US Revolution? Privacy -v- Intrusion
At DEEU research we are noticing an interesting trend in the United States pushing a revolution to claw back the rights of 'privacy' regarding mobile phone communications and GPS tracking, perhaps to counteract what appears to be the underlying suggestion of high level of 'intrusion'. A number of recent cases that have been reported are well worth reading and the rise of these cases suggest landmark judgments may not be far off. The effect of such judgments might bind the US's member states to possibly a single code of conduct. This may make sense where an operator, providing national coverage, has a uniform privacy policy as opposed to a single member state imposing local laws to such a degree that it might be possible to cause:
- the US constitution to be eroded by localised politics in a single member state
- national security may be undermined if a single member state bleeds information about a person's movements simply obtained via a production order application
The points above and below are not statements of fact but merely observations and, rather than my comments influence readers' thought-processes, below is a list of cases and some additional reading that may be of interest. The British legal system may well be interested in what is taking place and such cases can influence aspects of our case law. Mobile forensics and evidence might equally see requirements imposed as to the level of data that maybe accessed from the network and/or acquired from mobile devices. The US, whilst is still in its infancy, due to arriving fairly late to the table in these fields (but making up ground) regarding mobile phone forensics and evidence may, no doubt, want to keep an eye of how these cases impact on the area of data acquisition and harvesting.
Mobile Phone and GPS Privacy Cases:
http://edition.cnn.com/2011/09/20/tech/mobile/california-phone-search-law/
http://arstechnica.com/tech-policy/news/2011/08/judge-says-warrant-required-for-cell-phone-location-data.ars?utm_source=twitterfeed&utm_medium=rss&utm_campaign=rss
http://www.llrmi.com/articles/legal_update/2011_co_schutter.shtml
http://www.theolympian.com/2011/08/21/1767625/courts-grapple-with-gps-technology.html
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2011/08/22/BABR1KQFL7.DTL
http://trewmte.blogspot.com/2009/02/cellular-phones-warrantless-searches.html
Further reading material
http://www.aele.org/law/2011-02MLJ401.html
http://www.jdsupra.com/post/documentViewer.aspx?fid=6c7c563a-d772-413f-b28a-6074c5673f45
http://blogs.sfweekly.com/thesnitch/2011/09/lost_iphone_5_apple.php
http://blogs.sfweekly.com/thesnitch/2011/08/apple_iphone_lost.php
Wednesday, September 21, 2011
Review of Disclosure in Criminal Proceedings UK - update
Review of Disclosure in Criminal Proceedings UK - update
Review of Disclosure in Criminal Proceedings
The Rt Hon. Lord Justice Gross
September 2011
Updated Download Link - Report:
Review of disclosure in Criminal Proceedings - September 2011 (PDF 932kb)
Review of Disclosure in Criminal Proceedings
The Rt Hon. Lord Justice Gross
September 2011
This is a review ("the review") conducted at the request of and for the Lord Chief Justice, prompted by concerns as to the operation of the disclosure regime contained in the Criminal Procedure and Investigations Act 1996, as amended ("the CPIA").
The review was established to consider the practical operation of the CPIA disclosure regime and, if appropriate, the legislative framework, with a particular focus on the proportionality of the time and costs involved in that disclosure process.
The review was established to consider the practical operation of the CPIA disclosure regime and, if appropriate, the legislative framework, with a particular focus on the proportionality of the time and costs involved in that disclosure process.
Updated Download Link - Report:
Review of disclosure in Criminal Proceedings - September 2011 (PDF 932kb)
Tuesday, September 20, 2011
7.5 trillion mobile communications
7.5 trillion mobile communications
My recent post discussed mobile growth areas, as many have at this blog (just search past posts) and highlights the current European trend with smart-phones. A recognition of the British localised trends in the mobile marketplace can be read about here: UK_CMR_2011_FINAL.pdf
A news article about an Ovum report suggests the quantity of mobile -calls -texts -images and video messages will reach 7.5 trillion this year. Moreover, it is reported: "In a new forecast, the independent telecoms analyst also predicts that the market will generate revenues of $153 billion this year, up 8% on last year’s performance."
From analysis of a number of cross-market conditions by various market analysts these indicators provide useful coordinates about the future of mobile forensics and evidence. It is very positive, but there is a natural consequence of that success; adjustments will need to be made. Those trends cannot help but bring change and imply there will be a need for transformation from the current investigatory set up and a shake up of the stoggy and bloated surface-level superficiality stifling and damaging the approrpriate structural processes inherent in the mobile forensics and evidence tree, perhaps illustrated by the way in which honey-fungus of the genus Armillaria variety eats at the very core of a tree.
My recent post discussed mobile growth areas, as many have at this blog (just search past posts) and highlights the current European trend with smart-phones. A recognition of the British localised trends in the mobile marketplace can be read about here: UK_CMR_2011_FINAL.pdf
A news article about an Ovum report suggests the quantity of mobile -calls -texts -images and video messages will reach 7.5 trillion this year. Moreover, it is reported: "In a new forecast, the independent telecoms analyst also predicts that the market will generate revenues of $153 billion this year, up 8% on last year’s performance."
From analysis of a number of cross-market conditions by various market analysts these indicators provide useful coordinates about the future of mobile forensics and evidence. It is very positive, but there is a natural consequence of that success; adjustments will need to be made. Those trends cannot help but bring change and imply there will be a need for transformation from the current investigatory set up and a shake up of the stoggy and bloated surface-level superficiality stifling and damaging the approrpriate structural processes inherent in the mobile forensics and evidence tree, perhaps illustrated by the way in which honey-fungus of the genus Armillaria variety eats at the very core of a tree.
Saturday, September 17, 2011
Review of Disclosure in Criminal Proceedings UK
Review of Disclosure in Criminal Proceedings
The Rt Hon. Lord Justice Gross
September 2011
This is a review (“the review”) conducted at the request of and for the Lord Chief Justice, prompted by concerns as to the operation of the disclosure regime contained in the Criminal Procedure and Investigations Act 1996, as amended (“the CPIA”).
Download report:
http://www.judiciary.gov.uk/Resources/JCO/Documents/Reports/disclosure-review-september-2011.pdf
The Rt Hon. Lord Justice Gross
September 2011
This is a review (“the review”) conducted at the request of and for the Lord Chief Justice, prompted by concerns as to the operation of the disclosure regime contained in the Criminal Procedure and Investigations Act 1996, as amended (“the CPIA”).
Download report:
http://www.judiciary.gov.uk/Resources/JCO/Documents/Reports/disclosure-review-september-2011.pdf
Note: Text missing from the report at paragraph xiii) end of page 6, start of page 7.
Arrhenius equation, preserving photos/videos for 100 years
Arrhenius equation, preserving photos/videos for 100 years
Arrhenius acceleration factor and accelerated temperature cycling can be applied to simulate the effects on data retention held within memory devices on their store media. We learn that to determine the relationship between the rate constant (or acceleration factor) and the activation energy and temperature of a reaction can be given by Arrhenius equation expressed as:
In order to assess preservation we are informed, during tests, data can be subjected to "temperatures and activation energies" to determine their retention qualities under the following conditions:
- Ea = Activation Energy = 1.0 ev
- Boltzmann Constant = 8.62*10-5
- Product application temperature used for this test (Ta) = 40ºC
- Product test temperature used for this test (Tt) = 125ºC
- Product's time-to-failure is exponential
- Arrhenius Acceleration Factor = 2721
It is said that using a conservative approach applied to values of "well-known" industry standard numbers for the calculation, and higher stress of 40ºC (typical archival storage temperature of 25°C +/- 10°C), termperature cycle tests performed on n-DUTs (Device Under Test) and accelerated temperature of 125°C applied over x-hours can verify deterioration (thus preservation potential) of data occurs following tests. The output recorded can be simplified with the results entered in an Arrhenius table.
