TrewMTE Mobile & Technology Exploration

Saturday, September 28, 2013

MTEB Diploma CSUT2 Partner

Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2

Partner Support
The Mobile Telephone Examination Board (MTEB) are pleased announce that Quantaq Solutions (http://www.quantaq.com/about.htm) have agreed to be the MTEB Diploma CSUT2 Partner. Quantaq Solutions role is as a "Partner Support". This role entails

- providing trial copies of software
- respond to technical enquiries that a student may require to make

to assist with the student's Diploma.

Moreover, Quantaq Solutions will host an MTEB webpage solely for use by MTEB Diploma Students so that students can have acess to the software and post questions to seek technical assistance.

MTEB selected to work with Quantaq Solutions as a "Partner Support" because of their existing experience with (U)SIM/smart card examination tools, their range of independent, stand-alone tools to analyse (action commands/receive responses) on SIM/Smartcard and their highly regarded technical knowledge and experience in the fields of:

SIM, smartcards, NFC, RFID, M2M, location, DRM, security, cryptography, Mobile Wallet, technology, innovation, patents, technical design authority, standardisation, proof-of-concepts and software development

Gary Waite

Leading the "Partner Support" on behalf of Quantaq Solutions is Gary Waite. Gary is very well known in the mobile forensics arena for his work on the tools the (U)SIM forensic tools USIM Detective (USIM-D) and USIM Detective Professional (USIM-DP).

His experience and technical background further underpin his credentials of his expertise:
- Founder of Quantaq Solutions
- Past Vice Chair of the Smart Card Group GSM Association
- Test software supplier to Global Certification Forum (GCF) Field Trial Guidelines
- Authored the original ETSI GSM 11.17 standard. This standard formalised the core test processes and procedures for SIM Cards and remains at the heart of (U)SIM testing, programming and examination today.
- First to introduce recording in CUST File (EF) a particular handset's IMEI on SIM Card, which is important, evidentially
- Employed as Technology Manager for the last 11 years with a well know international Mobile Network Operator
- Skilled in C/C++/Java
- Holds a Degree from the University of Abertay Dundee - Electrical & Electronic Engineering, Electronic Engineering

Diploma:CSUT2
Free trial access to the following tools will be made available to Diploma Students.

USIMdetective - http://www.quantaq.com/usimdetective.htm
USIMexplorer - http://www.quantaq.com/usimexplorer.htm
USIMexplorer - http://www.quantaq.com/usimcommander.htm
USIMprofiler - http://www.quantaq.com/usimprofiler.htm

Diploma for SIM and USIM Technology Examination
Mobile Telephone Diploma Core
Diploma:CSUT2

The latest MTEB Diploma Modules Guide is MTEdipl 2.2 can be downloaded here:
https://dl.dropboxusercontent.com/u/84491783/MTEdipl%202.2.pdf

MTEB Diploma CSUT2 Partner

Saturday, September 14, 2013

Blocked SIM

A regular question that arises, "is it possible to bypass a PIN blocked SIM card?"

For a quick solution it is best to go to the operator to obtain a PUK code where there has been 3 CHV1 attempts and access is now blocked.

If it is 10 CHV1 attempts and blocked ([unless you know and have the test tools to e.g. slow the card]) then the operator may request that you send it to them and they in turn (depending upon their security level) may need to send it to the (U)ICC producer / manufacturer.

Today's UICC (using improved silicon and security techniques) have significant security improvements within each operator's card where there are various levels of electronic counter-measures (traps doors/dead-man's trap etc). Many of us (including me) simply cannot access certain areas of the UICC unless a flaw in the security is discovered. Unless you are confident of what you know and what you are doing, my observation is take the safest route.

None of the opinions I express originate based upon my gut feeling about a particular matter. I research, like others, to establish the industry security protocols, practices and procedures and then consider the position from there. It is important to bare in mind that forensics and evidence is not about hacking everything in sight or writing a program to extract data but to be aware and comprehend how industry standard bodies intended security should be implement, which norms the manufacturer and operator follow and whether following implementation security flaws occur.

sim2usim

Examination and Evidence from SIM and USIM Cards. Now an open blog.

http://sim2usim.blogspot.co.uk/

(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later). This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber.

