network it is possible to improve location positioning.
Below is an analysed MEAS_RES in more detail with a MEAS_REP included that was captured using a protocol tester on the Abis-interface (BTS/BSC) of a GSM900 PLMN. This example presents a useful opportunity to see a measurement report/response and equally provides a useful primer when looking more at subscriber track and trace and set up possible target-movements for lawful surveillance and interception.
The above can assists those involved in GSM cell site analysis, enabling an investigator to define in more detail the type of content information sought from an operator; as always subject to the type of case being investigated. The above material is not definitively or precisely accurate as each operator requires variation in content reports and uses varyng methods to harvest data, so care is needed before wading in with a list of requirements.
Monday, May 27, 2013
The Eagles Soar
The Eagles Soar
I am a Crystal Palace Football Club (CPFC) fan. The first football team I ever saw play (was against West Ham United (the Hammers), and we won) back in 1968. Since then I've never supported another club, never been a journeyman fan. Palace inspired in me loyalty and through the good times or the bad times, the thick and the thin, like many of our fans, I've stuck by Crystal Palace.
Congratulations to The Eagles ( http://www.cpfc.co.uk/index.aspx ) winning the £120 million football match at Wembley and promotion to the English Premier Football League ( http://en.wikipedia.org/wiki/Premier_League ) after overcoming Watford Football Club - http://uk.soccerway.com/news/2013/May/27/english-championship-crystal-palace-1-watford-0/
Thanks for the photos to:
screensavers.brothersoft.com
onthefire.com
History
http://en.wikipedia.org/wiki/History_of_Crystal_Palace_F.C.
I am a Crystal Palace Football Club (CPFC) fan. The first football team I ever saw play (was against West Ham United (the Hammers), and we won) back in 1968. Since then I've never supported another club, never been a journeyman fan. Palace inspired in me loyalty and through the good times or the bad times, the thick and the thin, like many of our fans, I've stuck by Crystal Palace.
Congratulations to The Eagles ( http://www.cpfc.co.uk/index.aspx ) winning the £120 million football match at Wembley and promotion to the English Premier Football League ( http://en.wikipedia.org/wiki/Premier_League ) after overcoming Watford Football Club - http://uk.soccerway.com/news/2013/May/27/english-championship-crystal-palace-1-watford-0/
Thanks for the photos to:
screensavers.brothersoft.com
onthefire.com
History
http://en.wikipedia.org/wiki/History_of_Crystal_Palace_F.C.
Sunday, May 19, 2013
Monday, May 06, 2013
(U)SIM Examination (Physical) Pt2
(U)SIM Examination (Physical) Pt2
Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:
(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later). This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:
(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;
(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.
In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber.
(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference.
The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:
PHY: Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC: Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS: Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC: Security features - 3GPP TS 51.011 [1], clause 7.
CMD: Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF: Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP: Application Protocol - 3GPP TS 51.011 [1], clause 11.
Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.
The run of standards doesn't end there. Attention and consideration should be given to:
ETSI standards
TS 102 230
TS 102 221
International standards
ISO/IEC 7816-pt1 to pt4
The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.
Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:
(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later). This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:
(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;
(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.
In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber.
(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference.
The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:
PHY: Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC: Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS: Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC: Security features - 3GPP TS 51.011 [1], clause 7.
CMD: Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF: Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP: Application Protocol - 3GPP TS 51.011 [1], clause 11.
Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.
The run of standards doesn't end there. Attention and consideration should be given to:
ETSI standards
TS 102 230
TS 102 221
International standards
ISO/IEC 7816-pt1 to pt4
The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.