Now the question. Has 100 years has been proven possible? According to recent announcements it is said to be more than possible, devices can achieve this such as SanDisk Memory Vault™. Indeed devices like these are able to store photos and videos for 104 years, apparently.
I thought the information might be useful to discuss because I heard on BBC radio news that suggestions for firearms officers to wear video cameras to record an incident or operation had some difficulties about storage. The radio news made no further mention about the exact storage difficulties, but if the difficulties involve archive (for large-scale storage) and preservation, might the above information be of some help?
Arrhenius acceleration factor and accelerated temperature cycling can be applied to simulate the effects on data retention held within memory devices on their store media. We learn that to determine the relationship between the rate constant (or acceleration factor) and the activation energy and temperature of a reaction can be given by Arrhenius equation expressed as:
In order to assess preservation we are informed, during tests, data can be subjected to "temperatures and activation energies" to determine their retention qualities under the following conditions:
- Ea = Activation Energy = 1.0 ev
- Boltzmann Constant = 8.62*10-5
- Product application temperature used for this test (Ta) = 40ºC
- Product test temperature used for this test (Tt) = 125ºC
- Product's time-to-failure is exponential
- Arrhenius Acceleration Factor = 2721
It is said that using a conservative approach applied to values of "well-known" industry standard numbers for the calculation, and higher stress of 40ºC (typical archival storage temperature of 25°C +/- 10°C), termperature cycle tests performed on n-DUTs (Device Under Test) and accelerated temperature of 125°C applied over x-hours can verify deterioration (thus preservation potential) of data occurs following tests. The output recorded can be simplified with the results entered in an Arrhenius table.
Now the question. Has 100 years has been proven possible? According to recent announcements it is said to be more than possible, devices can achieve this such as SanDisk Memory Vault™. Indeed devices like these are able to store photos and videos for 104 years, apparently.
I thought the information might be useful to discuss because I heard on BBC radio news that suggestions for firearms officers to wear video cameras to record an incident or operation had some difficulties about storage. The radio news made no further mention about the exact storage difficulties, but if the difficulties involve archive (for large-scale storage) and preservation, might the above information be of some help?
Sunday, September 11, 2011
Cybercrime: procedures, deterrent and investigation
Cybercrime: procedures, deterrent and investigation
The title cybercrime Convention on Cybercrime is not new and has had numerous airings going back to the late 1990s and early 2000s. It has largely languished there, though, until it became the economic follow-up to the war on terrorism given there has been a signifcant shift towards electronic attacks or gained perception about the potential threat for crimes to be committed using technoology.
Cybercrime isn't actually a qualification in itself of the 'actual crime' that has been or is about to be perpetrated, rather on the one hand it provides a global statement under which preventions, deterrent and investigation can be defined about crimes where technology is or can be used as a conduit for a criminal or terrorist event. The technologies that are perceived to be relevant and 'usable' for cybercrime are set out in:
Proposal for a COUNCIL FRAMEWORK DECISION on attacks against information systems
Article 2
Definitions
For the purposes of this Framework Decision, the following definitions shall apply:
(a) "Electronic communications network" means transmission systems and, where applicable, switching or routing equipment and other resources which permit the conveyance of signals by wire, by radio, by optical or by other electromagnetic means, including satellite networks, fixed (circuit- and packet-switched, including Internet) and mobile terrestrial networks, electricity cable systems, to the extent that they are used for the purpose of transmitting signals, networks used for radio and television broadcasting, and cable TV networks, irrespective of the type of information conveyed"
So this represents a broad range of identified technologies (whether used in natural sciences or manmade systems) that are identified avenues for 'cybercirme' procedures, deterrent and investigation. Furthermore, and on the other hand, cybercrime equally requires the 'type' of crime (substantive or inchoate) to be identifed that has or could operate 'through' a single or combination of technologies. For instance:
- a virus that is inserted into the electronic communication messages sent via Broadband of Power Lines (BPL) that takes down or attempts to take down a power station causing blackout might range in criminal law as a type of crime indicted eg under criminal damage, ecomonic damage, computer misuse, terrorism etc
- a message mispresenting a genuine individual that allows funds to be removed from the indiviudals account using the wireless network may be indicted in criminal proceedings as a fraud etc
In the UK, legislation covers crimes such as 'abstraction of electricity', 'obtaining a telecommunication service with the intention of avoiding payment', 'computer misuse', unlawful interception' etc. To re-write all the relevant Statutes to identify crimes like these and other as 'cybercrime' would not seem practical at all. Cybercrime, then, perhaps may well be best described for use as a 'global title' to identify a state of 'events' generated through the use of various technologies.
The International Telecommunications Union (ITU) recognises the need for cybercrime procedures, deterrent and investigation and published two highly informative draft guides that one would expect to find produced from such an experienced and authoritative organisation:
D010B0000073301PDFE.pdf
ITU toolkit cybercrime legislation.pdf
As these documents are drafts, it is clear that evolving documents will continue to refine and define 'cybercrime' but may remain unable to circumvent the identification of the actual technologies used in a crime. One possible consequence of this is that forensic exmainers and experts in their specific fields will continue to provide their services, but an adjustment to a report or opinion may be required to start with e.g.
"Cybercrime Report/Opinion: The use of X-technology in such and such an alleged crime...."
The title cybercrime Convention on Cybercrime is not new and has had numerous airings going back to the late 1990s and early 2000s. It has largely languished there, though, until it became the economic follow-up to the war on terrorism given there has been a signifcant shift towards electronic attacks or gained perception about the potential threat for crimes to be committed using technoology.
Cybercrime isn't actually a qualification in itself of the 'actual crime' that has been or is about to be perpetrated, rather on the one hand it provides a global statement under which preventions, deterrent and investigation can be defined about crimes where technology is or can be used as a conduit for a criminal or terrorist event. The technologies that are perceived to be relevant and 'usable' for cybercrime are set out in:
Proposal for a COUNCIL FRAMEWORK DECISION on attacks against information systems
Article 2
Definitions
For the purposes of this Framework Decision, the following definitions shall apply:
(a) "Electronic communications network" means transmission systems and, where applicable, switching or routing equipment and other resources which permit the conveyance of signals by wire, by radio, by optical or by other electromagnetic means, including satellite networks, fixed (circuit- and packet-switched, including Internet) and mobile terrestrial networks, electricity cable systems, to the extent that they are used for the purpose of transmitting signals, networks used for radio and television broadcasting, and cable TV networks, irrespective of the type of information conveyed"
So this represents a broad range of identified technologies (whether used in natural sciences or manmade systems) that are identified avenues for 'cybercirme' procedures, deterrent and investigation. Furthermore, and on the other hand, cybercrime equally requires the 'type' of crime (substantive or inchoate) to be identifed that has or could operate 'through' a single or combination of technologies. For instance:
- a virus that is inserted into the electronic communication messages sent via Broadband of Power Lines (BPL) that takes down or attempts to take down a power station causing blackout might range in criminal law as a type of crime indicted eg under criminal damage, ecomonic damage, computer misuse, terrorism etc
- a message mispresenting a genuine individual that allows funds to be removed from the indiviudals account using the wireless network may be indicted in criminal proceedings as a fraud etc
In the UK, legislation covers crimes such as 'abstraction of electricity', 'obtaining a telecommunication service with the intention of avoiding payment', 'computer misuse', unlawful interception' etc. To re-write all the relevant Statutes to identify crimes like these and other as 'cybercrime' would not seem practical at all. Cybercrime, then, perhaps may well be best described for use as a 'global title' to identify a state of 'events' generated through the use of various technologies.
The International Telecommunications Union (ITU) recognises the need for cybercrime procedures, deterrent and investigation and published two highly informative draft guides that one would expect to find produced from such an experienced and authoritative organisation:
D010B0000073301PDFE.pdf
ITU toolkit cybercrime legislation.pdf
As these documents are drafts, it is clear that evolving documents will continue to refine and define 'cybercrime' but may remain unable to circumvent the identification of the actual technologies used in a crime. One possible consequence of this is that forensic exmainers and experts in their specific fields will continue to provide their services, but an adjustment to a report or opinion may be required to start with e.g.