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference.

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
- A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.

Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process.

Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp? Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.

SIM Card Swap Fraud

This example is an extension of how man-in-the-middle-attack can work by using impersonation. By cloning Bure's SIM card the fraudsters were able to hack into the account, create a new beneficiary, which can be done only when the bank sends a client the one-time password via SMS, and transfer the money into several accounts. In this case the syndicate, armed with a fraudulent ID book in Bure's name, persuaded MTN to swap the Sim Card in Bure's absence. The Ubuntu project looks after orphaned and vulnerable children.
mtn-moves-to-prevent

PIN Enabled SIM Card

PIN Enabled SIM Card

A recent question raised the notion what data would be revealed if the SIM Card was read but had a PIN enabled. Using a free SIM Card reader the results are below. Do remember, using different readers their output can reveal different results dependent upon how the programmer wrote the software. The results are from an old Phase 2 GSM SIM Card.

Additional tests with the PIN Locked SIM Card conducted with different SIM Readers

Considering Clone Test SIM Card Tools

Considering Clone Test SIM Card Tools

There have been a few mentions about clone test Sim Cards at this blog raising observations as to possible issues that may be useful to know.

Yet further observations examiners may find useful to consider are whether it is necessary for a cloned test SIM Card tool to produce identical files, structure and format for every clone test card produced or whether the make/model of handset can influence e.g. the number of files etc necessary to gain access to a handset's memory? Cust_Files pre-generated on a cloned test card should be included or excluded from consideration regarding the number of GSM/3GPP EFs identified on a cloned test card? The importance, if any, of the evolution in a clone test card's development?

Below are two screen dumps, following examination using just one (U)SIM Card Reader, from two different clone test SIM Cards supplied by different manufacturer with their tools that provide a useful visual indicator when placed in context with the above observations. The observations above and the images below are not published to suggest a problem with a particular clone test SIM Card or tool. The observations are for the purpose should two different examiners use two different clone test SIM Cards and tools to generate evidence which one would be more pertinent for use when accessing memory on a particular handset etc?

New SIM Card Exploit

On the 19th July 2013 I posted http://trewmte.blogspot.co.uk/2013/07/android-ddms-vulnerability.html about knowing exploits on and understanding originality and genuineness of a handset and (U)SIM Card.

Karsten Nohl on the 22nd July released details of an exploit for older type (no specifics as yet) SIM Cards using DES security. The exploit revealed a returned 'error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.' http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking

Importantly, the article goes on to identify possible exploits that may be caused when in possession of a decrypted key.

What isn't clear is whether the exploit leads to the creation of a cloned SIM Card that is operating live in the same network at the same time and whether the network detection techniques fail to pick that up? That means not just detect (VLR/HLR) but take decisive action such as call tear down, blocking and suspending IMSI subscriber etc.

Articles:
http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking

http://nakedsecurity.sophos.com/2013/07/22/rooting-sim-cards-blackhat-speaker-says-he-may-be-able-to-own-your-phone-with-a-text-message/

http://thehackernews.com/2013/07/sim-card-cloning-hack-affect-750.html

For some background research materials specific to GSM SIM regarding Java servers and updating SIM OTA:
GSM 11.11
GSM 11.13 (Java Applets)
GSM 11.14 STK

Friday, August 30, 2013

Lawful Interception - Cloud/Virtual Services

Lawful Interception - Cloud/Virtual Services

As more and more people move to mobile/wireless devices to access virtual services so mobile forensics is having to expand its boundaries too in order to cope with cloud/virtual servcies. Many people misunderstand mobile forensics and see its role limited to arguments on good practice and methodology (extract and harvest data from mobile/smart phones). This narrow view is completely wrong but has arisen as mobile forensics is being labelled in some quarters as a sub-category of e.g. computer forensics in criminal proceeding. However, mobile forensics encompasses a wide area and on principals of science fact that computer forensics can operate:

- criminal investigation
- civil investigation
- contract and commerical ventures
- consultancy
- education
- public services/national security

