[00:00.000 --> 00:04.360]  Up until the Snowden documents came out working with a lot of law enforcement agencies.
[00:04.780 --> 00:07.380]  Law enforcement is kind of a lot like the hacker community.
[00:07.500 --> 00:11.900]  You've got some real fantastic people trying to do a good job to serve the country.
[00:12.140 --> 00:15.460]  Then you also have the people that you really don't want to deal with, some real horrible folks.
[00:15.700 --> 00:21.620]  So since over the past few years, I've been very carefully watching who I actually work with.
[00:21.800 --> 00:22.980]  I'm very selective.
[00:23.220 --> 00:29.920]  I try and work with agencies and people that aren't trying to destroy privacy in this country.
[00:30.000 --> 00:33.960]  But I did spend a lot of time writing the forensics tools for iOS.
[00:34.680 --> 00:36.260]  That also started back in 08.
[00:36.560 --> 00:43.520]  It started out a 17-page law enforcement guide that I've since circulated just for free to a number of different agencies.
[00:43.520 --> 00:46.540]  I've provided it a number of open-source tools as well.
[00:47.520 --> 00:53.600]  And that ended up leading to a lot of consulting that I've done on a federal and local level.
[00:53.780 --> 00:58.220]  I'm usually one of the guys that they call in when they've got the difficult high-profile cases.
[00:58.220 --> 01:01.320]  So I've worked closely with the law enforcement community.
[01:01.400 --> 01:02.960]  I've worked closely with the military.
[01:03.940 --> 01:08.520]  I've gotten to see a lot about what they're about and what they're trying to do.
[01:09.020 --> 01:15.980]  So everything from working on a number of important criminal cases that you guys have heard of to being brought into the D.C.
[01:16.040 --> 01:21.920]  area to consult on certain public officials' iPads and things like that, I've gotten to touch a lot of different agencies.
[01:21.920 --> 01:24.280]  So it's been a learning experience for me.
[01:24.420 --> 01:30.960]  And when the stone leaks came out, I think, you know, we were all a little bit naive, at least to just how far that rabbit hole went.
[01:31.200 --> 01:41.520]  So I've since been working primarily in more of a private setting, trying to work with private agencies, doing a lot of pro-privacy type of research and development.
[01:42.540 --> 01:43.600]  So that's me.
[01:43.960 --> 01:46.800]  The reason you're here is the iOS operating system.
[01:48.120 --> 01:50.680]  Obviously, it's pretty worldwide now.
[01:50.860 --> 01:56.080]  I believe they estimated 600 million devices are out right now.
[01:56.320 --> 01:58.000]  They're anticipating about a billion.
[01:58.880 --> 02:07.260]  Der Spiegel first leaked a little while ago the first hints that NSA had targeted the iOS operating system for collection.
[02:07.720 --> 02:15.440]  Later on, when Dropout Jeep came out, we learned that there are a lot of command and control capabilities that they were in the process of deploying.
[02:16.020 --> 02:22.080]  At the time Dropout Jeep was out, however, you know, we're talking about a few years ago, iOS was very different than it is now.
[02:22.400 --> 02:28.920]  And if you look at Dropout Jeep, they're even discussing close access methods, which may involve physical possession of a device.
[02:29.160 --> 02:30.640]  So there are a lot of limitations.
[02:31.320 --> 02:37.680]  But at the same time, I'm sure since Dropout Jeep came out, there are a number of mechanisms that have been deployed since.
[02:37.880 --> 02:39.220]  So I'll get into some of these.
[02:39.540 --> 02:49.160]  And obviously, it's being hacked by everybody, you know, whether it's to steal some celebrities nude photos or to get evidence for, you know, a case involving terrorism and whatnot.
[02:49.600 --> 02:52.040]  Everyone wants into iOS data.
[02:52.740 --> 02:58.700]  There are a number of forensic techniques now that are in commercial applications to acquire this data.
[02:59.000 --> 03:03.080]  Many of them have gone through our NIST and been validated by NIST, the NIST agency.
[03:03.660 --> 03:11.420]  A number of private sort of confidentially sealed private tools are out there as well that you don't see on the commercial market.
[03:13.780 --> 03:16.760]  So let me just give you a brief introduction of what this talk is about.
[03:17.800 --> 03:23.540]  I'm going to be talking about a number of undocumented high-value forensic services that are running on the iPhone.
[03:23.760 --> 03:25.800]  They run on every single iOS device.
[03:26.520 --> 03:27.980]  They've evolved quite a bit.
[03:28.100 --> 03:30.580]  They're currently still maintained by Apple, it seems.
[03:30.580 --> 03:32.100]  What data they provide.
[03:32.440 --> 03:40.380]  I'll give you some examples of the kind of data forensically that we've recently been able to acquire off of the device that hadn't been there before.
[03:41.060 --> 03:46.840]  There are also a number of surveillance mechanisms that are built in under the guise of enterprise security.
[03:47.000 --> 03:48.160]  And that is obviously important.
[03:48.160 --> 03:51.520]  You've got a company, you need to monitor these devices.
[03:51.520 --> 03:55.300]  You need to be able to, you know, get inside of an employee-owned device.
[03:55.300 --> 04:02.340]  At the same time, they make very interesting targets for an agency like NSA who has some of the capabilities that we don't.
[04:02.740 --> 04:04.900]  So I'll outline a few of those as well.
[04:05.280 --> 04:12.180]  And touch on just a few of the suspicious design choices that Apple's made that I think have really weakened the operating system.
[04:13.020 --> 04:15.460]  What the talk isn't, it's not a zero-day talk.
[04:15.760 --> 04:17.040]  None of these are zero days.
[04:17.460 --> 04:22.140]  These have been inside the operating system since as far back as I can tell.
[04:22.140 --> 04:23.700]  I've only got an iOS 2 device.
[04:23.900 --> 04:25.140]  I don't have an iOS 1 device.
[04:25.580 --> 04:29.060]  But as far as I can tell, they've been around since at least 2008.
[04:29.620 --> 04:31.800]  They've grown Apple's aware of the components.
[04:31.820 --> 04:33.120]  They've been maintaining them.
[04:33.280 --> 04:35.080]  You'll see how they've grown over time.
[04:35.320 --> 04:41.140]  I've sent plenty of emails to Tim Cook and their executive team about it and make sure that they're aware of these tools.
[04:41.400 --> 04:47.900]  The only thing I can get a response back from Apple on is, you know, my battery warranty and other things like that.
[04:47.900 --> 04:54.920]  I've gotten absolutely zero response from Apple on these specific things, which I've referred to as back doors to Apple.
[04:55.180 --> 04:57.680]  So, I have no doubt that they're aware of them at least.
[04:59.660 --> 05:03.900]  So, over the past few years, you've seen Apple break into the enterprise.
[05:04.920 --> 05:08.840]  Many of you are... anyone familiar with FIPS 140-2 compliance?
[05:08.840 --> 05:09.780]  They've gone after that.
[05:09.780 --> 05:12.820]  It's a cryptographic module certification process.
[05:13.700 --> 05:24.940]  They've really worked hard to break into the enterprise and keep the end user out by creating this hedged garden that you see, where you don't... obviously you don't want to allow users to jailbreak the device.
[05:25.120 --> 05:28.340]  You don't want to let them get too much data in the device.
[05:28.560 --> 05:39.360]  At the same time, a lot of what we see in terms of even being able to install apps has been centralized and funneled through Apple's enterprise and developer connection and other mechanisms.
[05:39.360 --> 05:53.300]  So, really at this point, Apple has full control of their devices, but they've been able to maintain, with reasonable levels of security, being sort of that single point of ingress into being able to do what you want with the device.
[05:53.680 --> 06:03.700]  In other words, unless you're hacking the device, you can't just throw it into a certain mode and install whatever you want, get complete access to the OS like you can, a lot more open-source systems.
[06:05.440 --> 06:08.380]  Apple does have a law enforcement process.
[06:08.380 --> 06:10.820]  And the URL is right there if you wanted to visit it.
[06:10.920 --> 06:11.800]  It's all very public.
[06:12.300 --> 06:21.620]  The process itself is very basic, but our current federal and local government agencies are using this process to obtain data off of a phone.
[06:21.760 --> 06:24.260]  So you get a device logged into evidence.
[06:24.480 --> 06:26.300]  There are a number of forensic tools out there.
[06:26.920 --> 06:35.380]  When it comes to a real serious matter or an issue that, you know, let's say a forensic tool can't get into a device for some reason, it goes to Apple.
[06:35.380 --> 06:38.320]  So Apple has been kind of riding the line.
[06:38.480 --> 06:41.300]  They've made some improvements lately to their law enforcement process.
[06:41.520 --> 06:51.020]  They now, by default, will disclose to the user a warrant that was served unless the law enforcement agency seeks confidentiality order.
[06:51.180 --> 07:00.800]  And so now, most of the law enforcement agencies, whenever they submit a warrant to Apple, they're including a confidentiality order to prevent the user from finding out.
[07:01.140 --> 07:04.360]  The process, I've seen in the papers, it takes about seven weeks.
[07:04.360 --> 07:07.080]  I've heard from a lot of federal agencies.