Monday, April 22, 2013
Tools and Methods for Water Damaged Phones
Tools and Methods for Water Damaged Phones
It's worth recording the links from a discussion that has been being going on about water damaged phones:Ultrasonic cleaning - http://www.ibreakityoufixit.com/shop/catalog/2
Vermiculite - http://www.cmmp-france.com/shawatecgb.html
Fingerprint Study - http://www.ucidiver.com/fingerprint_study.html
Solder Cleaning - www.tayloredge.com/reference/Science/solder_cleaning.pdf
Isopropyl alcohol - http://gorum.ca/clen-pcb.html
Non-forensic chip off - http://trewmte.blogspot.co.uk/2011/02/mobile-phone-chip-off.html
Reballing - www.emulation.com/pdf/102003BGA_Reballing_Instruction_Manual.pdf
Thermal Profiling - http://en.wikipedia.org/wiki/Thermal_profile
RSS - http://en.wikipedia.org/wiki/File:RSS_Components_of_a_Profile1.svg
Thermal Sensor Probes - http://www.thermometersuperstore.co.uk/acatalog/Probes.html
Updated subject matter:
Hydrophobic Coatings on Electronic Devices
I have been looking further into mobile phone
exposure to water to see whether there has been any research or
techniques or processes used in manufacturing to combat water damage /
corrosions etc. Hydrophobic Coatings appears to offer one solution.
More cell phones are damaged by water than by any other means, and this damage often requires the devices to be discarded. The number of damaged phones is also increasing because these phones are now taken almost everywhere. Chemical vapor deposition may be used to provide a solution to this problem. For example, the phones may be coated with a hydrophobic monolayer or multilayer of fluorosilanes. Bonding of the fluorosilane may be adopted for improvement purposes using a primary adhesion layer, which may be a different silane monolayer, e.g., an isocyanatosilane, and/or by introduction of hydroxyl groups via plasma treatment. The latter process is identified as typically rapid and economical and can be applied both on oxide and polymeric materials. The presence of OH groups can be assayed by XPS, ToF-SIMS and ATR-FTIR. The density of surface hydroxyl groups can be varied by changing the proportions of etch gases, the time and intensity of the plasma treatment, and the system base pressure. The hydrophobicity of the surface can be characterised by contact angle goniometry and XPS and ToF-SIMS analysis of fluorine. Resistance to abrasion can be tested with a Martindale abrasion tester.
These selection of applied treatments appear to reduce and slow down the water damage/corrosion and present improved chances of memory retention in unspoiled memory chips.
I see a relevance for knowing about treatments, such as the above, as it can help on many levels: as background prep knowledge, towards a recovered exhibit examination procedure, for use in advisory role as to why some water damaged phone exhibits could produce better results or capable of undergoing tests than others phones, and so on.
More cell phones are damaged by water than by any other means, and this damage often requires the devices to be discarded. The number of damaged phones is also increasing because these phones are now taken almost everywhere. Chemical vapor deposition may be used to provide a solution to this problem. For example, the phones may be coated with a hydrophobic monolayer or multilayer of fluorosilanes. Bonding of the fluorosilane may be adopted for improvement purposes using a primary adhesion layer, which may be a different silane monolayer, e.g., an isocyanatosilane, and/or by introduction of hydroxyl groups via plasma treatment. The latter process is identified as typically rapid and economical and can be applied both on oxide and polymeric materials. The presence of OH groups can be assayed by XPS, ToF-SIMS and ATR-FTIR. The density of surface hydroxyl groups can be varied by changing the proportions of etch gases, the time and intensity of the plasma treatment, and the system base pressure. The hydrophobicity of the surface can be characterised by contact angle goniometry and XPS and ToF-SIMS analysis of fluorine. Resistance to abrasion can be tested with a Martindale abrasion tester.
These selection of applied treatments appear to reduce and slow down the water damage/corrosion and present improved chances of memory retention in unspoiled memory chips.
I see a relevance for knowing about treatments, such as the above, as it can help on many levels: as background prep knowledge, towards a recovered exhibit examination procedure, for use in advisory role as to why some water damaged phone exhibits could produce better results or capable of undergoing tests than others phones, and so on.
Chip Off, JTAG, NAND and YAFFS2
Chip Off, JTAG, NAND and YAFFS2
An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter
An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter
Practitioner's view of Chip Off and JTAG
Raw NAND flash and the YAFFS2 file system
Sunday, April 21, 2013
Plug-in for mobile phones in iSync
Plug-in for mobile phones in iSync, how to use
All plug-ins can be downloaded for free.
Instructions for use
To install one of these plugins download, unzip and place the folder "PhonePlugins" in the "Library" folder (create the folder if it does not exist).
"Library" can refer either to the "Library" folder in the root of the disc (for all users), or to a specific user. In the first case the plug-in will be seen for all users in the latter only for the user for which it is installed.