In civil cases there is the investigation process, for example, of requiring examination of the mobile/smart phone as the conduit between confidential information being jettisoned to a secret file in the Cloud, because there is no trail of bread crumb data evidence on the PC/laptop. Radio signals are not part of computer forensics, unless we all ursurp the laws of physics and rename, for instance, radio signals as computer signals just to be able to lock mobile forensics to computer forensics; it would be just absurd. The investigatory elements requires knowing whether the device is capable of working with HSPA etc as opposed to suggesting full blown data streaming occurs on basic GSM transmission technology. In other words the investigator must be realistic in his/her approach. That equally means understand cell site analysis so that the investigator knowns to understand the advantages of, for instance, MIMO in the wireless arena and the base station set up for that purpose.

Mobile Cloud usage is on the increase and therefore public servcies/national security will equally require to understand any loopholes that exist. Mobile forensics provided for consultancy or in education again requires obtaining facts and understanding processes and procedures as indeed does contract and commercial ventures that require accuracy in description and terms for technology usage.

It is upon that basis this blog discussion introduces Lawful Interception - Cloud/Virtual Services so that whilst law enforcement and national security would seem the obvious target audience, it doesn't take that much effort to realise how all the other categories in which mobile forensics operates equally benefit from knowing the subject matter.

I am not able to provide masses of info or say too much on this issue but I thought trewmte blog readers might be interested in several informative documents about the subject matter. You may even appreciate the irony of making the downloads for these documents via Dropbox.

----------------

As a primer this is a very helpful document:

ETSI TR 102 997 V1.1.1 (2010-04)
Initial analysis of standardization requirements for Cloud services

The present document describes standardisation requirements for cloud services. It is based on the outcome of the ETSI TC GRID Workshop, "Grids, Clouds and Service Infrastructures", 2 and 3 December 2009. This event brought together key stakeholders of the grid, cloud and telecommunication domains to review state of the art and current trends. Needs for standardisation, with a particular focus on the emerging area of cloud computing and services, were discussed. The present document introduces and expands on the conclusions reached. This is not an exhaustive survey and is intended to serve as the basis for future work.

https://www.dropbox.com/s/nt095ho1jkbxjt9/tr_102997v010101p.pdf

---------------------------------

A useful guide to the mechanisms needed to enable eWarrants to function in the global marketplace.

ETSI TR 103 690 V1.1.1 (2012-02) Lawful Interception (LI); eWarrant Interface

The present document presents a high-level description of an interface mechanism - the eWarrant Interface - for receipt of requests for measures producing real-time or stored information by an issuing authority possessing lawful authorization to initiate such a request. The eWarrant Interface is a generic, extensible interface intended to be fully compatible with all existing kinds of requests for these purposes - as well as support future ones, including local
requirements and languages or character sets. The eWarrant Interface is not intended to replace existing implementation-specific mechanisms found, for example, in the Retained Data Handover Interface.

The present document describes an electronic interface. Annex B describes work flow for an eWarrant in different jurisdictions and a means for discovering related information. Annex C describes how this interface may be adapted and made interoperable for manual and legacy techniques. The present document provides a high-level description of the interface mechanism. It defines basic principles of interoperability, and provides recommendations for the types of data that are delivered. It provides a recommendation on the choice of data modelling languages, but the present document does not give a normative structure for the delivery of eWarrant messages. It is envisaged that a later Technical Specification will add the required details for a full implementation.

https://www.dropbox.com/s/16csgxf3ut33c1w/tr_103690v010101p.pdf

----------------------------------

Here is the draft standard being worked on that will eventually be the agreed standardised approach to interception for Cloud and Virtual Services that occurs trans-border.