[07:07.080 --> 07:10.040]  They're looking at about four months to get the data off the device.
[07:10.700 --> 07:18.220]  The data that comes across, we'll talk about a little bit later, but what Apple promises in their terms is the unencrypted data.
[07:18.300 --> 07:20.760]  In other words, the NS Protection None data.
[07:20.760 --> 07:23.720]  That's not protected with the data protection encryption.
[07:24.560 --> 07:28.400]  And then I've heard a number of unsubstantiated reports I thought I would mention at least.
[07:28.400 --> 07:31.300]  You know, federal government folks that I've spoken to.
[07:32.220 --> 07:34.140]  I've heard rumors of this black box.
[07:34.560 --> 07:44.800]  We've seen in recent news, you know, people suspecting Apple of doing a lot of cryptography-type debugging work, working against AES, for example.
[07:45.060 --> 07:56.000]  I can't tell you whether or not any of that is true, but I have heard rumors of some black box that came from Foxconn that supposedly surprised a lot of Apple engineers when they discovered that of its capabilities.
[07:56.240 --> 07:57.420]  I know nothing of it.
[07:57.540 --> 07:58.400]  I've never seen it.
[07:58.480 --> 08:03.980]  But that's what I'm hearing from a few federal agents that are out there, that have actually run phones through Apple.
[08:04.180 --> 08:13.980]  So we've got two main veins where Apple obviously has admitted that they are able to extract data from passcode-locked devices.
[08:13.980 --> 08:25.120]  And we've got this other vein where someone is possibly suspicious of whether or not Apple is working to debug and counteract a lot of the encryption on the device.
[08:25.380 --> 08:27.180]  I can't attest to the second.
[08:27.720 --> 08:32.780]  But obviously it's within Apple's own... this is part of their law enforcement process.
[08:33.380 --> 08:38.760]  They've already admitted they can extract certain categories of active data from passcode-locked devices.
[08:38.760 --> 08:39.940]  Well, what kind of data is this?
[08:40.060 --> 08:40.460]  Let's take a look.
[08:40.600 --> 08:42.920]  SMS, photos, video, contacts.
[08:43.100 --> 08:47.380]  You know, basically most of the important stuff and personal data on your phone.
[08:48.000 --> 08:49.280]  So why is this?
[08:49.740 --> 08:51.840]  We've got, you know, Apple touts to the enterprise.
[08:51.840 --> 08:55.580]  We've got all this strong encryption, you know, military-grade encryption.
[08:55.580 --> 08:56.820]  How are they able to do this?
[08:57.340 --> 09:14.040]  Well, you might remember... this is in my slide, but Sajani Labs presented a few years ago this storage encryption overview where you could see in the upper right this little thing called the D-key, which is one of the encryption keys that's used primarily to encrypt the Apple file system.
[09:14.320 --> 09:21.440]  That key is actually stored in a faceable storage, and it's protected with hardware deduced keys, and not the PIN.
[09:21.800 --> 09:34.140]  So the real question is, of course, what... you know, if you don't have a PIN, and if your encryption isn't married to the PIN, what's stopping Apple or anyone else from being able to get to that data?
[09:34.140 --> 09:36.420]  The real answer is nothing.
[09:37.620 --> 09:46.920]  Most of the Apple files that are on the file system, and this has been known for a couple years, have been encrypted with an encryption mechanism that's never tied to your PIN.
[09:47.200 --> 09:57.140]  Apple has data encryption for now and iOS 7 third-party apps and your email, which up until a recent version, they weren't even encrypting attachments.
[09:57.140 --> 10:01.240]  But everything else that's on your phone is encrypted with this D-key.
[10:01.480 --> 10:06.480]  It's also called a class 4 key, which is tied to the hardware and has nothing to do with your password.
[10:07.320 --> 10:09.840]  So fast forward now, we're in iOS 7.
[10:10.260 --> 10:11.860]  Not much has changed.
[10:12.040 --> 10:17.400]  Most of the file system encryption is still not married to your PIN or your complex passphrase.
[10:18.580 --> 10:24.800]  There are a number of additional documents now on the iPhone that are encrypted.
[10:24.800 --> 10:28.820]  So Apple did add the third-party app documents.
[10:28.840 --> 10:32.120]  But there's also a lot of data that's still not encrypted.
[10:33.000 --> 10:35.940]  A few other interesting things I want to mention about the encryption.
[10:36.260 --> 10:46.020]  Once you unlock that device after it's rebooted for the first time, you authenticate as a user on that phone and unlock most of that key bag.
[10:46.240 --> 10:53.780]  So there are additional layers of encryption on top of that, which can be unlocked in some of the methods I'm going to talk about.
[10:54.380 --> 11:06.000]  However, once you authenticate, your phone for the most part is walking around with that key bag left in a state to where it's possibly interceptable by a number of different means.
[11:06.180 --> 11:23.600]  So the law enforcement technologies that are out there have started to try and adapt to this new technique where we want to be able to get the data off of the device potentially before the suspect shuts the device down, leaving most of your encryption still open.
[11:24.420 --> 11:29.660]  So there are a number of different forensics tools that are out there that are able to perform deep extraction.
[11:29.920 --> 11:40.700]  Now we can't do physical extraction anymore since the iPhone 4 and all the old fun boot ROM exploits that there were, but there are a number of deep logical types of extractions that we can get.
[11:41.620 --> 11:43.980]  Tablet forensics now are being deployed in the field.
[11:44.100 --> 11:46.900]  And you see a lot of companies coming out with tablet devices.
[11:47.540 --> 11:58.780]  If you look at Celebrite and others, there are field expedient forensic tools that can actually establish a connection with the device and acquire it in the field before the device can get a chance to be rebooted.
[11:58.780 --> 12:05.220]  Obviously, you guys have heard about, you know, a number of dumping, cases of dumping phones at traffic stops and things like that.
[12:05.520 --> 12:09.140]  A lot of these tablet solutions are employed for those types of purposes.
[12:12.240 --> 12:27.300]  As far as, you know, black bag technologies, in terms of juice jacking for example, there are some techniques out there that you would expect a lot of the federal type agencies in countries all over the world, really, to be interested in.
[12:27.700 --> 12:34.040]  You know, all the stories you hear of, you know, a compromised docking station or an alarm clock in a hotel.
[12:34.660 --> 12:45.140]  There are a lot of technical capabilities that are out there, many in the open-source community, that you can use to build these types of solutions, even still with iOS 7.
[12:46.400 --> 12:57.420]  Now, one thing I want to point out, and this is part of the real core of my talk, is computer infiltration was one of the things that Der Spiegel, as well as Dropout Jeep, had mentioned.
[12:58.220 --> 13:09.380]  Specifically, Der Spiegel talked about the NSA hacking into Target's desktop computers and being able to essentially activate 38 other different features on the phone from that point.
[13:09.560 --> 13:10.880]  So, keep that in mind.
[13:11.180 --> 13:12.820]  We'll get back to that in a few.
[13:13.040 --> 13:21.020]  But really, what I want to start talking about is that relationship between the desktop and the phone.
[13:21.600 --> 13:28.240]  So, how many of you guys, just a show of hands, are aware with the pairing process that the iPhone has and how that works?
[13:29.040 --> 13:31.180]  So, you get a desktop machine.
[13:31.440 --> 13:32.680]  You get your iPhone.
[13:32.980 --> 13:35.300]  You can obviously make them start talking to each other.
[13:35.400 --> 13:36.340]  You can sync your data.
[13:36.660 --> 13:39.500]  There's a little pairing dance that takes place.
[13:40.100 --> 13:46.960]  And the way that works is there are a set of private keys that get generated and exchanged between the phone and the desktop.
[13:46.960 --> 14:04.600]  One other thing that's interesting is more recent versions of iOS now send what's called an escrow bag, which is essentially a copy of the system key bag in order to allow whoever has that record to access encrypted data even while the device is locked.
[14:04.820 --> 14:09.700]  So, we talked earlier about having that phone unlocked after you first authenticate.
[14:10.340 --> 14:20.200]  If you have these escrow records or access to these escrow records, you also have the keys to be able to unlock all of that other encryption that gets locked when you lock the device.
[14:21.080 --> 14:22.340]  A few other things.
[14:22.600 --> 14:23.680]  USB thumb drives.
[14:24.100 --> 14:37.160]  So, when you are dealing with forensics tools now, you... hopefully you're never on the receiving end of this, but your place of business or your residence ends up getting raided.
[14:37.380 --> 14:43.860]  There are a number of forensics tools on USB stick now that are able to hunt for these pairing records that we're talking about.
[14:44.240 --> 14:46.760]  The pairing records end up getting stored on your desktop.
[14:47.340 --> 14:52.660]  And really, any other device that you've ever plugged your computer into or plugged your phone into.
[14:53.260 --> 14:56.520]  You know, now with iOS 7, at least you have to push trust.
[14:57.060 --> 15:00.740]  But you establish this relationship with these desktop machines.
[15:01.140 --> 15:07.640]  And that machine can forever access the data on your phone using this pairing data.
[15:10.740 --> 15:13.880]  So, let me just read this from Der Spiegel before we get into it.
[15:13.880 --> 15:18.660]  The document states possible for the NSA to tap most sensitive data, blah, blah, blah.