"Cybercrime Report/Opinion: The use of X-technology in such and such an alleged crime...."
Saturday, September 10, 2011
Smart phones overtake basic mobile phones in Europe
Smart phones overtake basic mobile phones in Europe
The Guardian newspaper, thursday 8/9/11, reported "New data released by research company IDC show smartphone shipments up 48% compared to the same period in 2010, reaching nearly 22m, as Samsung, Apple, HTC and BlackBerry maker RIM dominated the market and Finland's Nokia saw its previous dominance wiped out. Last year smartphones made up just over a third of mobile phone sales in the region."
However, alternative research from IMS suggests that, infact, there is a SIM card sales explosion: "Of the 4.2 billion SIMs sold in 2010, 85% were to existing SIM card users, i.e. existing users of cellular handsets. This means that more than 80% of SIM-based cell phone users replaced their SIM cards last year. This may seem a little surprising as the proportion of cell phone users that replaced their actual handsets last year was much less than this. In fact at a global level, only 24% of cell phone users replaced their handsets with brand new handsets last year."
Moreover, IMS research further suggests when dealing with 4FF embedded SIMs: "With the current removable model, the volume of SIM cards sold in 2016 is set to pass 6 billion. If all cards were embedded by this time the number would be nearer 2 billion, around half what it was last year! As the SIM card market represents more than 80% of smart card volumes, this would be very bad news for many card and semiconductor suppliers."
On the basis of both reports the news in quite uplifting and a useful indicator of growth. At a time when the Prime Minister, David Cameron, looks to re-assess economic imbalance (services -v- manufacturing) in Britian, the elements to bring about the stimulus for wealth-creation, productivity and employment maybe here. Why would that be so? Because here is an area where services and manufacturing are required to forge a union in order that both can co-exist, such that they work not only in practice but in principle, too.
I am happy to revisit the sub-text of my 1988 proposal 'Putting Britain First' and reference to other reading materials if it would help put meat on the bones of this one.
The Guardian newspaper, thursday 8/9/11, reported "New data released by research company IDC show smartphone shipments up 48% compared to the same period in 2010, reaching nearly 22m, as Samsung, Apple, HTC and BlackBerry maker RIM dominated the market and Finland's Nokia saw its previous dominance wiped out. Last year smartphones made up just over a third of mobile phone sales in the region."
However, alternative research from IMS suggests that, infact, there is a SIM card sales explosion: "Of the 4.2 billion SIMs sold in 2010, 85% were to existing SIM card users, i.e. existing users of cellular handsets. This means that more than 80% of SIM-based cell phone users replaced their SIM cards last year. This may seem a little surprising as the proportion of cell phone users that replaced their actual handsets last year was much less than this. In fact at a global level, only 24% of cell phone users replaced their handsets with brand new handsets last year."
Moreover, IMS research further suggests when dealing with 4FF embedded SIMs: "With the current removable model, the volume of SIM cards sold in 2016 is set to pass 6 billion. If all cards were embedded by this time the number would be nearer 2 billion, around half what it was last year! As the SIM card market represents more than 80% of smart card volumes, this would be very bad news for many card and semiconductor suppliers."
On the basis of both reports the news in quite uplifting and a useful indicator of growth. At a time when the Prime Minister, David Cameron, looks to re-assess economic imbalance (services -v- manufacturing) in Britian, the elements to bring about the stimulus for wealth-creation, productivity and employment maybe here. Why would that be so? Because here is an area where services and manufacturing are required to forge a union in order that both can co-exist, such that they work not only in practice but in principle, too.
I am happy to revisit the sub-text of my 1988 proposal 'Putting Britain First' and reference to other reading materials if it would help put meat on the bones of this one.
Sunday, August 28, 2011
Touch Screens - Keeping them fingerprint free
Touch Screens - Keeping them fingerprint free
In my early thread about android dots locking the screen several possibilities were raised and, in particular, I happen to mention "ii) using fingerprint tape on the touch-screen (so clean the screen regularly)"; that was mentioned in context with the theme of the discussion about avoiding your security access being breached by an unauthorised person.
After some highly active chats with people, nothing to precipitant of course, and not to put too fine a point upon it, the conversation (some of which was rather humorous) turned to prevention of *fingerprints, rather than cure of them. Various options were discussed, which had to be inexpensive:
- Wearing gloves. Ideas stretched (no pun intended) from Marigold Washing Up gloves to those Latex gloves. One would look pretty ridiculous, wouldn't one, having to put on one's gloves everytime one wanted to use one's phone?
- False hand. Now, you see, this is exactly what I am talking about, people just wont be sensible :-). This led to thoughts about Kenny Everitt's character, the one with the giant hands, 'Brother Lee Love'. It was felt, after a long discussion and a few pints of larger, that hands like this would be OK in the boardroom but would be thoroughly inappropriate for use when sitting in a packed train carriage and tapping the passenger (in the next seat) on their face and body with hands this size and asking him/her to budge-up so one could use the touch screen phone. That was considered using poor ettiquette and simply bad form to do it. So let that be a lesson to you all, don't get on trains with big hands if you want to use your touch screen device.
- Cling-film. Oh yes, real classy! But it is cheap and it is disposable (but does it avoid fingerprints?). Could, though, cause a run on stock at the local supermarket due to frequent changes.
- Screen spray protection. Now it would have useful to find out more about any spray on products that prevented lipids build up on the screen, similar to this type of product Windshield Treatment
- Cover screen protection. The ones seen during research tended to show a plastic screen cover or film which might work if they do not retain fingerprint smudges or lipids residue on the cover screen of film.
- Stylus. Research reveals that there are over 15 million pages on google that refer to 'stylus'. Clearly, a bit of research refinement was necessary and I came away with these items for the purposes of the topic of this thread:
This stylus is called a 'capacitive stylus', and you can learn more about why they are used here
They can be used with resistive touch screen devices, such as HTC and so on:
From the styli research I came away with the notion that if "necessity is the mother of invention", (in fact we are told Plato actually said: "Necessity, who is the mother of invention") then styli are in need of it, apparently. I arrived at this opinion when one individual found you could make a free of charge capacitive stylus made from a "silvery-metallic looking antistatic film". OK, ok, I think I am following this. Enlightenment is just around the corner with a home made video. It is only an image, below, so follow the link to how-to-make-a-free-capacitive-stylus to watch the video. I found the author of the video waving his hands around alot and it is abit distracting when watching the video. Also, he finds it necessary to touch the screen with the hand not holding the home-made stylus, which could indicate a possible set back in avoiding fingerprints. Fair play to him, though, as it appear his find might just be a discovery of necessity of some sort, but that is just pure speculation on my behalf.
Having trawled the life and times of these styli I happened to come across this little video gem (below) from someone using a home made version of capacitive stylus made from a "square of static bag". Two points to note. One point is that a outcome of using a capacitive stylus is that when used it cleans the screen at the same time, apparently. I had some difficulty in following that logic if the point in using a stylus is to avoid using fingers then where are the fingerprints to be revealed eg: the dots, pin, password? The second point might answer the former question as it seems the video is actually about preservation of fingerporints when a touch screen device is being examined and where the user has fingered his/her touch screen device. I'll give at least one mark out of ten for effort for the handwritten statement of intent at the top of the paper which the author of the video helpful points out to refresh our memory of it. I'll leave all of you to judge how effective the technqiue is used by the video's author. Follow this link to preservation of fingerprints
So, luckily, having worked to bring the discussion back on topic about fingerprints, it would appear there is a world out deeply involved with 'mothers of inventions' working out how to avoid leaving fingerprints on touch screen devcies and another world working out how to preserve them. Moreover, use a stylus by all means, but you will need two if you wish to re-size the image on the touch screen. Finally, I and those raise observations take no responsibility for anyone using any of the observations above. If you have any suggestions you would like to add to this discussion on how to avoid or preserve fingerprints on touch screen devices send an email (to trewmte@gmail.com) along with your name and company and those details will be given as a by-line along with your suggestions.