Draft ETSI DTR 101 567 V0.1.0 (2012-05) Lawful Interception (LI); Cloud/Virtual Services (CLI)
The present document provides an overview on requests for handover and delivery of real-time information associated with cloud/virtual services. The report identifies Lawful Interception needs and requirements in the converged cloud/virtual service environment, the challenges and obstacles of complying with those requirements, what implementations can be achieved under existing ETSI LI standards, and what new work may be required to achieve needed Lawful Interception capabilities. Cloud Services in whichever forms they take (Infrastructure, Software, Platform or combinations of these) are often trans border in nature and the information required to maintain Lawful Interception (LI) capability or sufficient coverage for LI support may vary in different countries, or within platforms of different security assurance levels. This work aims to ensure capabilities can be maintained while allowing business to utilise the advantages and innovations of Cloud Services and was undertaken cooperatively with relevant cloud security technical bodies.

https://www.dropbox.com/s/0knuausa0h1wupq/tr_101567v010101p.pdf

Thursday, August 29, 2013

Mobile Forensics Diplomas

Following on from the article Forensic Erosion ( http://trewmte.blogspot.co.uk/2013/07/forensic-erosion.html ) the MTEB Diplomas fill the gap between a time limited (expiration) certificate and a Degree course. You may not have seen it but I did produce six MTEB Diploma options and posted it here - http://trewmte.blogspot.co.uk/2010/05/diplomas-mobile-telephone-evidence.html . Moreover, it could help Universities focus their approach to producing Mobile Forensics Degrees with applicants holding a Diploma using it for credits towards the Degree.

The excellent feature of a possessing a Diploma is that it continues to have a value as representation of a person's knowledge, skills and experience similar to a BSc/MSc/PhD. Certificates (e.g. product training certificates) are useful but unless you purchase training year in year out for that same product, which the product can undergo regular changes, waving a five or ten year old certificate may be considered as to its relevance to the evidence or work of a person has been involved.

When a Diploma is undertaken it enables the student to demonstrate current knowledge, skills and experience whilst defining future objectives such as processes and procedures desired to be achieved or occurring in the current marketplace.

A Diploma does not require the student to develop a "new" or "unique" design, process or proposition previously undiscovered (unlike BSc, MSc or PhD trial and error) but demonstration of the student's existing knowledge and how to deploy those skillsets and experience with what works and only express where the subject sees marketplace events or targets to be achieved.

Diplomas are considerably less expensive than BSc, MSc and PhD as they are of a shorter study/submission period, thus present current knowledge, skills and experience to be known sooner and recognised (put to work) in current markets, without limitation of an expiration date associated with a product Certificate at one end of the scale or outdated by the time final semester (BSc/MSc/PhD) is achieved at the other end of the scale.

A Diploma module e.g. * Diploma for ME and UE Technology Examination - Mobile Telephone Diploma Core CMSU3 - enables a candidate to consider mobile/smart phone examination as a specific subject or consider the ME/UE in connection with/to:

* Foundation/Research Skills and/or
* QA and Evidence Handling and/or
* association with SIM and USIM Technology Examination and/or
* Call Records and Network Records Analysis and/or
* Cell Site Analysis

Thus permutation options for submission of a Diploma report may include the expression of ME and UE Technology Examination in isolation or include one or more of the above subjects.

The latest MTEB Diploma Modules Guide is MTEdipl 2.2 ( https://dl.dropboxusercontent.com/u/84491783/MTEdipl%202.2.pdf )

Friday, August 23, 2013

Operational Audit Check (OAC) is part of Cell Site Analaysis (CSA)

There is a news aticle on News96.5.com about a mast (US cell tower) that caught figure during an install/maintenance work (http://www.news965.com/news/news/local/cell-phone-tower-burning-could-fall/nZYBg/). The article provides us with a useful reminder when conducting cell site analysis (CSA) to remember to conduct an operational audit check (OAC) and request confirmation that the target mast and the density of support radio coverage masts in the immediate area were all operational at the material time. This should be requested as soon as practicalable to do so.

Invariably, an event (e.g. a serious crime) requires instant action and requires, if relevant, knowing the cell coverage at the scene of crime (SoC) and the coverage in surrounding areas (e.g. identifying potential get away routes). It could impact the investigation if an OAC is not conducted regarding the density of surrounding masts and it later comes to light a mast was out of commission for a period and other masts in trh surrounding area had their coverage increased.