[15:19.260 --> 15:22.520]  Contactless SMS, traffic, notes, location information.
[15:22.840 --> 15:24.800]  Does that sound familiar?
[15:25.060 --> 15:30.020]  This is the same type of data that is in Apple's current law enforcement process.
[15:30.480 --> 15:34.680]  The unencrypted data that they're able to pull off the device while the device is locked.
[15:35.240 --> 15:39.720]  They're able to infiltrate the computer a person uses to sync their iPhone.
[15:39.860 --> 15:42.020]  This is, again, the quote that came from Der Spiegel.
[15:42.020 --> 15:44.240]  To enable these additional features.
[15:44.580 --> 16:02.220]  So, I suspect, and again, we'll never know unless someone actually leaks this information, that the goal here is obviously to infiltrate the desktop computer systems, get control of this pairing data, the pairing records, and use that information to access the device.
[16:02.740 --> 16:06.600]  Of course, part of this is not just about accessing the device, is it?
[16:06.960 --> 16:12.640]  Part of this is about what kind of data you might be able to get off of the device that really shouldn't come off the device.
[16:13.780 --> 16:18.380]  Sir, can I trouble you to just grab a glass of water for me so I can continue my talk?
[16:18.540 --> 16:18.840]  Thank you.
[16:20.800 --> 16:23.000]  So, let's talk about these undocumented services.
[16:23.760 --> 16:25.500]  Obviously, you guys are familiar with the backup.
[16:25.740 --> 16:26.860]  There's nothing wrong with the backup.
[16:26.980 --> 16:28.860]  You need to be able to backup your phone, right?
[16:29.180 --> 16:35.100]  What's the one feature that Apple's recently added to protect the data coming from the backup?
[16:35.100 --> 16:35.780]  Does anyone know?
[16:37.240 --> 16:37.640]  Encryption.
[16:37.760 --> 16:37.880]  Encryption, right.
[16:38.500 --> 16:39.000]  So, you would imagine...
[16:39.000 --> 16:39.760]  Thank you so much.
[16:40.320 --> 16:51.280]  So, you would imagine that having backup encryption on the phone should obviously prevent someone if they've got your phone and decide they want to rip a backup of it from being able to get to your data.
[16:55.320 --> 17:01.080]  The problem, of course, is that a number of these undocumented services I'm going to outline bypass the backup encryption.
[17:01.300 --> 17:02.360]  So, we'll get into that shortly.
[17:03.280 --> 17:08.400]  Some other properties of these undocumented services, they can be accessed both through USB and wirelessly.
[17:08.780 --> 17:12.800]  So, it doesn't really matter if I've got physical access to your phone or not.
[17:13.020 --> 17:31.180]  If I have ever been able to either establish a pairing on my own, for example, maybe at a traffic stop or if you've been arrested, or if I'm able to grab a pairing record off your desktop, which law enforcement is currently doing, if they arrest you they're going to seize your desktop as well as your mobile devices.
[17:31.740 --> 17:39.660]  So, if they can get access to this pairing record, they can access your phone wirelessly at any point in the future.
[17:39.880 --> 17:44.580]  That pairing record stays on your phone, it lives on your phone until you restore the phone completely.
[17:45.400 --> 17:55.040]  If the device hasn't been rebooted, then they can access all of the data that is protected by data protection without having your PIN.
[17:55.980 --> 17:57.680]  Partly due to this escrow record.
[18:01.460 --> 18:07.060]  And then in addition to that, and some of these undocumented services, let's look at the documented ones.
[18:07.280 --> 18:14.060]  We're able to do a lot with just the services we know about, like mobile installation and being able to install software, get it up and running.
[18:14.300 --> 18:17.940]  We can take the traffic on that phone, reroute it anywhere we want to.
[18:18.080 --> 18:19.720]  So, we'll talk about that a little bit.
[18:22.570 --> 18:29.270]  But, you know, most of these services that I'm outlining here, they're not referenced by any known Apple software.
[18:30.270 --> 18:36.370]  So, I've looked, I've went and scanned through iTunes, Xcode, everything else that's out there.
[18:36.470 --> 18:38.610]  There are a few proprietary pieces of software.
[18:38.970 --> 18:43.470]  Apple has nothing public that is actually using any of these interfaces.
[18:44.310 --> 18:50.130]  The raw data that comes from some of these interfaces makes it impossible to put the data back onto the phone.
[18:50.130 --> 18:57.270]  So, you know, one of the arguments that I hear a lot is, well, maybe it's for Apple tech stores or engineering or genius bar.
[18:57.610 --> 19:02.090]  Well, once you get this data off, it's in such a raw format that you actually get the raw databases.
[19:02.530 --> 19:05.090]  You don't just get someone's contact data.
[19:05.450 --> 19:07.170]  So, there's no way to put it back on the phone.
[19:07.730 --> 19:09.770]  The data is very personal, as you'll see.
[19:10.330 --> 19:12.270]  We're talking, you know, we already talked a little bit.
[19:12.330 --> 19:13.890]  You've got photos, SMS.
[19:14.270 --> 19:18.670]  There's a lot of personal information coming off of this phone that we'll look at.
[19:19.450 --> 19:28.630]  And in addition to this, this backup encryption that's supposed to protect the user, that's been sold to the end user to protect their device, is completely bypassed.
[19:31.250 --> 19:35.010]  Now, a lot of these you could potentially argue for development purposes.
[19:35.230 --> 19:40.670]  However, all of these I'm going to outline, they're on all 600 million phones that are out there.
[19:40.670 --> 19:42.550]  You don't have to have developer mode enabled.
[19:44.990 --> 19:50.590]  So, I'll just highlight Dropout Jeep, and then I'll skip over to the next slide and explain how we get into some of this.
[19:50.790 --> 20:07.270]  But, Dropout Jeep, if you take a look at some of the features that they outline, the ability to remotely push-pull files, SMS retrieval, contacts, again, a lot of the same stuff that we keep hearing about from Apple's law enforcement process now.
[20:07.410 --> 20:08.950]  It's the same basic type of data.
[20:08.950 --> 20:12.430]  Now, the Dropout Jeep implant was close access.
[20:12.610 --> 20:14.070]  So, we could be talking jailbreaking.
[20:14.370 --> 20:16.630]  We could be talking baseband exploitation.
[20:17.390 --> 20:24.950]  You know, we don't know exactly, but I suspect it probably had something to do with jailbreaking back in the day to have a 100% success rate.
[20:26.050 --> 20:27.910]  So, how we do it today is a little different.
[20:28.110 --> 20:31.130]  Let's assume we're not talking about a jailbroken device.
[20:31.270 --> 20:36.490]  We're not talking about a device that is giving you any kind of data that any other phone won't.
[20:36.550 --> 20:37.850]  No developer mode, nothing.
[20:37.850 --> 20:39.830]  Just something straight out of the box.
[20:41.110 --> 20:45.330]  The basic process to starting some of these services...
[20:45.330 --> 20:47.990]  And again, a lot of this is nothing new.
[20:48.390 --> 20:49.710]  We know this protocol.
[20:49.710 --> 20:51.010]  We've known it since about 2008.
[20:51.870 --> 20:54.770]  There's a process on the phone called lockdownD.
[20:55.090 --> 20:57.190]  You know, we're able to connect to this port.
[20:57.310 --> 20:59.950]  This is how you would normally initiate a sync, for example.
[20:59.950 --> 21:07.510]  You authenticate by establishing an SSL session using your private keys that were exchanged when you paired with the device.
[21:08.530 --> 21:14.970]  And then you can start any service that the phone knows about by issuing a start service command, essentially.
[21:15.210 --> 21:17.670]  That creates a new listening port on the device.
[21:17.850 --> 21:22.350]  You connect to that port either through TCP or through USB MUX, for example.
[21:22.350 --> 21:25.350]  And then you access the services on that device.
[21:25.790 --> 21:38.470]  Now, a number of commercial tools that are used for law enforcement, forensic acquisition, currently invade a lot of this deep architecture to get the undocumented data out of these services.
[21:38.470 --> 21:42.510]  And some of these include Celebrite, Mobile Phone Examiner, Elcomsoft.
[21:42.730 --> 21:44.190]  There are many more out there as well.
[21:44.330 --> 21:51.210]  But if you read the product descriptions, a lot of them claim a deep logical analysis or an extended logical analysis.
[21:51.210 --> 21:54.930]  And then they outline a lot of the data that we're talking about here.
[21:55.790 --> 22:00.630]  So, this is known essentially in the software manufacturing community for law enforcement.
[22:01.270 --> 22:03.790]  It's not necessarily known to the end user.
[22:04.530 --> 22:08.190]  A lot of this is relatively new over the past year or so, I want to say.
[22:11.160 --> 22:18.460]  So, for those of you who aren't familiar with Libi Mobile Device, it's an open-source project that you can actually take and download it.
[22:18.740 --> 22:27.780]  All of the LockdownD protocols to cover the services in iOS are currently accounted for in Libi Mobile Device.
[22:28.040 --> 22:30.560]  I didn't write it, but it's been around for a while.
[22:30.780 --> 22:35.720]  Like I said, the problem is we haven't really looked at any of these services since this was written.