So there you have it.
Until the next time, have a great August bank holiday.
* Lipophobicity & Oleophobic
* Indium tin oxide - one of the most widely used transparent conducting oxides
* Example of device using Oleophobic coating technology Ipad
In my early thread about android dots locking the screen several possibilities were raised and, in particular, I happen to mention "ii) using fingerprint tape on the touch-screen (so clean the screen regularly)"; that was mentioned in context with the theme of the discussion about avoiding your security access being breached by an unauthorised person.
After some highly active chats with people, nothing to precipitant of course, and not to put too fine a point upon it, the conversation (some of which was rather humorous) turned to prevention of *fingerprints, rather than cure of them. Various options were discussed, which had to be inexpensive:
- Wearing gloves. Ideas stretched (no pun intended) from Marigold Washing Up gloves to those Latex gloves. One would look pretty ridiculous, wouldn't one, having to put on one's gloves everytime one wanted to use one's phone?
- False hand. Now, you see, this is exactly what I am talking about, people just wont be sensible :-). This led to thoughts about Kenny Everitt's character, the one with the giant hands, 'Brother Lee Love'. It was felt, after a long discussion and a few pints of larger, that hands like this would be OK in the boardroom but would be thoroughly inappropriate for use when sitting in a packed train carriage and tapping the passenger (in the next seat) on their face and body with hands this size and asking him/her to budge-up so one could use the touch screen phone. That was considered using poor ettiquette and simply bad form to do it. So let that be a lesson to you all, don't get on trains with big hands if you want to use your touch screen device.
Photo Courtesy of videovista.net - kenever3.jpg
- Cling-film. Oh yes, real classy! But it is cheap and it is disposable (but does it avoid fingerprints?). Could, though, cause a run on stock at the local supermarket due to frequent changes.
- Screen spray protection. Now it would have useful to find out more about any spray on products that prevented lipids build up on the screen, similar to this type of product Windshield Treatment
- Cover screen protection. The ones seen during research tended to show a plastic screen cover or film which might work if they do not retain fingerprint smudges or lipids residue on the cover screen of film.
- Stylus. Research reveals that there are over 15 million pages on google that refer to 'stylus'. Clearly, a bit of research refinement was necessary and I came away with these items for the purposes of the topic of this thread:
This stylus is called a 'capacitive stylus', and you can learn more about why they are used here
The photo is courtesy of htcaccessorystore
They can be used with resistive touch screen devices, such as HTC and so on:
Photo coutesy of engadget
From the styli research I came away with the notion that if "necessity is the mother of invention", (in fact we are told Plato actually said: "Necessity, who is the mother of invention") then styli are in need of it, apparently. I arrived at this opinion when one individual found you could make a free of charge capacitive stylus made from a "silvery-metallic looking antistatic film". OK, ok, I think I am following this. Enlightenment is just around the corner with a home made video. It is only an image, below, so follow the link to how-to-make-a-free-capacitive-stylus to watch the video. I found the author of the video waving his hands around alot and it is abit distracting when watching the video. Also, he finds it necessary to touch the screen with the hand not holding the home-made stylus, which could indicate a possible set back in avoiding fingerprints. Fair play to him, though, as it appear his find might just be a discovery of necessity of some sort, but that is just pure speculation on my behalf.
Having trawled the life and times of these styli I happened to come across this little video gem (below) from someone using a home made version of capacitive stylus made from a "square of static bag". Two points to note. One point is that a outcome of using a capacitive stylus is that when used it cleans the screen at the same time, apparently. I had some difficulty in following that logic if the point in using a stylus is to avoid using fingers then where are the fingerprints to be revealed eg: the dots, pin, password? The second point might answer the former question as it seems the video is actually about preservation of fingerporints when a touch screen device is being examined and where the user has fingered his/her touch screen device. I'll give at least one mark out of ten for effort for the handwritten statement of intent at the top of the paper which the author of the video helpful points out to refresh our memory of it. I'll leave all of you to judge how effective the technqiue is used by the video's author. Follow this link to preservation of fingerprints
So, luckily, having worked to bring the discussion back on topic about fingerprints, it would appear there is a world out deeply involved with 'mothers of inventions' working out how to avoid leaving fingerprints on touch screen devcies and another world working out how to preserve them. Moreover, use a stylus by all means, but you will need two if you wish to re-size the image on the touch screen. Finally, I and those raise observations take no responsibility for anyone using any of the observations above. If you have any suggestions you would like to add to this discussion on how to avoid or preserve fingerprints on touch screen devices send an email (to trewmte@gmail.com) along with your name and company and those details will be given as a by-line along with your suggestions.
So there you have it.
Until the next time, have a great August bank holiday.
* Lipophobicity & Oleophobic
* Indium tin oxide - one of the most widely used transparent conducting oxides
* Example of device using Oleophobic coating technology Ipad
Monday, August 22, 2011
TCP/IP, RFC and a few laughs along the way
TCP/IP, RFC and a few laughs along the way
For those of us who are constantly studying to keep up to date with technological advances or going on re-fresher courses to remind ourselves of things we thought we knew well, but had actually forgotten bits and pieces, it is the daunting amount of information to be read and absorbed that can be off-putting at times. For example, I am currently on a re-fresher for TCP/IP (Transmission Control Protocol/Internet Protocol - TCP/IP_model) and just one of the documents I am reading runs to over 700 pages long. TCP/IP sounds very boring (and to most it probably is).
Given that the nitty-gritty of TCP/IP also appears technically demanding to understand (perhaps a bit like rocket science) one needs a sense of humour working in this arena if one is not to go ‘bonkers’ or become a total ‘anorak’ on the subject. Whilst reading the commentary on the standardisation bodies structure responsible for the creation of RFC (Request for Comments) IP Standards and proposals for RFC standards I was came across a couple of gems, which I found quite humorous. To fully appreciate the humour, one needs first to have an appreciation of the aura of formality and control engendered around understanding standardisation and the bodies that assist in their creation.
As a very brief overview, because of the openness and perpetual renewal of TCP/IP, which is popular with developers and users alike, there is no overall governing body to issue directives and regulations for the Internet. Control is mostly based on mutual co-operation. The Internet community is said to be organised and managed by the Internet Architecture Board (IAB). The IAB itself relies on the Internet Engineering Task Force (IETF) for issuing new Standards (RFCs) and the Internet Assigned Numbers Authority (IANA) for co-ordinating values shared among multiple protocols. RFC standards can be proposed by anyone; but the RFC Editor is responsible for reviewing and publishing new standards documents. The IETF itself is governed by the Internet Engineering Steering Group (IESG) and is further organised in the form of Areas and Working Groups where new specifications are discussed and new standards are proposed.
In order to have a new IP protocol approved as a standard, applicants have to submit a proposed specification to the IESG where it will be discussed and reviewed for technical merit and feasibility and also published as an Internet draft document. For Internet Protocol suite to evolve through the mechanism of Request for Comments (RFC) new protocols (mostly application protocols) are designed and implemented by researchers, and are brought to the attention of the Internet community identified in standard categories:
Draft standard: There is a possibility that changes will be made in a draft protocol before it becomes a standard.
Proposed standard: Revision of the protocol is likely.
Experimental: A system should not implement an experimental protocol unless it is participating in the experiment and has co-ordinated its use.
Informational: Protocols developed by other standard organisations, or vendors, or that are for other reasons outside the purview of the IAB may be published as RFCs
Historic: These are protocols that are unlikely to ever become standards, because they have been superseded by later developments or due to lack of interest.
Required: A system must implement the required protocols.
Recommended: A system should implement the recommended protocol.