In some cases, it may not be possible at short notice to draught-in coverage from other masts and a radio black spot may occur. This, too, is in important to anticipate and be considered when analysing call records, road networks and the density of masts (thus coverage) upon the landscape. Moreover, if the out of commission mast is at a central location of a road network or town/city, consider also the base stations delivering small cell/micro cell coverage. Many of these base stations have their antennas tilted. There are two types of tilt commonly available: electrical and mechanical. Electrical tilt enables the network to remotely alter the tilt angle of the antennas. Mechanical tilt requires an engineer to visit site and mechanically alter the antenna tilt. Here again, not considering these points could mean an investigation can include arriving at erroneous conclusions that may be uncovered later on.

My experience of performing OAC for particular cases can vary from the experience of others. I am not able to say why information I have found was available was not accessible to other experts/investigators. It seems to me that an illustration of the information that supports the above comments I made should be demonstrated. I have hidden some cell site/mast details from the data served in a particular case, that of site name, address and NGR, as this relevation is not necessary to specifically identity the cell site/mast details in that particular case. However, it is assumed that site name, address and NGR are standard details that form part of the request of the information sought from a particular operator.

Sunday, August 11, 2013

Windows Phone Online App Builder

It is not easy to encourage people to start programming, largely because it presents itself as a daunting task to learning a new set of rules relevant to a particular vocabulary, syntax, etc in order that an app or utility can work with a particular existing program or operating system. The problem also exists knowing where to get started without being overwhelmed with the cost of buying programming tools, maybe upgrading the computer on which the app will be produced and then have the skillset and techniques to know how to design the app itself.

Getting started can be much easier than might be thought at first instance. Microsoft Windows Phone App Store website ( http://apps.windowsstore.com/default.htm ) has made available online a simple way to create an app online which will allow the user to work with different templates and then te site automates the production of source code that can be updated should improvements to the app design/layout/content become necessary. The app can be loaded to a particular windows phone for trial testing.

Image courtesy of Microsoft Windows App Store

Well done Microsoft, this is a great idea. Whilst other mobile OS app builders have their own solutions, this online solution is unique for Windows Phone. Have a go and see for yourself.

I do forecast that the whole programming environment will under-go a further revolution whereby the tools for programming and emulator testing will all be free in the future to encourage app building and commissioning. Back in 2007 I wrote a prediction regarding handset owners should be allowed to profile their own mobiles "Alternatively, the likes of Nokia, Motorola, SonyEricsson, Samsung etc could create mobile 'phones with the appropriate GSM/GPRS/WCDMA/WiFi wireless operating systems on them and allow the general public to profile their handsets with the application features (download) they not only like, but actually want." http://trewmte.blogspot.co.uk/2006/11/vodafone-move-to-standardise-handset.html

Tuesday, August 06, 2013

RIPA 2000 s1(3)

WEBPAGE/SITE STATEMENT - PROHIBITED
The contents of this site, and communications between this site and its users, are protected by database right, copyright, confidentiality and the right not to be intercepted conferred by section 1(3) of the Regulation of Investigatory Powers Act 2000. The use of those contents and communications by Internet Service Providers or others to profile or classify users of this site for advertising or other purposes is strictly forbidden.

Regulation of Investigatory Powers Act 2000
1. Unlawful interception.
(3)Any interception of a communication which is carried out at any place in the United Kingdom by, or with the express or implied consent of, a person having the right to control the operation or the use of a private telecommunication system shall be actionable at the suit or instance of the sender or recipient, or intended recipient, of the communication if it is without lawful authority and is either—
(a)an interception of that communication in the course of its transmission by means of that private system; or
(b)an interception of that communication in the course of its transmission, by means of a public telecommunication system, to or from apparatus comprised in that private telecommunication system.

Sunday, July 28, 2013

Forensic Erosion

The BBC website identifies a report by MPs that presents findings that many see as the chaotic forensic landscape in Britain today: http://www.bbc.co.uk/news/science-environment-23436303.

But there are other issues needing to be addressed, too.

Marketplace
In some ways the situation reminds me when I responded back in 2005, along with many others I should add, to a public consultation document on legal aid and engagement of consultants and experts in the UK. There is only so much that one can put into a document with the natural expectation that further questions would be asked of the author about its content in order to undestand the minutiae operating behind any opinion or solutions put forward. The solution I put forward was to remodel and reduce or remove regional distortion with respect to the expert fees and the forensics landscape.