[22:35.880 --> 22:40.080]  And when Libi Mobile Device was written, a lot of these services were fairly benign.
[22:41.940 --> 22:43.620]  So, let's talk about the first one.
[22:43.880 --> 22:45.100]  This is PCAP.
[22:46.060 --> 22:48.080]  You guys are probably all familiar with PCAP.
[22:48.620 --> 22:56.840]  What they don't tell you is that a packet sniffer is available and running on all 600 million iPhone devices that are out there.
[22:57.260 --> 22:58.640]  Not developer mode.
[22:58.780 --> 23:03.700]  Has absolutely nothing to do with engineering or tech support.
[23:03.700 --> 23:05.140]  iTunes doesn't talk to it.
[23:05.280 --> 23:09.640]  There's just a packet sniffer there doing nothing waiting for someone to connect to it.
[23:10.380 --> 23:16.400]  Now, you can connect to this like any other service across Wi-Fi and enable the sniffer.
[23:16.520 --> 23:17.460]  Here's an example.
[23:18.200 --> 23:23.620]  Now, there's no visual indication given to the user that the device is currently packet sniffing.
[23:23.620 --> 23:24.800]  And you can see...
[23:24.800 --> 23:26.240]  I don't know if you can actually read that.
[23:26.420 --> 23:33.940]  But that's me just connecting my phone to my own packet sniffing software that I wrote to connect to the iPhone.
[23:34.440 --> 23:40.940]  And then going to my website on my iPhone, you can get all of the HTTP request response data.
[23:41.480 --> 23:44.860]  You can see third-party app data going across.
[23:45.920 --> 23:51.360]  A lot of the time, there's a lot of proprietary HTML or XML that just gets sent across.
[23:51.880 --> 23:57.880]  It does send mostly request response data, but oftentimes you do see a lot of content as well.
[23:58.400 --> 24:01.400]  So that's one example, more of a lighter example.
[24:01.760 --> 24:13.320]  Now, some developers in open-source have used this and have taken advantage of the fact that we've got PCAP running on the iPhone and have written some developer tools that are actually able to go and scrape this data for the developers.
[24:13.580 --> 24:15.520]  So there is some practical utility to it.
[24:15.680 --> 24:19.140]  However, none of this information has been given to developers by Apple.
[24:19.300 --> 24:22.380]  We're not supposed to necessarily know about this.
[24:23.300 --> 24:31.380]  One of the biggest forensic troves of data that a lot of software manufacturers are getting these days is from a service called Mobile File Relay.
[24:31.660 --> 24:37.540]  Now, this has been around since iOS 2, but it started its life as a very benign service.
[24:37.540 --> 24:41.540]  And if any of you have a jailbroken phone, you can even grab a copy of the binary.
[24:41.700 --> 24:43.820]  It sits in userlib exec on the phone.
[24:45.680 --> 24:54.620]  Unlike most logical forensic tools that get you just a list of contacts and a list of whatever, this actually gets you copies of the database files themselves.
[24:54.960 --> 25:00.760]  So when you get a copy of the SQLite3 databases, you're able to carve out a lot of deleted data as well.
[25:00.880 --> 25:02.700]  Deleted contacts, deleted texts.
[25:02.700 --> 25:06.880]  You can really pull out data as if this was a physical acquisition.
[25:08.060 --> 25:10.480]  What you get is kind of strange.
[25:10.800 --> 25:12.080]  It's almost kicking at old school.
[25:12.240 --> 25:22.600]  You get a CPIO archive that is gzip compressed, coming back to the end user, containing a number of different directory structures, depending on the data source that you request.
[25:23.620 --> 25:26.060]  As I said, we used to think it was benign.
[25:27.580 --> 25:34.860]  In iOS version 2, these were the only data sources that we were able to get off of file relay.
[25:35.120 --> 25:42.860]  And the only real one that had any kind of useful data was user databases, which had your contacts and a couple other basic databases.
[25:45.020 --> 25:48.740]  So it's easy to see how easily this could have been overlooked several years ago.
[25:49.480 --> 25:55.220]  As of iOS 7, these are all of the data sources that you can request from mobile file relay.
[25:55.520 --> 25:57.280]  You can see it's grown considerably.
[25:57.600 --> 26:03.480]  And there's a lot more data now that's being sent in iOS 7 than has ever been sent before.
[26:03.920 --> 26:09.240]  All of this information is dumped in lieu of backup encryption.
[26:09.240 --> 26:12.860]  So we skirt back up encryption completely by connecting to this service.
[26:13.140 --> 26:15.420]  Doesn't matter if the user has it turned on or off.
[26:15.900 --> 26:20.500]  And we're able to get it in a really raw dump format, like I said, a CPIO archive.
[26:21.480 --> 26:23.760]  So I'm going to cover just some of these sources.
[26:24.800 --> 26:27.360]  Now, if you want to, go and look at these sources.
[26:27.660 --> 26:29.380]  Grab the mobile file relay binary.
[26:29.560 --> 26:30.680]  Just do a strings dump.
[26:30.900 --> 26:39.280]  This is not... it doesn't take a lot of rocket science to get to this point, where you can see all of the directories, all the paths that it's dumping from your phone.
[26:39.900 --> 26:41.740]  But a couple of the most interesting ones.
[26:41.760 --> 26:43.400]  Of course, you can get a list of accounts.
[26:43.960 --> 26:48.860]  And that will give you all the email, Twitter, iCloud, Facebook accounts that are configured on the device.
[26:49.160 --> 26:51.160]  That gives you a SQLite 3 database.
[26:52.000 --> 26:53.780]  The address book, that's great.
[26:54.660 --> 27:02.040]  The caches folder is interesting because this is a lot of the low-level data that the phone caches itself that really shouldn't come off the phone.
[27:02.040 --> 27:09.980]  For example, every time you hit that home button and your application suspends, the phone takes a screenshot of what you were last looking at.
[27:10.120 --> 27:12.380]  And it saves that screenshot in this cache.
[27:12.720 --> 27:19.500]  So by grabbing this cache, you end up with a copy of the last thing a user was looking at in all of the applications.
[27:20.220 --> 27:22.240]  There's also a keyboard typing cache.
[27:22.840 --> 27:25.900]  The keyboard typing cache, it's gotten a little better.
[27:25.960 --> 27:27.040]  I'll touch on that in a minute.
[27:27.040 --> 27:33.820]  But every time you type something into the iPhone, regardless, a lot of that data is logged for autocorrect.
[27:34.000 --> 27:35.540]  So you're getting a lot of low-level data.
[27:35.720 --> 27:38.980]  Everything from map tile images, the contents of the clipboard.
[27:39.520 --> 27:41.720]  Again, stuff that shouldn't be coming off the phone.
[27:43.280 --> 27:45.740]  Core location is a set of GPS logs.
[27:45.880 --> 27:56.140]  So you guys remember the consolidated database debacle that went on a couple of years ago where Apple was storing all of your location data, and you were able to easily pull it out.
[27:56.380 --> 27:58.000]  Well, it looks like that's kind of back now.
[27:58.140 --> 28:06.340]  I looked in my core location dump, and I was able to get 60 days' worth of timestamps, that delta there.
[28:06.460 --> 28:10.440]  So I've got 60 days of location data for my personal device.
[28:11.080 --> 28:13.080]  And it's stored in these two files.
[28:13.140 --> 28:16.720]  You see files, lock, cache, encrypted, and cache, encrypted.
[28:16.720 --> 28:24.800]  Now, of course, the word encryption doesn't mean anything by now, because you've got access to all of this data completely unencrypted.
[28:25.480 --> 28:29.180]  Again, we're skipping past user-level backup encryption.
[28:29.280 --> 28:31.440]  So that encrypted is sort of a misnomer.
[28:32.780 --> 28:39.300]  One of the most interesting features that I've seen in iOS 7 is this HFS meta data source.
[28:39.600 --> 28:43.960]  Now, this data source is just beyond all reason ridiculous and unnecessary.
[28:43.960 --> 28:47.160]  There's no way I can imagine justifying this if I were Apple.
[28:47.360 --> 28:51.900]  But you get a complete metadata disk image of the entire phone.
[28:52.000 --> 28:56.180]  It's about 200 meg, without the actual file content in it.
[28:56.340 --> 29:02.000]  So you can actually mount this on your Mac after you download it, and see every single file that's on the file system.
[29:02.620 --> 29:07.540]  Normally, you know, to the end user, your typical end user, they think, well, metadata, big deal.
[29:07.740 --> 29:12.040]  We all know better that metadata is just as telling as real data.
[29:12.040 --> 29:18.920]  So what we can gain from just having this disk image, of course, we can see when the device was last activated or wiped.
[29:19.100 --> 29:21.640]  We can see every application you've got installed.
[29:21.860 --> 29:24.840]  And a lot of the time, the names of the documents that are installed.
[29:24.980 --> 29:31.740]  For example, Dropbox, we can see all of the locally cached files that you've got in your Dropbox just by looking at this file structure.
[29:31.980 --> 29:33.460]  All of the email accounts.
[29:33.820 --> 29:36.600]  One of my favorites is the SMS drafts folder.