Elective: A system may or may not implement an elective protocol. The general notion is that if you are going to do something like this, you must do exactly this.
Limited use: These protocols are for use in limited circumstances. This may be because of their experimental state, specialised nature, limited functionality, or historic state.
Not recommended: These protocols are not recommended for general use. This may be because of their limited functionality, specialised nature, or experimental or historic state.
The overall picture one gets, having glimpsed at this highly defined and controlled standardisation structure, is one of individuals feverishly working away solving technical conundrums with little room for levity. Well, apparently not. It was with a grinning surprise I found, amid all this rocket science, that some ‘techies’ have been allowed to let their imaginations run riot – presumably to defeat creeping techmadness, maybe? Two protocols identified by the RFC Editor, and dated April 1st that are described at best as “impractical”:
RFC 1149 (dated 1990 April 1 - rfc1149) describes: A standard for the transmission of IP datagrams by avian carrier (carrier pigeon)
See also RFC 6214 – (rfc6214)
RFC 1437 (dated 1993 April 1 - rfc1437) describes: The Extension of MIME Content-Types to a New Medium (transmission of people by electronic mail).
Are these two impractical or just ahead of their time?
Thursday, August 18, 2011
Android DOTS - Locking the Screen
Android DOTS - Locking the Screen
I have received several emails following the earlier post iphones-common-password-usage-risks whether I had seen other studies or reports about security risks with the Locking the Screen (linking DOTS) feature in Android and similar featured mobile phones and what I thought.
It is impossible to read everything and many studies/report sometimes don't become available until some years after authors produce them.
My own analysis of the reports (at this stage) that I have seen thus far is that many of the comments about Locking the Screen privacy techniques generally identify that an author acknowledges the device has this privacy/security capability available and provides one method to reduce risk. Forensically speaking, authors also record the complications when the restricted access mode is activated when the device is presented for examination. These are useful comments, but are not fully supported by any indepth research to define common combination of DOTS used by users for their numerical choice of locking patterns. That is menat to be taken in context with the common choice of PINs as suggested by the post iphones-common-password-usage-risks.
The authors Aviv/Gibson/Mossop/Blaze/Smith in 2010 produced an informed and respected report on Screen Smudges that illustrated risks of pattern smudges on the mobile phone touch-screen being detected which refined earlier concerns in 2009 about smudging illustrated in posts on the Android - An Open Handset Alliance Project.
There are discussive science articles on the web about how secure are Android DOTS unlock_patterns regarding numerical choices for the locking code that, again, could provide useful material for more indepth forensic analysis and study. I could carrry on identifying material I have researched but that would merely produce, largely, similar and repetitous paragraphs of statements listing what I found available. However, risks to user touch-screen mobile phones may occur when considering entering unlock DOTS patterns, passwords and PINs and unauthorised access attacker or hackers gaze could potentially include the less troublesome methods to gain access using:
i) clandestine apps/progs (WORMs etc from download or P2P) that could record user entries on the touch-screens and storing the output [having fowarded to a memory cards etc] in a hidden file (so be aware of apps/progs on the handset - check eg file manager/root and change memory cards on a regular basis)
ii) using fingerprint tape on the touch-screen (so clean the screen regularly)
iii) shoulder-surfing the user's locking DOTS pattern (so the longer the pattern the harder it can be for the shoulder-surfer to memorise)
I have received several emails following the earlier post iphones-common-password-usage-risks whether I had seen other studies or reports about security risks with the Locking the Screen (linking DOTS) feature in Android and similar featured mobile phones and what I thought.
It is impossible to read everything and many studies/report sometimes don't become available until some years after authors produce them.
My own analysis of the reports (at this stage) that I have seen thus far is that many of the comments about Locking the Screen privacy techniques generally identify that an author acknowledges the device has this privacy/security capability available and provides one method to reduce risk. Forensically speaking, authors also record the complications when the restricted access mode is activated when the device is presented for examination. These are useful comments, but are not fully supported by any indepth research to define common combination of DOTS used by users for their numerical choice of locking patterns. That is menat to be taken in context with the common choice of PINs as suggested by the post iphones-common-password-usage-risks.
The authors Aviv/Gibson/Mossop/Blaze/Smith in 2010 produced an informed and respected report on Screen Smudges that illustrated risks of pattern smudges on the mobile phone touch-screen being detected which refined earlier concerns in 2009 about smudging illustrated in posts on the Android - An Open Handset Alliance Project.
There are discussive science articles on the web about how secure are Android DOTS unlock_patterns regarding numerical choices for the locking code that, again, could provide useful material for more indepth forensic analysis and study. I could carrry on identifying material I have researched but that would merely produce, largely, similar and repetitous paragraphs of statements listing what I found available. However, risks to user touch-screen mobile phones may occur when considering entering unlock DOTS patterns, passwords and PINs and unauthorised access attacker or hackers gaze could potentially include the less troublesome methods to gain access using:
i) clandestine apps/progs (WORMs etc from download or P2P) that could record user entries on the touch-screens and storing the output [having fowarded to a memory cards etc] in a hidden file (so be aware of apps/progs on the handset - check eg file manager/root and change memory cards on a regular basis)
ii) using fingerprint tape on the touch-screen (so clean the screen regularly)
iii) shoulder-surfing the user's locking DOTS pattern (so the longer the pattern the harder it can be for the shoulder-surfer to memorise)
Wednesday, August 17, 2011
The Emperor's New Clothes
The Emperor's New Clothes
I was reminded recently of this Hans Christian Andersen tale that brought back memories of hearing it as a child. The hero in the tale is the child for speaking out because those who could have said something found it difficult until it became impossible for them not to say something (but by then it was too late).
The tale could have application to forensics and expert evidence. The focus on distinguishing illusion from reality is an important one and tasks all of us in our field of endeavour to ensure amongst other things:
i) opinion given doesn't simply repeat what others have stated for fear of stepping out of line or the threat of the use psychological intimidation of belittle to one's character
ii) to stand up and challenge, even where an awful lot money has been spent on methods or systems that are systemtically flawed or producing inaccurate statements
iii) not to leave a problem to others to highlight the reality of it ('truth will out') because it feels safe to pretend ignorance or suggesting that it was someone else's problem so not bothering to test the veracity of the method/system in use
I was reminded recently of this Hans Christian Andersen tale that brought back memories of hearing it as a child. The hero in the tale is the child for speaking out because those who could have said something found it difficult until it became impossible for them not to say something (but by then it was too late).
The tale could have application to forensics and expert evidence. The focus on distinguishing illusion from reality is an important one and tasks all of us in our field of endeavour to ensure amongst other things:
i) opinion given doesn't simply repeat what others have stated for fear of stepping out of line or the threat of the use psychological intimidation of belittle to one's character
ii) to stand up and challenge, even where an awful lot money has been spent on methods or systems that are systemtically flawed or producing inaccurate statements
iii) not to leave a problem to others to highlight the reality of it ('truth will out') because it feels safe to pretend ignorance or suggesting that it was someone else's problem so not bothering to test the veracity of the method/system in use
Monday, August 15, 2011
Research: critiques of author recognition
Research: critiques of author recognition
With the high-profile Olympics less than 12-months away, the recent looting and rioting that involved the use of voicemail, instant messenging and web-based media and the approach to using "cybercrime" as the new-labelled tool to describe digital investigation and evidential seizure of alleged culpability, these research papers cover some useful ground that might be helpful in evaluating methodology previously unsuspected as fallible to error or mistake, and may have some useful application when applied in author recognition cases which might be relevant to evidence found on mobile phones and computers.
Authors vs. Speakers: A Tale of Two Subfields
The best part of Monday's post on the Facebook authorship-authentication controversy ("High-stakes forensic linguistics", 7/25/2011) was the contribution in the comments by Ron Butters, Larry Solan, and Carole Chaski. It's interesting to compare the situation they describe — and the frustration that they express about it — with the history of technologies for answering questions about the source of bits of speech rather than bits of text.