Specific Skillset Education (SSE)
As many of you will know I have never pretended to come from an academic background, and despite many attempts by some to insult me due to their own fears that non-academics can know considerably more, I took their hostile approach and made positive of their negative approach by calling for academic qualifications in the area of forensics with which I am concerned - http://trewmte.blogspot.co.uk/2009/01/mobile-forensics-and-evidence-degrees.html. Germane and relevant then why, with the explosive growth and use of mobile communications, after four years there still no standalone academic qualifications in mobile forensics and evidence? There are some academic forensics courses that placed this important area into one-off mini-module to another degree course but it has been and still is plainly obvious that could never meet the standard automatically expected from proper academic skillsets qualifications that were and are needed. The current situation raises the notion that a person need not be academically qualified to intellectualise this subject, but would still require huge knowledge, skillsets and experience to get through. However, concerns about ready-made tools have given rise to what the professional community has called and is calling 'push button forensics' ( http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4906 ) that implants the notion qualifications are not necessary. Alternatively, it is also noted Universities simply may not possess the knowledge, skillsets and experience to impart what is needed to students. What is needed is specific skillset education (SSE) to avoid jack of all trades, master of none.

Possible Solution
Perhaps the House of Commons Science and Technology Committee could look at giving support to people (like me and others) and allow us together with Parliament to create qualifications directly linked to a Prize Degree coming from the House of Commons Science and Technology Committee enabling citizens of this country to re-connect with Parliament. This would create a cushion. In other words, people want more out of Parliament and not just to feel but actually enjoy the experience Parliament serves all areas. Having a Parliamentary Commitee qualification can help do that.

Of course, my observations maybe seen as a novel idea but it would actually fill the gaps being left open by Universities that are unable to deal with a fast changing society and technology revolution and where people with long term knowledge, skill and experience are not working as University lecturers.

Tuesday, July 23, 2013

New SIM Card Exploit

On the 19th July I posted http://trewmte.blogspot.co.uk/2013/07/android-ddms-vulnerability.html about knowing exploits on and understanding originality and genuineness of a handset and (U)SIM Card.

Karsten Nohl on the 22nd July released details of an exploit for older type (no specifics as yet) SIM Cards using DES security. The exploit revealed a returned 'error code that contained the device's cryptographic signature, a 56-bit private key. It was then possible to decrypt the key using common cracking techniques.' http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking

Importantly, the article goes on to identify possible exploits that may be caused when in possession of a decrypted key.

What isn't clear is whether the exploit leads to the creation of a cloned SIM Card that is operating live in the same network at the same time and whether the network detection techniques fail to pick that up? That means not just detect (VLR/HLR) but take decisive action such as call tear down, blocking and suspending IMSI subscriber etc.

Articles:
http://www.theinquirer.net/inquirer/news/2283935/sim-card-encryption-exploit-leaves-mobile-phone-users-vulnerable-to-hacking

http://nakedsecurity.sophos.com/2013/07/22/rooting-sim-cards-blackhat-speaker-says-he-may-be-able-to-own-your-phone-with-a-text-message/

http://thehackernews.com/2013/07/sim-card-cloning-hack-affect-750.html

For some background research materials specific to GSM SIM regarding Java servers and updating SIM OTA:
GSM 11.11
GSM 11.13 (Java Applets)
GSM 11.14 STK

Friday, July 19, 2013

Android DDMS Vulnerability

Android DDMS Vulnerability

A suggested in-memory patch solution to the DDMS vulnerability is reported in this article:

https://securityledger.com/2013/07/security-start-up-university-team-on-android-patch-app/

The article states "The flaw is located in an Android component known as the Dalvik Debug Monitor Service (or DDMS), the virtual machine that runs software on Android devices. The vulnerability affects almost all Android devices in use, could allow a malicious actor to modify a legitimate, signed Android application without affecting the application’s cryptographic signature. That would prevent Android from noticing the changes when the application is installed."