[29:36.600 --> 29:49.080]  So anytime you think you're going to type a really nasty message, and then you decide delete, delete, delete, that actually gets saved on the file system with the phone number as the directory name containing all that information.
[29:49.420 --> 29:58.480]  So we're able to see back, you know, I've seen six months to eight months worth of SMS drafts information cached in this folder.
[29:58.660 --> 30:09.860]  And even if you can't see the content, which is stored, by the way, and you can get to that, but even if you can't see the content, you can see all the phone numbers that you were communicating with just through this dump.
[30:12.460 --> 30:15.020]  Of course, you can also get a great timeline of activity.
[30:15.300 --> 30:21.460]  So what we do when we build cases, you know, against murderers or rapists or whatnot, we build a timeline.
[30:21.780 --> 30:24.840]  And, you know, we get your timeline of activity.
[30:24.980 --> 30:31.680]  We know that this device was used at this hour, this hour, for this period of time.
[30:31.920 --> 30:33.120]  That helps a lot.
[30:33.120 --> 30:41.720]  There was a case recently that I assisted the military with that involved specific usage of the device by the witness.
[30:42.120 --> 30:49.020]  And drilling that down to be able to pinpoint this time of day directly affected the case and impacted the case.
[30:50.140 --> 30:51.520]  So we get a lot of that data.
[30:51.660 --> 30:53.300]  We also get keyboard, keyboard cache.
[30:53.940 --> 31:00.740]  Now, up until one of the most recent versions of iOS 7, Apple was using Dynamic Dictionary 4.
[31:00.820 --> 31:02.380]  That's their file format.
[31:02.640 --> 31:13.200]  That contained a complete sequenced, ordered listing of everything you typed in to the keyboard in any application in the order you typed it.
[31:13.380 --> 31:16.460]  So you type something in SMS or email, it doesn't matter.
[31:16.760 --> 31:18.080]  It wound up in this cache.
[31:18.080 --> 31:24.500]  It was a great source of forensic artifacts, of course, if you're trying to work on different types of cases.
[31:24.760 --> 31:27.220]  But at the same time, it was just terrible for privacy.
[31:27.660 --> 31:30.240]  So recently, Apple released... sorry?
[31:30.560 --> 31:31.100]  Passwords?
[31:31.960 --> 31:36.160]  The very first version stored passwords, credit card numbers, all of that.
[31:36.540 --> 31:41.080]  By 2009, they had gotten smart enough to get rid of the password feature.
[31:42.260 --> 31:45.400]  And then, recently, Dynamic Dictionary 5.
[31:45.640 --> 31:47.780]  They only keep a word count now, which is great.
[31:47.900 --> 31:54.000]  They still keep a count in terms of, you know, I've used the word kill 107 times.
[31:54.140 --> 31:55.240]  That's all recorded down.
[31:55.800 --> 32:02.220]  I don't know if any of you guys are familiar with, you know, probabilistic types of language analysis, hidden Markov models.
[32:02.380 --> 32:08.640]  You can take a lot of this data, feed it into a statistical classifier, get a decent probability for phrases.
[32:08.640 --> 32:15.940]  In fact, Apple has their own phraseology framework in iOS now, which is one of the reasons that they don't have to store the phrases anymore.
[32:16.940 --> 32:19.680]  So you still do get a lot of information from that.
[32:19.840 --> 32:24.720]  You get a complete database dump of the calendar, alarms, notes, all the notes you type in.
[32:24.720 --> 32:32.820]  I can't tell you how many cases I've worked where the person, the suspect, would have a list of bomb-making components in their notepad.
[32:32.860 --> 32:36.100]  And that was the core evidence that was used to convict them.
[32:36.880 --> 32:43.340]  Of course, you also get photos, which, you know, dealing with a camera roll is one thing, being able to dump the camera roll off your phone.
[32:43.460 --> 32:50.040]  But now we're talking about going and getting the complete photo album that was synced from the user's desktop, copied onto the phone.
[32:50.180 --> 32:51.840]  You're able to also get that off.
[32:51.960 --> 32:58.480]  So if you get that off, you get potentially, what, five years, ten years worth of not only photos, but you get metadata.
[32:58.480 --> 33:01.320]  You get the geolocation tags that are in there.
[33:01.520 --> 33:04.860]  You know where they've been, what they've been doing, exactly when they were doing it.
[33:07.770 --> 33:08.250]  Sir?
[33:08.470 --> 33:09.210]  Deleted photos?
[33:10.130 --> 33:11.790]  Deleted photos don't come off.
[33:11.970 --> 33:23.750]  They, with the encrypted file system, fortunately, you delete a photo, unless you can find it in a thumbnail database or some other artifact in there, the file itself is dumped off the phone.
[33:24.510 --> 33:28.070]  User databases, again, that's been around for a while, but you get everything else.
[33:28.230 --> 33:31.310]  Your SMS databases, your email metadata.
[33:32.250 --> 33:39.030]  Depending on what version of iOS you're on, you may also get email attachments and possibly even the email database.
[33:41.010 --> 33:44.050]  VARFS, this was a predecessor to HFS meta.
[33:44.330 --> 33:53.010]  It's basically the same thing, only you got a stat VFS structure and this other crazy little set of structures returned.
[33:53.410 --> 33:54.870]  It was extremely proprietary.
[33:54.870 --> 34:03.570]  Again, lending to the fact that we're not talking about standardized interfaces that were ever intended to be used by us guys.
[34:04.870 --> 34:11.410]  Voicemail as well, you get a copy of all the audio files, the voicemail database, who left it, when they left it, what the phone number was, et cetera.
[34:12.010 --> 34:13.530]  So that's mobile file relay.
[34:13.690 --> 34:19.150]  And again, I've only touched on maybe a dozen of, I believe, 43 or 46 services.
[34:19.150 --> 34:27.050]  So since 2008, we've gone from six services to 40-something services that are serving up your personal data on the device.
[34:27.470 --> 34:31.810]  And absolutely no documentation to show that they should be there.
[34:32.050 --> 34:32.310]  Sir?
[34:32.310 --> 34:34.450]  You know what's outside the scope of
[34:40.690 --> 34:43.730]  your words that you type?
[34:43.890 --> 34:48.050]  Are they actually indexing the words that you're typing all your text messages?
[34:48.410 --> 34:52.030]  A lot of them do, but they keep it in a reasonable format.
[34:52.170 --> 34:55.370]  I think Apple's format now is a lot better than it used to be.
[34:55.550 --> 35:00.550]  Is there a rationale they give for why they get to know that you use kill 100%?
[35:00.550 --> 35:04.110]  Well, the idea is you get that little autocorrect window, right?
[35:04.330 --> 35:12.150]  It wants to learn your words, which is why websites like Damn You Autocorrect are so funny, because it tries to learn your words and adapt to them.
[35:12.290 --> 35:15.910]  But the engineering behind it just, it was very poorly engineered.
[35:16.770 --> 35:18.510]  Let's talk about a couple other things.
[35:18.910 --> 35:21.170]  House Arrest, we know what this service does.
[35:21.550 --> 35:25.090]  iTunes uses this to allow you to exchange documents and information, right?
[35:25.390 --> 35:33.230]  So you need to be able to copy a document out of, you know, whatever office app you're using on the phone and copy it into some other app.
[35:33.750 --> 35:34.650]  That's great.
[35:34.910 --> 35:50.950]  The problem is, even though iTunes itself doesn't let you, the underlying service allows you complete access to that application, sandboxes, library, and caches folder, where you can get all of the other really deep information, the databases that get stored,
[35:51.030 --> 35:54.830]  your Facebook database, all the user info that gets cached.
[35:55.130 --> 35:57.970]  You can access this if you know how to talk to the service.
[35:58.550 --> 36:05.770]  If you're dealing with a photo vault, there are a number of photo vaults that aren't worth a dime in the app store that just store your photos in the sandbox, unencrypted.
[36:06.010 --> 36:07.730]  You can get all that data from it.
[36:08.150 --> 36:10.310]  One example is from the Twitter app.
[36:10.910 --> 36:12.410]  You can get all the recent photos.
[36:12.510 --> 36:14.590]  I went through my Twitter app the other day and looked at it.
[36:14.670 --> 36:25.810]  You get all the recent photos from my stream, my recent timeline that's cached, my entire private message database, screenshots of the last time I used Twitter, and all of my OAuth tokens as well.
[36:26.330 --> 36:32.690]  So if I were to take the Twitter app, I'd be able to easily deduce what the consumer key and secret is from the app.
[36:33.210 --> 36:46.830]  If I were to use these OAuth tokens indefinitely, once I intercepted them, I could potentially access your Facebook, your Twitter, your Fitbit, whatever it is that's using OAuth, as long as you don't revoke that token later on.
[36:47.330 --> 36:48.970]  So here's a quick tip.
[36:49.130 --> 36:57.970]  If you lose physical access of your device for any amount of time and you're a little paranoid about it, unauthorize all your tokens and just create new tokens.
[36:57.970 --> 37:02.550]  Because once that is intercepted, that gives anybody the ability to access your accounts remotely.
[37:04.690 --> 37:05.130]  Photovolts.
[37:05.570 --> 37:11.910]  Like I said, you know, a lot of the data that they are protecting, a lot of the time they just Base64 encode the photo or whatever.