Practical Attacks Against Authorship Recognition Techniques
The use of statistical AI techniques in authorship recognition (or stylometry) has contributed to literary and historical breakthroughs. These successes have led to the use of these techniques in criminal investigations and prosecutions. However, few have studied adversarial attacks and their devastating effect on the robustness of existing classification methods. This paper presents a framework for adversarial attacks including obfuscation attacks, where a subject attempts to hide their identity imitation attacks, where a subject attempts to frame another subject by imitating their writing style. The major contribution of this research is that it demonstrates that both attacks work very well. The obfuscation attack reduces the effectiveness of the techniques to the level of random guessing and the imitation attack succeeds with 68-91% probability depending on the stylometric technique used. These results are made more significant by the fact that the experimental subjects were unfamiliar with stylometric techniques, without specialized knowledge in linguistics, and spent little time on the attacks. This paper also provides another significant contribution to the field in using human subjects to empirically validate the claim of high accuracy for current techniques (without attacks) by reproducing results for three representative stylometric methods.
With the high-profile Olympics less than 12-months away, the recent looting and rioting that involved the use of voicemail, instant messenging and web-based media and the approach to using "cybercrime" as the new-labelled tool to describe digital investigation and evidential seizure of alleged culpability, these research papers cover some useful ground that might be helpful in evaluating methodology previously unsuspected as fallible to error or mistake, and may have some useful application when applied in author recognition cases which might be relevant to evidence found on mobile phones and computers.
Authors vs. Speakers: A Tale of Two Subfields
The best part of Monday's post on the Facebook authorship-authentication controversy ("High-stakes forensic linguistics", 7/25/2011) was the contribution in the comments by Ron Butters, Larry Solan, and Carole Chaski. It's interesting to compare the situation they describe — and the frustration that they express about it — with the history of technologies for answering questions about the source of bits of speech rather than bits of text.
Practical Attacks Against Authorship Recognition Techniques
The use of statistical AI techniques in authorship recognition (or stylometry) has contributed to literary and historical breakthroughs. These successes have led to the use of these techniques in criminal investigations and prosecutions. However, few have studied adversarial attacks and their devastating effect on the robustness of existing classification methods. This paper presents a framework for adversarial attacks including obfuscation attacks, where a subject attempts to hide their identity imitation attacks, where a subject attempts to frame another subject by imitating their writing style. The major contribution of this research is that it demonstrates that both attacks work very well. The obfuscation attack reduces the effectiveness of the techniques to the level of random guessing and the imitation attack succeeds with 68-91% probability depending on the stylometric technique used. These results are made more significant by the fact that the experimental subjects were unfamiliar with stylometric techniques, without specialized knowledge in linguistics, and spent little time on the attacks. This paper also provides another significant contribution to the field in using human subjects to empirically validate the claim of high accuracy for current techniques (without attacks) by reproducing results for three representative stylometric methods.
Thursday, July 28, 2011
M2M Crime
M2M Crime
In the last discussion (mobile-markets) a reference was made to M2M (machine-to-machine) market stats. Yesterday's article from 'pcworld' about hackers using mobile communications for war texting to unlock car doors (war_texting) should provide useful material to study about M2M for MTEB Students to identify 'potential' crime activity and where evidence maybe generated. Send your finalised report (pdf), for marking, by email please.
In the last discussion (mobile-markets) a reference was made to M2M (machine-to-machine) market stats. Yesterday's article from 'pcworld' about hackers using mobile communications for war texting to unlock car doors (war_texting) should provide useful material to study about M2M for MTEB Students to identify 'potential' crime activity and where evidence maybe generated. Send your finalised report (pdf), for marking, by email please.
Saturday, July 23, 2011
Mobile Markets: Nokia 'Mobile Man'...it tells of a story
Mobile Markets: Nokia 'Mobile Man'...it tells of a story
This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.
It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.
The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up? I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).
It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.
If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.
My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.
In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together. This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted. Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.
For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.
This excellent construction, made up entirely of mobile phones, is Nokia's collaborative project with Beijing postal service to encourage recycling of mobile phones that can be handed in at post offices, according to the news article at news.cnet.com.
It's great to see projects like, which tend to draw promotions using creative and talented ideas demonstrating the evolving and transforming world of mobile phones and its market places. Back in 2007 I posted on another creative work cellphone-transformer, which, yet again, shows a design that captures the imagination displaying the versatile uses to which a mobile phone might be put.
The business and ecomonic philosophy that resides behind these creative images equally tells of a story of growth and success. If recycling is happening then, perhaps, that is as a likely consequence of mobile ubiquity taking hold. That is a nice statement, but can I back it up? I don't have my finger on every financial and market research pulse, but, apart from anecdotal references, there are various stats out there from the market research firms. Indeed, back in 2008 I blogged (staggering-figures-for-mobile-phone) on the state of the mobile data market when the economic downturn (which appears to have started in 2007 so we are led to believe) had got a firmer grip on global markets. In 2010 the stats still showed extraordinary figures (text.it), although the exact detail where all this activity occurs to generate such figures may not be obvious. It may be compelling to want to know how many consumers send text and mms messages (see OFCOM website for stats), but that is not the full picture. There are the other data markets in business to consider, such as the M2M market place (winwin) and comments by industry pundits on the mobile payments market (cellular-news).
It is useful to see how industry people collate information and bring amassed facts together in order to express their views and vision on what all the facts mean to them in aggregrate. An example of this can be seen in Tomi Ahonen's enthusiastic commentary found in Insiders Guide To Mobile (lulu) with references to trillion dollar market, over 4 billion users and the segmented factors when drawn together identified to him what is forecast for mobile. A view of one segment of the mobile phone market, apps, is simply a further illustration of information to be sourced to underpin market trends (windows-phone-apps-reach-new-market), another is sales and market penetration, such as Apple's iPhone outrageously outstanding sales growth.
If I removed from the context of the above commentary discussion about modern technology, and simply focussed on what an image might communicate, I could have been talking about social, cultural and economic life that might have been depicted by way of an 18th/19th century painting (irrespective of whether the painting is by an impressionist or not). Whilst the image above may not be an old master piece, the image still has a story to explicitly convey and that, in forensic terms, requires understanding all or part of any implicit subtext the image can also communicate.
My forensic skills, acquired over the years, meant that my reaction to seeing this image (even though photo/art imagery is not my subject), was to look at it as evidence and then set out to see what I could deduce from there. In reality we do this everyday in our work. We see a SIM card. We then want to know what it is and what is inside. In order to know what we are dealing with we need to know how it works and what can be held inside and whether all or part thereof can be revealed. Moreover, we need to know what amounts to 'conformance' and within that framework which conforming element is 'mandatory' and which is 'optional'. Once we have that background we can then begin to understand what is 'non-conforming' and/or 'unusual'. This path can equally be taken when dealing with mobile phones and RF investigations.
In conclusion, the subtext of this discussion can be revealed. However mobile phones maybe presented to the world, it is our job in forensics not to change that messsage, but to break down the presentation into its various building block elements in order that we know how each piece works and then how the pieces fit together and work and cooperate together. This is because a true forensic standard requires of the individual to obtain knowledge by way of commentary, appropriate training, standards, specs and investigation, that includes examination and testing (trial and error), which is one side of the coin. The other side of this coin is knowing what the 'thing' in its final state is intended to do, which requiries understanding of the market place it which the 'thing' is to be adopted. Using skills and techniques like these provide for a rich source of experience, too. Essentially, learning to bring all the pieces that are needed into play and being able to demonstrate that identifies the forensic examiner working with a well hone, self-principled approach of high standard.
For MTEB students, the summer recess is now here. Sure, have a great time and relax and enjoy the break, but don't waste valuable time. Great people strive in life because they want to go beyond what has already been achieved. Take time out from relaxing to bring together the exposure you have had to mobile knowledge and experience you have acquired, thus far. Select a particular line of investigative enquiry and see how far you get with it. I have identified some links above to illustrate a way forward or choose a different subject matter; remember to be able to demonstrate the primary basics of 'bush' methodology.