So to prevent any new threat occuring ReKey can help you do this. However, what is the solution where threat already existed on the Android phone prior to the in-memory patch being installed? Are there any known affects (exploits that add or alter data or cause call events etc)? Could those 'affects' impact on the weight given to evidence extracted and harvested from a particular smart phone?

How relevant is the above to device examination? Computer forensic examiners spend hours and days sifting through data and studing how a program installs, executes and stores activity generated by use of a program. Smart phones are now highly complex radio communication and electronic devices running a multitude of internal operating programs, user access programs fashioned to the device, interfaces to connect to other devcies and, all importantly, programs to communicate using radio transmission/receiver technologies GSM, W/CDMA, LTE, Wi-Fi, Bluetooth/IRDA, RFID/NFC.

In the early days of mobile phone examination the SIM Card was the focus of attention as little occurred by way of the handset itself. Evolved feature handsets have transformed mobile phones to smart phones and processes of acquiring data have largely become mechanical with plug-in tools pumping out data in production line fashion. Invariably examiners cannot rely simply one one tool but require a toolbag of tools. These tools in themselves are still not enough as the art and skill of interpretation as to the cause and effect and meaning of data are not present in the tools. Sure, tools may show e.g. a (static/active) graph of internet activity of a smart phone once data has been harvested from it but does the tool confirm whether the smart phone automated that process or whether it involved human intervention to cause the intenet activity?

Evolved, too, has the (U)SIM. Which means understanding of what is actually stored on it and applications that run from it, the (U)SIM, cannot be ignored when it comes to automated processes and human intervention.

Image - SIM Toolkits (STKs): Proactive SIM enables and allows a SIM to issue commands and action responses and thus may be susceptable to generating events in a manner and form that needs to be understood (see: GSM11.14).

The DDMS vulnerability reminds us that over-reliance on a tool simply to extract and harvest data and then present the data in a eye-pleasing format is not enough. Understanding the program/s and apps on a smart phone and in a USIM, its genuineness and originality, how data and records are caused to be generated and the interpretation of the records and data is now where we are at. Production line (bang it on, bang it out) recordings of only call activity, phonebooks, texts, IM messages, graphics, internet etc is fast becoming an incomplete methodology for smart phone and USIM examination.

Sunday, June 23, 2013

Considering Clone Test SIM Card Tools

Considering Clone Test SIM Card Tools

There have been a few mentions about clone test Sim Cards at this blog raising observations as to possible issues that may be useful to know.

http://trewmte.blogspot.co.uk/2012/10/to-clone-or-not-to-clone.html
http://trewmte.blogspot.co.uk/2008/11/cloning-test-sim-cards.html

Yet further observations examiners may find useful to consider are whether it is necessary for a cloned test SIM Card tool to produce identical files, structure and format for every clone test card produced or whether the make/model of handset can influence e.g. the number of files etc necessary to gain access to a handset's memory? Cust_Files pre-generated on a cloned test card should be included or excluded from consideration regarding the number of GSM/3GPP EFs identified on a cloned test card? The importance, if any, of the evolution in a clone test card's development?

Below are two screen dumps, following examination using just one (U)SIM Card Reader, from two different clone test SIM Cards supplied by different manufacturer with their tools that provide a useful visual indicator when placed in context with the above observations. The observations above and the images below are not published to suggest a problem with a particular clone test SIM Card or tool. The observations are for the purpose should two different examiners use two different clone test SIM Cards and tools to generate evidence which one would be more pertinent for use when accessing memory on a particular handset etc?

Friday, June 21, 2013

PIN Enabled SIM Card

Additional tests with the PIN Locked SIM Card conducted with different SIM Readers

Mobile Phone Forensic Examination

Greg Smith has over 30 years (1985 to 2016) experience in handling digital and mobile telephone evidence in criminal and civil investigations and providing services to blue-chip clients in the UK. Our unit the DEEU conducts acquisition and harvesting of data from:

SIM/USIM/MMC Cards
Mobile/Smart Phones/Tablets
Satellite/WiFi
Computer Forensics/network

Forensically recovering saved and deleted data using a range of hardware and software tools to obtain or image physical data or download logical data.

Cell Site Analysis investigations and evidence since 1988.

Contact:
The DEEU
Email: trewmte@gmail.com