[37:11.910 --> 37:13.530]  There are some that are better than that.
[37:14.170 --> 37:21.690]  And the ones that do encrypt, unfortunately, some of them will store your PIN in the configuration file or a hash of the PIN.
[37:21.870 --> 37:24.290]  You know, 10,000 hashes is really easy to generate.
[37:25.550 --> 37:38.730]  Once in a while they will encrypt the file, but, you know, most of the time, I would say, you know, maybe 80% of the photovolts out there in the store have some major serious flaw that you can easily exploit just by having this data.
[37:38.730 --> 37:54.210]  And then even if you have a good app that does encrypt and doesn't store the PIN, a lot of the time they'll log information such as the PIN that's been entered into Syslog, and you can grab a copy of that through another interface called Syslog.
[37:55.670 --> 38:01.890]  So let's talk about some theories as to this data and a lot of the other data that's just undocumented and it shouldn't be there.
[38:01.910 --> 38:03.430]  Why is Apple doing it?
[38:03.430 --> 38:09.110]  Are they really giving us...are they really installing back doors or do they have some type of plausible deniability?
[38:09.250 --> 38:14.390]  Well, let's look at...one excuse I hear a lot is iTunes or Xcode uses them.
[38:14.470 --> 38:17.270]  Well, we can't find any real use for a lot of these.
[38:17.890 --> 38:20.990]  Apple uses the backup sync, obviously.
[38:21.290 --> 38:22.590]  It doesn't use file or relay.
[38:22.830 --> 38:24.530]  It certainly doesn't use the packet sniffer.
[38:25.350 --> 38:30.810]  iTunes uses house arrest, but it doesn't try and access library, cash, or some of the other privileged folders.
[38:31.510 --> 38:33.750]  And iTunes actually respects your backup encryption.
[38:34.090 --> 38:35.830]  It doesn't try and skirt around it.
[38:35.970 --> 38:45.350]  So if you have your backups encrypted, you know, if someone just does a dump through iTunes, they're not going to be able to get to your data unless they have your password or find a way to brute force it.
[38:45.470 --> 38:46.890]  So that theory's out the window.
[38:47.510 --> 38:52.510]  What about the idea that, well, this must be for the genius bar for Apple to provide support?
[38:52.850 --> 38:54.650]  Well, like I mentioned, the data is too raw.
[38:54.890 --> 39:02.990]  Tech support wouldn't know what to do with a gzip CPIO archive, let alone what to do with the raw SQLite 3 data that comes off of the device.
[39:03.250 --> 39:08.970]  Even if they have some software that is able to go and parse this data, there's no way you can put it back onto the phone.
[39:09.110 --> 39:11.470]  So what's the point of them having it in the first place?
[39:11.750 --> 39:22.490]  And if I bring an Apple device to a genius bar, they had better respect my passwords that I have on the device and not try and bypass the user backup encryption.
[39:22.970 --> 39:31.370]  You know, if I were to bring my desktop in and there was some way that they could somehow bypass file vaults, I think we would all be revolting at Apple stores right now.
[39:32.330 --> 39:38.950]  But even if, let's just assume there was a legitimate use, why do they need a copy of my personal photos?
[39:39.070 --> 39:41.590]  Why do they need a copy of everything that's synced to my desktop?
[39:42.450 --> 39:46.470]  The data is just far too personal to do any kind of in-store tech support.
[39:49.410 --> 39:52.410]  One other theory must be for developers to debug.
[39:52.670 --> 39:53.850]  Well, we don't know about this stuff.
[39:53.930 --> 39:56.210]  I'm an Apple developer, I've got my certificates.
[39:56.210 --> 40:02.730]  There's nothing in any of the docs that tells me about the PCAP service or file relay or any of these other services.
[40:04.130 --> 40:06.550]  Developers don't need to bypass backup encryption.
[40:06.750 --> 40:08.390]  In fact, you know, they probably...
[40:08.390 --> 40:10.910]  Apple would probably be pretty upset if developers are doing that.
[40:11.730 --> 40:14.170]  Apple wants developers to use the APIs.
[40:14.950 --> 40:16.350]  iPhone wants to use your contacts.
[40:16.490 --> 40:17.350]  It gives you a dialogue.
[40:17.430 --> 40:18.590]  You allow, you don't allow.
[40:18.830 --> 40:21.390]  Those are the interfaces that Apple developers are given.
[40:21.390 --> 40:25.090]  We're not expected to use any of these features to get this data.
[40:26.470 --> 40:27.550]  How about engineering?
[40:28.350 --> 40:32.370]  Well, we don't really need engineering tools on all 600 million devices.
[40:32.590 --> 40:34.370]  Why is there a packet sniffer on them all?
[40:34.990 --> 40:37.230]  We don't need to get this low-level data.
[40:37.630 --> 40:44.930]  Apple also has made some improvements to iOS 7 that has helped to prevent a lot of malware from exploiting this type of data.
[40:45.390 --> 40:53.410]  For example, they no longer allow local host connections, so I can't, from within my app, I can't connect to my phone's own IP in iOS 7.
[40:53.590 --> 41:06.270]  In iOS 6, I could have written an app that would take that pairing that was established and connect to the phone itself at regular intervals in the background and dump all of my data and send it off remotely.
[41:06.490 --> 41:10.750]  Apple plugged that hole in 7 by not allowing me to connect to the phone and attack the phone.
[41:10.830 --> 41:15.870]  So now I have to have two phones attacking each other on the same network, which just makes it even more fun.
[41:17.270 --> 41:20.770]  Also, if you're doing engineering, you shouldn't need to bypass backup encryption.
[41:20.970 --> 41:26.490]  They ought to be asking me for my permission to get the data off the phone before they're going to do any crazy engineering on it.
[41:26.650 --> 41:29.110]  So I don't really think this is for engineering either.
[41:30.090 --> 41:33.650]  And of course, there's a theory, oh, well, maybe Apple put it on there and forgot about it.
[41:33.670 --> 41:36.950]  Maybe it's some old relic from, you know, development or whatnot.
[41:37.230 --> 41:39.390]  They're maintaining this code.
[41:39.690 --> 41:42.870]  This code has been updated as recently as iOS 7.
[41:43.410 --> 41:50.330]  I'm sure when iOS 8 comes out, I've already heard from a number of developers that there have been a lot of changes in 8 to lockdown.
[41:50.670 --> 41:52.730]  And they've changed directories of things that stored in.
[41:52.730 --> 41:55.290]  It'll be interesting to see just how much it changes.
[41:55.530 --> 42:00.650]  But over the years, year after year, there are new data sources in file relay.
[42:00.970 --> 42:07.130]  There are new hashes on some of these service binaries that are there.
[42:07.130 --> 42:09.050]  They are constantly being maintained and updated.
[42:09.210 --> 42:10.970]  Nobody has forgotten about them.
[42:11.150 --> 42:18.430]  And they've even made some changes to try and patch for bugs that would allow this to be a more widespread security threat.
[42:20.130 --> 42:21.450]  So I'm running short on time.
[42:21.530 --> 42:23.430]  I'm going to skip over some of the more benign services.
[42:23.430 --> 42:25.990]  But obviously, you can do a lot with what's already there.
[42:27.010 --> 42:29.350]  Syslog, diagnostics data, you can install apps.
[42:29.590 --> 42:33.410]  If you have an enterprise account, you could easily install invisible malware.
[42:34.070 --> 42:39.370]  It's still possible to have a process that is hidden and runs in the background on the iPhone.
[42:39.570 --> 42:40.550]  They say you can't do it.
[42:41.370 --> 42:42.890]  That's really all you need to do it.
[42:43.310 --> 42:46.450]  For those of you who were at DEFCON recently, the MACTANS talk.
[42:46.610 --> 42:47.370]  It was a great talk.
[42:47.450 --> 42:50.490]  I was really hoping that information would come forward at some point.
[42:51.390 --> 42:54.970]  The SB app tags flag allows you to hide your app.
[42:55.150 --> 42:57.890]  So if you install it through Xcode, it does not appear in the user interface.
[42:58.170 --> 43:01.630]  And you can create a VoIP app to run.
[43:01.630 --> 43:03.590]  You can identify your app as a VoIP app.
[43:03.770 --> 43:07.710]  And it will run in the background every ten minutes or so.
[43:08.210 --> 43:11.550]  To sort of maintain those connections, the voice over IP connections.
[43:11.730 --> 43:15.530]  And you see this happening with Fring and some of the other Skype and whatnot.
[43:16.270 --> 43:20.790]  If you want to do bad things in the background, all you have to do is set a keep alive handler.
[43:21.150 --> 43:24.750]  And you can have your app trigger off every ten minutes or so.
[43:24.890 --> 43:28.050]  And I believe it can run for up to ten minutes before it's killed off.
[43:28.530 --> 43:29.810]  So you can do all kinds of stuff.
[43:29.810 --> 43:33.090]  And even if you don't have root access, you can dump all the socket connections.
[43:33.110 --> 43:34.310]  You can get all that metadata.
[43:34.590 --> 43:35.910]  Who are you connecting to?
[43:36.290 --> 43:37.470]  How are you connecting?