Tuesday, July 19, 2011
iPhones: Common Password Usage Risks
iPhones: Common Password Usage Risks
In the current climate of news about the use of PINs/Passwords to gain unauthorised access to mobile content and voicemail accounts, an interesting study published by an app developer identifying common iPhone passwords. The article identifies the ten most common pin/passwords determined from the study:
"Formulaic passwords are never a good idea, yet 15% of all passcode sets were represented by only 10 different passcodes (out of a possible 10,000). The implication? A thief (or just a prankster) could safely try 10 different passcodes on your iPhone without initiating the data wipe. With a 15% success rate, about 1 in 7 iPhones would easily unlock--even more if the intruder knows the users’ years of birth, relationship status, etc." most common iphone passcodes
Whilst password predicability may not be ground breaking news, this study just might be a useful insight that highlights that iphone mobile phone users appear to make predictable choices when selecting a pin/password and may persuade users to look more carefully at their choice of handset pin/password in current use.
Sunday, July 03, 2011
HTML5: holds a future for and after other mobile apps
HTML5: holds a future for and after other mobile apps
I have just written about mobile apps and forensics (windows-phone-apps-reach-new-market) because it is here and now and requires attention. An aspect of Forensics though is equally not being blinked to future trends. The question of future trends was asked by the House of Commons Science and Technology Committee in their recent report cmselect 855. It is really worth the time and effort to download and read this report.
HTML5 is a future trend and one that has already started to take hold. As nebusiness's The Journal pointed out (http://www.nebusiness.co.utechnology-leap-set-to-make-apps-redundant) "HTML5 builds on the technology of the existing internet but, as every web user knows, if you lose your connection, you lose your work. With HTML5 you don’t – you can go from connected to disconnected and never notice: files can be saved locally and remotely when needed, just like normal apps. Quietly, we’re starting to see more HTML5 apps, like that of the FT, which work on all devices. The FT app is amazing. Try it out. It’s all in HTML5 and as good as, if not better, than a native iPhone app."
With HTML5 there is a sense that forensics might see improvement in interpreting data that could be properly rendered for viewing; currently this can require other apps to assist that process. Moreover, vast quantities of unintelligible random code and data which could not be rendered by handsets can be found during physical dumps that no one really makes sense to identify what it is. Were unravelling and decoding of random code/data to be explained in itself it still might not explicitly or implicity confirm whether the handset user could see/access rendered versions of that code and data on the handset screen or select content by using the handset UI. HTML5 may yet assist in solving some of these issues, so is it a future trend forensic practitioners should be aware?
Well, I think it is something that cannot be excluded largely due to the fact it is at present being used, mobile browsers are making use of it and widely used mobile handsets support or portions of it in e.g. Apple's iOS 4.2, Android, Samsung, Nokia and so on.
So what can HTML5 do for mobile web browsing?
Well, it helps standardise those issues which had previously been problematical to mobile web browsing and, for mobile web developers, to get testable, cross-platform and standards-based interface for developing content that, prior to HTML5, required _fit_the_need_of_the_technology_ methods or proprietory APIs to achieve the level of rendering needed for rich content and browsing.
HTML5 and Forensics
It opens up the door for new or improved evidence. Do remember, particularly for those readers not involved with forensics, evidence doesn't necessarily mean recovered data that is detrimental or that some massive spying operation is in progress. Mobile HTML5 could have benefits to assist retain data that could help resolve a dispute, track a missing person and so on. Location awareness, localised data caching when mobile connectivity is lost and a range of other features that I shall be discussing later on.
What is possible to say at this stage, omitted data previously breaking the chain of causation needed for forensic evaluation may well be greatly assisted by HMTL5 but without a forensic examiner having to put, metaphorically speaking, all his/her sought artefact-eggs into one evidential-methodology basket. Nice !
I have just written about mobile apps and forensics (windows-phone-apps-reach-new-market) because it is here and now and requires attention. An aspect of Forensics though is equally not being blinked to future trends. The question of future trends was asked by the House of Commons Science and Technology Committee in their recent report cmselect 855. It is really worth the time and effort to download and read this report.
HTML5 is a future trend and one that has already started to take hold. As nebusiness's The Journal pointed out (http://www.nebusiness.co.utechnology-leap-set-to-make-apps-redundant) "HTML5 builds on the technology of the existing internet but, as every web user knows, if you lose your connection, you lose your work. With HTML5 you don’t – you can go from connected to disconnected and never notice: files can be saved locally and remotely when needed, just like normal apps. Quietly, we’re starting to see more HTML5 apps, like that of the FT, which work on all devices. The FT app is amazing. Try it out. It’s all in HTML5 and as good as, if not better, than a native iPhone app."
With HTML5 there is a sense that forensics might see improvement in interpreting data that could be properly rendered for viewing; currently this can require other apps to assist that process. Moreover, vast quantities of unintelligible random code and data which could not be rendered by handsets can be found during physical dumps that no one really makes sense to identify what it is. Were unravelling and decoding of random code/data to be explained in itself it still might not explicitly or implicity confirm whether the handset user could see/access rendered versions of that code and data on the handset screen or select content by using the handset UI. HTML5 may yet assist in solving some of these issues, so is it a future trend forensic practitioners should be aware?
Well, I think it is something that cannot be excluded largely due to the fact it is at present being used, mobile browsers are making use of it and widely used mobile handsets support or portions of it in e.g. Apple's iOS 4.2, Android, Samsung, Nokia and so on.
So what can HTML5 do for mobile web browsing?
Well, it helps standardise those issues which had previously been problematical to mobile web browsing and, for mobile web developers, to get testable, cross-platform and standards-based interface for developing content that, prior to HTML5, required _fit_the_need_of_the_technology_ methods or proprietory APIs to achieve the level of rendering needed for rich content and browsing.
HTML5 and Forensics
It opens up the door for new or improved evidence. Do remember, particularly for those readers not involved with forensics, evidence doesn't necessarily mean recovered data that is detrimental or that some massive spying operation is in progress. Mobile HTML5 could have benefits to assist retain data that could help resolve a dispute, track a missing person and so on. Location awareness, localised data caching when mobile connectivity is lost and a range of other features that I shall be discussing later on.
What is possible to say at this stage, omitted data previously breaking the chain of causation needed for forensic evaluation may well be greatly assisted by HMTL5 but without a forensic examiner having to put, metaphorically speaking, all his/her sought artefact-eggs into one evidential-methodology basket. Nice !
Saturday, July 02, 2011
Windows Phone Apps reach new market levels
Windows Phone Apps reach new market levels
Back in 2006 Vodafone announced news to standardise handsets (here) and I commented then that it might be a good idea if users could profile their own handsets with the apps they actually use. There is much market evidence to suggest the evolving mobile is moving in that direction. Android, Apple, Blackberry, Java and Symbian apps stores are a good example of this. The growth in mobile apps has not been limited to the five previously mentioned, Window Phone apps, too, are storming ahead with over 25,235 apps available.
There is a brief synopsis of the Windows Phone apps growth at winrumors. The chart below is courtesy of windowsphoneapplist.
Knowing these stats can be helpful but unless there is some inter-related commentary about the technology (so to speak) that links those stats to forensics, it can all become pretty meaningless. My take on those stats is they do present challenges that the mobile forensic community will need to adapt, sooner rather than later. There is a wealth of information in apps that cannot be gleaned from using many of the evidence recovery automated handset readers. This has happened because evidence tools may not have been designed for that purpose; recovering app info and the content they store.
Firstly, it is important to understand the distinction between apps accessible through interface/emulator tools, designed for app builders and programmers (so to speak), and those tools said to be designed for collecting evidence.