The plug-in for iSync 10.5.x only work for OS X 10.5 or later.
Plug-in iSync for Motorola
ISync plug-in for Nokia phones (For Mac OS X 10.5)
ISync plug-in for Nokia For Mac OS X 10.5 or later
ISync plug-in for Sony Ericsson mobile Mac OS X 10.5
http://translate.google.co.uk/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Ffaqintosh.com%2Frisorse%2Fit%2Fothutil%2Fisync%2FiSyncLeo%2F&act=url
Instructions for use
To install one of these plugins download, unzip and place the folder "PhonePlugins" in the "Library" folder (create the folder if it does not exist).
"Library" can refer either to the "Library" folder in the root of the disc (for all users), or to a specific user. In the first case the plug-in will be seen for all users in the latter only for the user for which it is installed.
The plug-in for iSync 10.5.x only work for OS X 10.5 or later.
Plug-in iSync for Motorola
ISync plug-in for Nokia phones (For Mac OS X 10.5)
ISync plug-in for Nokia For Mac OS X 10.5 or later
ISync plug-in for Sony Ericsson mobile Mac OS X 10.5
http://translate.google.co.uk/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Ffaqintosh.com%2Frisorse%2Fit%2Fothutil%2Fisync%2FiSyncLeo%2F&act=url
Mobile microprocessors
iPhone to Android
iPhone to Android
Interesting tool:
1 Transfer iPhone SMS and MMS with attachments to Android
2 Transfer SMS and MMS to Android from iTunes Backup
3 Extract picture, video, audio attachments from iPhone MMS to computer
4 Save iPhone SMS and MMS to local database on computer
5 Copy SMS and MMS from PC local database to Android
6 Export iPhone SMS and MMS to document files
7 Print out iPhone SMS and MMS in amazing threading mode
http://www.backuptrans.com/iphone-sms-mms-to-android-transfer.html
1 Transfer iPhone SMS and MMS with attachments to Android
2 Transfer SMS and MMS to Android from iTunes Backup
3 Extract picture, video, audio attachments from iPhone MMS to computer
4 Save iPhone SMS and MMS to local database on computer
5 Copy SMS and MMS from PC local database to Android
6 Export iPhone SMS and MMS to document files
7 Print out iPhone SMS and MMS in amazing threading mode
http://www.backuptrans.com/iphone-sms-mms-to-android-transfer.html
Android Data Extractor Lite
Android Data Extractor Lite
The author of this tools states:
"This Python script dumps all important SQLite Databases from a connected Android smartphone to the local disk and analyzes these files in a forensically accurate workflow. If no smartphone is connected you can specify a local directory which contains the databases you want to analyze. Afterwards this script creates a clearly structured XML report.
If you connect a smartphone you need a rooted and insecure kernel or a custom recovery installed on the smartphone.
ADEL needs a predefined configuration for each device to work proper."
https://github.com/mspreitz/ADELhttps://github.com/mspreitz/ADEL/tree/master/xml
"This Python script dumps all important SQLite Databases from a connected Android smartphone to the local disk and analyzes these files in a forensically accurate workflow. If no smartphone is connected you can specify a local directory which contains the databases you want to analyze. Afterwards this script creates a clearly structured XML report.
If you connect a smartphone you need a rooted and insecure kernel or a custom recovery installed on the smartphone.
ADEL needs a predefined configuration for each device to work proper."
https://github.com/mspreitz/ADELhttps://github.com/mspreitz/ADEL/tree/master/xml
Windows Memory Toolkit
MoonSols Windows Memory Toolkit
This toolkit collection comes in either a free
community edition or cost purchase professional edition. Useful to know
about and try these tools, particularly students with no budget or
budget limitations.
http://www.moonsols.com/windows-memory-toolkit/
http://www.moonsols.com/windows-memory-toolkit/
MBRWizard
MBRWizard
Here's an interesting tool and some links to discussions about variants of MBRWizards and download:
http://mbrwizard.com/http://systemexplorer.net/file-database/file/nbrtwizard-exe
http://mbrwizard.com/http://systemexplorer.net/file-database/file/nbrtwizard-exe
Subscribe to:
Posts (Atom)