[43:38.570 --> 43:39.530]  What IPs?
[43:39.590 --> 43:41.650]  What kind of processes are running on the phone?
[43:41.830 --> 43:44.330]  A lot of this information is enterprise level stuff.
[43:44.470 --> 43:48.590]  But obviously it has and can be used for more nefarious purposes.
[43:51.390 --> 43:53.810]  So you paid 600 bucks for this fingerprint reader.
[43:54.070 --> 43:56.390]  You're probably assuming it gave you a lot of security.
[43:57.070 --> 44:02.570]  Unfortunately, bad news, the encryption is not tied to your fingerprint at all.
[44:03.030 --> 44:07.450]  In fact, if you reboot your phone, you can't use your fingerprint.
[44:07.670 --> 44:09.770]  So your phone needs a way to access that crypto.
[44:10.070 --> 44:11.430]  It's all tied to the pin.
[44:11.550 --> 44:17.230]  And again, that's just a small sliver of what actually really is what we would consider encrypted.
[44:17.810 --> 44:21.450]  So the fingerprint reader doesn't really do anything for you.
[44:21.650 --> 44:26.310]  But in addition to that, there is a bypass for the fingerprint reader anyway.
[44:26.730 --> 44:29.110]  It was designed for enterprises.
[44:29.630 --> 44:32.970]  Obviously, you have an employee that dies or leaves on bad terms.
[44:33.090 --> 44:35.250]  You want to be able to get to an employee-owned phone.
[44:35.570 --> 44:41.110]  And in order to do that, if there is a lock on the phone or fingerprint lock, as far as I know, dead fingers don't work.
[44:41.310 --> 44:43.950]  Has anyone tried with a cadaver by show of hands?
[44:44.650 --> 44:45.950]  I don't think they work.
[44:45.950 --> 44:49.970]  I've tried with bacon grease, and I ate a lot of bacon for that test.
[44:50.770 --> 44:52.150]  But it's difficult.
[44:52.450 --> 44:54.750]  You really don't want an enterprise to have to go through that.
[44:54.890 --> 44:56.970]  So Apple, of course, provided a switch.
[44:57.450 --> 45:00.450]  But the switch, there are a couple neat little caveats.
[45:00.770 --> 45:10.250]  So when I went to investigate how the switch worked, I noticed that the device itself has code to call home when you first provision that device out of the box.
[45:10.250 --> 45:18.070]  So before you even type a name into it, that device will call home and see if it is part of a larger MDM rollout.
[45:18.210 --> 45:27.310]  And I would imagine that the IBMs or the Cisco's or the large companies of this world are going to need something like that to provision 30,000, 40,000 devices.
[45:27.950 --> 45:32.930]  So it calls Apple, and it looks to see if the device is provisioned.
[45:32.930 --> 45:37.990]  Of course, we've all just recently learned about NSA's interdiction techniques.
[45:38.130 --> 45:43.950]  Now, I'm not suggesting NSA is using this, but it's certainly one interesting hole that's there.
[45:44.230 --> 45:46.410]  The idea of electronic interdiction.
[45:46.730 --> 45:48.810]  You pull your phone out of the box.
[45:48.830 --> 45:54.270]  If you're already being targeted on some level, your phone is calling home before it's even set up.
[45:54.410 --> 46:07.750]  What could NSA do if they were able to, you know, establish that relationship, that pairing relationship with the device, and, you know, create that trusted kind of link right out of the box.
[46:07.790 --> 46:12.470]  Of course, they could continue to monitor you wirelessly as long as they wanted to.
[46:12.730 --> 46:29.970]  And, of course, if you penetrate the enterprise, if you penetrate, you know, small business or an IBM, and you're able to get access to these enterprise keys, like we read about in the Dr. Spiegel article, well, now you can access this switch that's available to the enterprise and access all 30,000
[46:29.970 --> 46:30.670]  of their devices.
[46:31.010 --> 46:36.910]  You talk about China hacking us, China talking about having back doors in the operating system.
[46:37.210 --> 46:50.830]  Well, if I'm able to get into one American company or one American government organization and get, you know, one little set of supervisor certs, that means that I can activate the switch on pretty much any device that they monitor out there.
[46:51.890 --> 46:55.790]  This is all stored in what's called an MC Cloud configuration in iOS 7.
[46:55.930 --> 46:58.330]  And there are four different results that can occur.
[46:58.330 --> 46:59.510]  You can deny all pairing.
[47:00.310 --> 47:01.330]  You can allow pairing.
[47:01.990 --> 47:04.630]  But, of course, you throw up a trust dialogue and make the user push trust.
[47:05.550 --> 47:10.910]  You can allow pairing with no user prompt and while locked, which that's kind of a more interesting one.
[47:11.450 --> 47:15.450]  And then, of course, there's that certificate challenge response that you do with the enterprise.
[47:16.250 --> 47:18.510]  So it's interesting to see.
[47:18.630 --> 47:21.570]  I don't know if you can read that, but that's a little disassembly.
[47:21.690 --> 47:31.810]  But all of these different, these four different tests, they will jump over the pairing logic that ensures that the device is unlocked and that you've pushed the trust button.
[47:32.090 --> 47:40.090]  So if you look at that in more of a pseudo code type dump, essentially, we check the cloud configuration.
[47:40.090 --> 47:46.270]  Do we allow pairing while the device is locked and bypass the fingerprint reader and bypass the pin lock?
[47:46.970 --> 47:48.430]  Or is it an Apple TV?
[47:48.430 --> 47:52.990]  And if either of those holds true, we skip all device lock checks.
[47:53.390 --> 47:57.450]  Now, one of the other checks halfway down under pairing security, that's the actual pairing test.
[47:57.610 --> 47:58.510]  Is the device locked?
[47:59.170 --> 48:00.430]  Has setup completed?
[48:00.710 --> 48:02.070]  Has the user ever pushed trust?
[48:02.350 --> 48:14.170]  If setup hasn't completed, if you have an out-of-the-box device that's calling home to Apple, you can pair with that with absolutely no trust dialogue without any pairing security whatsoever, without the user even knowing.
[48:15.730 --> 48:16.830]  So calling home.
[48:16.830 --> 48:25.930]  This is something, of course, is a lot harder for us to do unless we are able to bypass SSL validation, of course.
[48:26.150 --> 48:33.130]  However, we all know that certain government agencies have been able to spoof a number of certificates.
[48:34.050 --> 48:40.590]  If you're able to spoof iProfiles.apple.com, you know, again, I don't have the resources for that.
[48:40.730 --> 48:41.890]  We know NSA does.
[48:42.090 --> 48:45.410]  But it connects to the server and it downloads a certificate.
[48:45.410 --> 48:50.470]  And then in addition, once it gets that certificate, it goes and talks to the session and the profile directories.
[48:51.330 --> 48:53.330]  It's kind of a RESTful API.
[48:53.350 --> 48:59.850]  And it downloads this MC Cloud configuration, which essentially defines the pairing security for the device.
[49:00.710 --> 49:16.210]  So if I really was interested in electronic interdiction, I would sit between myself and Apple, or between the phone and Apple, and I would essentially masquerade as Apple, and I would send configurations that allowed me access to these devices while locked.
[49:16.490 --> 49:20.810]  It would actually be technically relatively easy to pull off if I were an NSA.
[49:21.930 --> 49:26.330]  From there, this cloud configuration can invoke this pairing bypass we talked about.
[49:27.910 --> 49:29.290]  But you know what?
[49:29.610 --> 49:47.850]  Even if you can't bypass SSL, Apple seems to have left a switch right in the app, where if this little setting is turned on on the phone somehow, MC Cloud config accept any HTTPS certificate, all SSL validation goes out the window, and you can sit there and masquerade as Apple all you want,
[49:47.930 --> 49:50.330]  and the phone's not going to give the user any kind of warning.
[49:50.330 --> 49:55.470]  So it seems like there's already even a mechanism in there to bypass this SSL validation.
[49:55.710 --> 49:59.990]  Now perhaps that's some engineering code that got forgotten and left behind.
[50:00.230 --> 50:02.530]  Perhaps it's there intentionally, but it's there.
[50:04.370 --> 50:07.250]  From there, you know, you call home, you get the new cloud configuration.
[50:07.970 --> 50:09.450]  It's a great attack surface.
[50:09.650 --> 50:14.250]  And maybe in a future talk I'll attack this and give a little highlight.
[50:15.510 --> 50:18.550]  But again, this is more of a higher level talk.
[50:18.550 --> 50:19.850]  So here's my questions, okay?
[50:20.170 --> 50:22.230]  And these are the questions you guys should be asking Apple.
[50:22.430 --> 50:27.990]  Why is there a packet sniffer running on every single iOS device that has nothing to do with developer mode?
[50:28.330 --> 50:35.090]  Why are there undocumented services that bypass user backup encryption, dumping all of my personal data from the phone?
[50:36.190 --> 50:38.390]  Why isn't this data still encrypted yet?
[50:38.530 --> 50:43.710]  I mean, they should have found it's very easy, engineering-wise, to encrypt the whole disk.
[50:43.830 --> 50:54.530]  Why are they leaving 90% of the data that's on the phone still encrypted only based on a hardware deducible key that allows you to get access to this data without a pin?