Secondly, it doesn't automatically follow that just because an examiner obtains an evidential physical dump from flash memory ( a ) the examiner has dumped everything from the correct component ( b ) that the dump's content will be 'visible' and 'legible' (PACE 1984) and 'intelligible' (DPA1984).
Holding such a view doesn't mean, nor is it intented to suggest, that I think there is an impossibility here that cannot be overcome. Do I think the mobile forensic communty, working together, will find the solutions? Yes, absolutely, naturally.
Back in 2006 Vodafone announced news to standardise handsets (here) and I commented then that it might be a good idea if users could profile their own handsets with the apps they actually use. There is much market evidence to suggest the evolving mobile is moving in that direction. Android, Apple, Blackberry, Java and Symbian apps stores are a good example of this. The growth in mobile apps has not been limited to the five previously mentioned, Window Phone apps, too, are storming ahead with over 25,235 apps available.
There is a brief synopsis of the Windows Phone apps growth at winrumors. The chart below is courtesy of windowsphoneapplist.
Knowing these stats can be helpful but unless there is some inter-related commentary about the technology (so to speak) that links those stats to forensics, it can all become pretty meaningless. My take on those stats is they do present challenges that the mobile forensic community will need to adapt, sooner rather than later. There is a wealth of information in apps that cannot be gleaned from using many of the evidence recovery automated handset readers. This has happened because evidence tools may not have been designed for that purpose; recovering app info and the content they store.
Firstly, it is important to understand the distinction between apps accessible through interface/emulator tools, designed for app builders and programmers (so to speak), and those tools said to be designed for collecting evidence.
Secondly, it doesn't automatically follow that just because an examiner obtains an evidential physical dump from flash memory ( a ) the examiner has dumped everything from the correct component ( b ) that the dump's content will be 'visible' and 'legible' (PACE 1984) and 'intelligible' (DPA1984).
Holding such a view doesn't mean, nor is it intented to suggest, that I think there is an impossibility here that cannot be overcome. Do I think the mobile forensic communty, working together, will find the solutions? Yes, absolutely, naturally.
Monday, June 27, 2011
iCloud MobileMe Quota Storage
iCloud MobileMe Quota Storage
As with most things in the digital world and examining evidence, it is essential for an examiner to understand the way in which a product or service works and the options that brings, as opposed to only considering the stored data that is discovered upon initial examination.
There has been alot of discussions in the forensic community about iCloud and its impact on off-device storage access and examination. Interesting to note then that MobileMe storage quotas are in place, as recently observed:
http://www.macrumors.com/2011/06/20/if-you-use-all-your-icloud-storage-apple-sends-you-this-email/
If the user only wants to keep to the 5GB limit and doesn't delete data and the devcie storage is equally full, is newer data automatically deleted or stored elsewhere? I only raise the point because with increased data flowing in and out of mobile phones, this could impact on data connected to one issue being spread across several storage locations.
As with most things in the digital world and examining evidence, it is essential for an examiner to understand the way in which a product or service works and the options that brings, as opposed to only considering the stored data that is discovered upon initial examination.
There has been alot of discussions in the forensic community about iCloud and its impact on off-device storage access and examination. Interesting to note then that MobileMe storage quotas are in place, as recently observed:
http://www.macrumors.com/2011/06/20/if-you-use-all-your-icloud-storage-apple-sends-you-this-email/
If the user only wants to keep to the 5GB limit and doesn't delete data and the devcie storage is equally full, is newer data automatically deleted or stored elsewhere? I only raise the point because with increased data flowing in and out of mobile phones, this could impact on data connected to one issue being spread across several storage locations.
Monday, June 06, 2011
D-Day 6th June
D-Day 6th June
I mentioned today's important date to a number of people. Quite a few had forgotten the date and mainly the younger generation didn't know about events that took place on this date back in 1944.
For anyone who may have missed it or might want to know more, here are some links providing the historical background.
NORMANDY LANDINGS
British Legion Remembrance d-day-65
Wikipedia Normandy Landings
Britannica DDay
Remembrance D-Day.html
Lifeformation D-Day
SCHOOL CHILDREN (CBBC)
BBC/CBBC D-Day
I mentioned today's important date to a number of people. Quite a few had forgotten the date and mainly the younger generation didn't know about events that took place on this date back in 1944.
For anyone who may have missed it or might want to know more, here are some links providing the historical background.
NORMANDY LANDINGS
British Legion Remembrance d-day-65
Wikipedia Normandy Landings
Britannica DDay
Remembrance D-Day.html
Lifeformation D-Day
SCHOOL CHILDREN (CBBC)
BBC/CBBC D-Day
Friday, June 03, 2011
Update on Forensic Webblog Posts
Update on Forensic Webblog Posts
-------------------------------------
Radio Survey Field Notes
CSA Training Explanatory Diagram
iOS 4.3.3 deletion of Location Cache
Requesting Cell Site Data
---------------------------------
Handset Examination in 1995
sn0wbreeze unthethering Windows iPhones
Symbian OS v9.4, Series 60 rel. 5
----------------------------
Answer To Reset (ATR)
Blackberry Forensic Analysis
--------------------------------
Vodafone CDR data
Mobile Evidence CDR/Billing Course
Call Detail Record (CDR) GSM Mobile Telephone Call
ABOUT THE BLOGS
I have endeavoured to be free with sharing knowledge and information over many years through my blogs, but given the changing economy, UK and global events and advancements in forensics, the nature of the technical content, new developments and examination techniques and legal information will only be accessible to approved law enforcement personnel, security specialists and authorised individuals. The following blogs are now approved access only:
Cell Site Analysis
http://cellsiteanalysis.blogspot.com
Forensic examination and evidence from SIM an USIM
http://sim2usim.blogspot.com
Forensic examination and evidence from Mobile and Smart Phones
http://forensicmobex.blogspot.com
Forensic analysis of Billing and CDR Records
http://cdranalysis.blogspot.com/
Mobile Telephone Evidence (http://trewmte.blogspot.com) will of course remain an open.
The criteria for authorised access to blogs:
a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals
Cell Site Analysis
http://cellsiteanalysis.blogspot.com/-------------------------------------
Radio Survey Field Notes
CSA Training Explanatory Diagram
iOS 4.3.3 deletion of Location Cache
Requesting Cell Site Data
Forensic Mobile Examination
http://forensicmobex.blogspot.com---------------------------------
Handset Examination in 1995
sn0wbreeze unthethering Windows iPhones
Symbian OS v9.4, Series 60 rel. 5
Examination and Evidence from SIM and USIM Cards
http://sim2usim.blogspot.com----------------------------
Answer To Reset (ATR)
Blackberry Forensic Analysis
Billing & Call Detail Record Analysis
http://cdranalysis.blogspot.com/--------------------------------
Vodafone CDR data
Mobile Evidence CDR/Billing Course
Call Detail Record (CDR) GSM Mobile Telephone Call
ABOUT THE BLOGS
Mobile Telephone Blogs Approved Access Only
I have endeavoured to be free with sharing knowledge and information over many years through my blogs, but given the changing economy, UK and global events and advancements in forensics, the nature of the technical content, new developments and examination techniques and legal information will only be accessible to approved law enforcement personnel, security specialists and authorised individuals. The following blogs are now approved access only:
Cell Site Analysis
http://cellsiteanalysis.blogspot.com
Forensic examination and evidence from SIM an USIM
http://sim2usim.blogspot.com
Forensic examination and evidence from Mobile and Smart Phones
http://forensicmobex.blogspot.com
Forensic analysis of Billing and CDR Records
http://cdranalysis.blogspot.com/
Mobile Telephone Evidence (http://trewmte.blogspot.com) will of course remain an open.
The criteria for authorised access to blogs:
a) Law Enforcement
b) Security Services (MI5, MI6, CID, SB, FBI....)
b1) Security Specialists - a proveable record in security for
networks, digital forensics, handsets, SIM, CDR etc
c) Authorised individuals
Subscribe to:
Posts (Atom)