[50:55.490 --> 51:02.070]  And lastly, you know, why is there no way to see what devices, what desktop machines I'm actually paired with?
[51:02.590 --> 51:04.530]  You know, you have no idea as the end user.
[51:04.770 --> 51:08.810]  In iOS 6, everything you plugged that phone into established a pairing with it.
[51:08.950 --> 51:12.150]  There were dozens of pairing records on some of my old phones.
[51:12.150 --> 51:22.450]  You plug it into a friend's computer to steal a charge, or you plug it into, you know, one of those little units that does the sound, and it happens to also pair with it sometimes.
[51:22.450 --> 51:26.930]  Just to... it must use some of these interfaces in controlling the audio.
[51:27.390 --> 51:33.530]  But there are a number of different devices, and, you know, you connect to any malicious device in a hotel or whatnot.
[51:33.570 --> 51:36.530]  We were completely unprotected in iOS 6.
[51:36.530 --> 51:38.790]  But even in 7, you have a trust dialogue.
[51:39.130 --> 51:42.910]  We're still stupid, and we push trust almost without thinking about it.
[51:43.230 --> 51:48.650]  Plugging into, you know, an audio device, or plugging into an FM transmitter, or whatever.
[51:49.370 --> 51:54.470]  So there's no way yet to review these pairing records to know what's actually talking to the phone.
[51:55.270 --> 51:57.750]  But I will give you a little bit of a way to protect yourself.
[51:58.430 --> 52:02.990]  So I talked about this little test where it says deny all pairing.
[52:03.210 --> 52:07.910]  So I want to figure out how to make that work, because I really don't want my phone pairing with anything.
[52:08.150 --> 52:12.810]  I don't mind if I have a pairing record on my desktop, which is encrypted, you know, three different ways.
[52:13.050 --> 52:16.070]  But I really, you know, I don't want anything else.
[52:16.230 --> 52:28.450]  If I'm stopped by a cop and my phone happens to still be unlocked, or if I'm compelled to unlock my phone for any reason by any foreign government or my own government, I don't want anybody to get anything off of it.
[52:28.670 --> 52:31.350]  So enter Apple Configurator.
[52:31.450 --> 52:34.470]  And this is something you guys can do, again, to protect your own phone.
[52:34.870 --> 52:36.110]  It's free in the App Store.
[52:36.770 --> 52:39.410]  It lets you define an MDM restriction on the phone.
[52:39.990 --> 52:44.490]  And you can use it to prevent your phone from pairing with anything, even while it's unlocked.
[52:45.250 --> 52:50.890]  So if you were to plug it in right now to my desktop, you push trust, it just won't pair with it.
[52:51.410 --> 52:58.250]  You can pair it once with your desktop, or if you don't want it to be able to pair with anything, you know, you can keep your phone completely isolated.
[52:58.250 --> 53:01.790]  Now, this won't help you if they still send your phone to Apple.
[53:01.990 --> 53:06.350]  Of course, they can still get that chunk of data that's not encrypted off of it.
[53:06.490 --> 53:09.650]  And there are rumors that they're doing pin boot forcing.
[53:10.610 --> 53:11.850]  That's really easy to do.
[53:11.950 --> 53:14.850]  I used to do it in all the older versions of my forensics tools.
[53:15.510 --> 53:20.870]  The only thing I don't have today, carte blanche, that Apple has is code signing authority.
[53:20.870 --> 53:28.770]  So if you're able to root the phone with a signed RAM disk that will do a pin boot force, you can easily scroll through all 10,000.
[53:28.930 --> 53:30.970]  So still use a complex passphrase.
[53:31.910 --> 53:35.170]  It's removable if you don't want it later, but it's another step.
[53:35.310 --> 53:41.070]  It'll keep nosy cops, it'll keep TSA, whoever it is you're trying to keep out of your phone, away from pairing with it.
[53:41.070 --> 53:42.070]  I got five minutes left.
[53:42.370 --> 53:46.750]  It'll defeat every forensic tool that's currently out there.
[53:47.410 --> 53:49.790]  All you do is you set it up as a supervised device.
[53:49.790 --> 53:52.210]  You create a pairing profile for it.
[53:52.910 --> 53:56.450]  And then where there's that little arrow, you just uncheck that box.
[53:56.630 --> 53:58.650]  Allow pairing with non-configurator hosts.
[53:58.850 --> 54:01.010]  It won't pair with anything after that.
[54:01.610 --> 54:07.070]  You'll see this profile appear in the phone itself when you look under profiles.
[54:08.190 --> 54:10.230]  So I'm just about done, then I'll take a couple questions.
[54:10.510 --> 54:15.070]  But here are my design suggestions for Apple, and really all cell phones in general.
[54:15.130 --> 54:21.130]  We need to start using asymmetric cryptography because we leave way too much data unlocked so that our phone can do stuff in the background.
[54:21.370 --> 54:22.430]  Get a photo, whatever.
[54:22.930 --> 54:31.010]  We need some type of session state encryption for copies of this data so that we can effectively manage it without having to leave it unencrypted.
[54:31.210 --> 54:32.290]  A boot password.
[54:32.550 --> 54:37.990]  And we really need some way to better protect this escrow bag that we're sending around.
[54:38.110 --> 54:40.050]  It's just like we're chucking around encryption keys.
[54:41.370 --> 54:43.990]  So lastly, you know, this is summary.
[54:44.350 --> 54:46.510]  Apple's dishing out a lot of data behind our backs.
[54:47.170 --> 54:52.230]  You guys may or may not have been aware of just how much, but it's intensified over the recent years.
[54:52.890 --> 54:54.650]  It violates customers' trust.
[54:54.890 --> 54:58.770]  We're bypassing encryption, user-level backup encryption.
[54:58.910 --> 54:59.830]  This should not be so.
[55:00.070 --> 55:02.410]  And there really is no excuse for a lot of this.
[55:03.010 --> 55:06.290]  It's a tasty target for both government and for criminals.
[55:06.770 --> 55:09.630]  And a lot of these really need to get addressed by Apple.
[55:10.090 --> 55:11.690]  So, I've got just a few minutes left.
[55:11.770 --> 55:14.650]  I wanted to break and take any questions you guys might have.
[55:14.990 --> 55:16.950]  Is this available for online?
[55:17.650 --> 55:18.450]  The configurator?
[55:18.610 --> 55:18.890]  No.
[55:19.330 --> 55:20.070]  The slide deck?
[55:20.190 --> 55:21.670]  I'll get the slide deck up for you.
[55:22.250 --> 55:23.230]  What was your question, sir?
[55:23.370 --> 55:26.250]  Have you found anything interesting in X in your source code?
[55:26.450 --> 55:27.430]  Or is that pretty well?
[55:28.370 --> 55:30.330]  A lot of people have been through that.
[55:30.930 --> 55:33.930]  I like to start with binary and just work my way back.
[55:33.930 --> 55:42.770]  But the open-source pieces of iOS, I don't expect those to be nearly as offensive as some of the closed source components.
[55:42.950 --> 55:44.350]  So, I haven't really spent a lot of time in there.
[55:44.430 --> 55:44.970]  Yes, you don't.
[55:45.070 --> 55:45.750]  We have time for that.
[55:45.810 --> 55:46.490]  We don't have time?
[55:46.610 --> 55:46.810]  Okay.
[55:46.930 --> 55:47.270]  We're done.
[55:47.370 --> 55:47.810]  Thank you, guys.
[55:54.470 --> 55:55.410]  Thank you very much.
[55:55.450 --> 55:55.710]  Thanks.
[55:56.050 --> 55:56.370]  Sorry.
[55:56.490 --> 55:57.150]  I had to race through it.
[56:01.120 --> 56:01.520]  Sorry.
[56:02.460 --> 56:04.780]  Is there something like Little Snitch for iOS?
[56:04.900 --> 56:06.280]  I wish there was.
[56:06.700 --> 56:09.480]  Could you use the PCAP stuff to implement it?
[56:10.180 --> 56:10.580]  Potentially.
[56:10.880 --> 56:15.360]  I think someone's written on the jailbreak circuit IP tables or something like that.
[56:15.640 --> 56:16.540]  Or some equivalent.
[56:17.260 --> 56:18.520]  But I haven't played with it.
[56:19.100 --> 56:19.580]  I don't know if that works.
[56:19.580 --> 56:22.400]  Because some of these apps might just be chatting out and you'd never know it.
[56:22.480 --> 56:22.800]  Oh, yeah.
[56:23.040 --> 56:25.360]  And I've got a lot of code that I've written.
[56:26.440 --> 56:26.840]  Thanks.
[56:27.020 --> 56:27.300]  Appreciate it.
[56:27.320 --> 56:30.180]  How would the profiles.apple.com...
[56:30.180 --> 56:32.360]  Yeah, let's get out.
[56:32.780 --> 56:33.260]  Let's go ahead.
[56:33.380 --> 56:33.860]  Let's go ahead.
[56:33.860 --> 56:34.640]  Let's talk if you guys want to talk.
[56:34.780 --> 56:35.220]  Let's go ahead.
[56:35.220 --> 56:36.440]  And this is the second one.