It's been a long time since I wrote a blog post. I moved to Singapore and started a new job and I simply lost track of time. I couldn't let the year end without getting at least a few posts up. I promise 2014 will be better as I actually missed blogging this year.

This post will cover how to get your own NSRL server running so you can perform hash checks while you are out on IR engagements, or whatever the "case" may be.

Getting Started

• NSRL Hashes: http://www.nsrl.nist.gov/RDS/rds2.41/rds241m.zip
• REMnux: http://sourceforge.net/projects/remnux/files/version4
• nsrllokup: http://rjhansen.github.io/nsrllookup
  • https://github.com/rjhansen/nsrllookup/tree/master/src

I’m sure you can use another Linux distro, but I already had REMnux installed and configured.

REMnux

• remnux@remnux:~/$unzip master.zip
• remnux@remnux:~/$sudo ./configure --with-nsrl=rds_241m.zip
• remnux@remnux:~/$sudo make install
• remnux@remnux:~/$nsrlsvr

Check if the process is running. It should be quite large as it will load all of the hashes into memory for better performance.

remnux@remnux:~/$ ps aux |grep nsrl

remnux 6984 0.4 62.5 2139288 1938472 ? Ssl 02:03 0:22 nsrlsvr  

You're done. Simple, huh?

On Windows

On a pretty much fresh install of Windows XP SP3 and filtering by "unknown" only you should get something like this. Note that most of those are VMWare Workstation related, which is newer version from when the last time the NSRL hashes were posted.

md5deep.exe -o e -s C:\Windows\System32\* | nsrllookup.exe -s 192.168.1.13

2ce150705bbeb30e6c8059cc530043aa C:\Windows\System32\Packet.dll  
f8dea29db6acd5e0cdf826f61c57422f C:\Windows\System32\tprdpw32.dll  
d553ed83f09c35d5bfb6d2195b76f491 C:\Windows\System32\TPSvc.dll  
12d82f9b89b41ed2ead173d2843599cd C:\Windows\System32\TPVMMon.dll  
c6bdfd9f093fb16fcc7da5c978defd5a C:\Windows\System32\TPVMMondeu.dll  
ef3d6aa91b07e980db537592d75a1f94 C:\Windows\System32\TPVMMonjpn.dll  
e5d6bda8319a3a8807cdc4c02fb32a1c C:\Windows\System32\TPVMMonUI.dll  
e256cd358572eba41f05ffb1503b79c5 C:\Windows\System32\TPVMMonUIdeu.dll  
b1a817677372f1d0646193ef5aa97136 C:\Windows\System32\TPVMMonUIjpn.dll  
cb2df5c410ac9bb9f522259bbc13c710 C:\Windows\System32\TPVMW32.dll  
b609f11ae55ee952b49a04bfdb141288 C:\Windows\System32\vmGuestLib.dll  
8db91bbc5060d91d9f23adee24f4c1bd C:\Windows\System32\vmGuestLibJava.dll  
8821ebee901b208239fe6ee3414eb062 C:\Windows\System32\vmhgfs.dll  
d2aa64cb308cdbc6034744503d6ee66b C:\Windows\System32\vmwogl32.dll  
28380e517b6ab25c3f1e61a42dc19b1e C:\Windows\System32\vmx_fb.dll  
d053547c06d55a4100b7bf84e9818370 C:\Windows\System32\vmx_mode.dll  
5c68ef9d3a8e424dc404de6430663c02 C:\Windows\System32\vsocklib.dll  
4633b298d57014627831ccac89a2c50b C:\Windows\System32\wpcap.dll  

NOTE I only hashed executable files (-o e). By default nsrllokup.exe will use the -u (unknown) flag, which is most likely what you're going to be using. If you wanted to filter by -k (known) you could use nsrllookup.exe -k -s _ip_. -u is default so you don't have to specify it.

You can customize your list of hashes if you want and pass the -f locationtoyour_set when starting up nsrlsvr. I used NSRL because everyone knows about them. If anyone knows of a more up-to-date or better list of hashes put it in the comments so everyone can use it. I use a combination of NSRL and custom hashes.

Here are the options from nsrlsvr

remnux@remnux:~$ nsrlsvr -h

Usage: nsrlsvr [-vbhsSo -f FILE -p PORT -t TIMEOUT]  
-v : print version information
-b : get information on reporting bugs
-f : specify an alternate RDS (default: /usr/local/share/nsrlsvr/NSRLFile.txt)
-s : allow clients to query server status (default: disabled)
-S : run as a normal process (do not run as a daemon)
-o : only support old (1.0) nsrlsvr protocol
-h : show this help message
-p : listen on PORT, between 1024 and 65535 (default: 9120)
-t : stop after TIMEOUT seconds of inactivity (default: disabled)

Organizations that use a standard baseline should be able automate and leverage this pretty easily within their environment.

Props to RJHansen for writing this tool! Thanks.

I have been talking with quite a few people lately tasked with "security" inside their organizations and couldn't help but notice their lack of understanding when it came to Windows process information.

I figured if the people I have talked with don't understand then there are probably a lot more people that don't understand. I'm guessing quite a few people that consider themselves "experts" as well.

I decided to write this post in an effort to help the individuals that may not have the knowledge, free time, training budgets, etc. to explore Windows processes. For about $50 - $75 (few books) and some free time you can learn pretty much everything needed to know about Windows processes.

My goal isn't to dive very deep into each of the processes. I figured a bulleted "cheat sheet" vs. wordy descriptions will be best for my intended audience.

The people that want to dive deeper can buy themselves a copy of Windows Internals, 6th Edition Part I and II, fire up Process Explorer/Process Hacker, start reading the great documentation by the Volatility team (references below).

Note The information below focuses on Windows 7 processes as more and more organizations are finally starting to migrate away from Windows XP. I wanted to give those folks a head start.

Let's break it down....

Idle and System

• Created by ntoskrnl.exe via the process manager function, which creates and terminates processes and threads.
• No visible parent processes
• System has a static PID of 4
• System creates smss.exe
• There should only be one system process running

SMSS - Session Manager

• First user mode process
• Parent process is System
• Base Priority of 11
• Username: NT AUTHORITY\SYSTEM
• Performs delayed file delete/rename changes
• Loads known dlls
• Runs from %systemroot%\System32\smss.exe
• Creates session 0 (OS services)
• Creates session 1 (User session)
• Creates csrss and winlogon then exits, which is why they have no parent process and they both have session ids of 1
• Runs within session 0
• Only one smss.exe process should be running at one time. The second smss.exe process exits, so you will only see the one running in session 0.
• There can be more sessions if more users are logged on to the system. 0 and 1 are for a single user logged onto the system.

CSRSS.EXE - Client/Server Run

• Windows subsystem process.
• Base Priority of 13
• %SystemRoot%\system32\csrss.exe
• Username: NT AUTHORITY\SYSTEM
• Creates/Deletes processes and threads, Temp files, etc.
• In XP its used to draw text based console windows. Under Windows 7, the conhost process now does that functionality. For example, cmd.exe
• One csrss process per session
• Its name is often used by malware to hide on systems (CSSRS.EXE, CSRSSS.EXE, etc.)
• Runs within session 0

WININIT.EXE - Windows Initialization Process

• Parent to services.exe (SCM), lsass.exe and lsm.exe
• Created by smss.exe, but since smss.exe exits there is no parent to WININIT.
• Base Priority of 13
• Username: NT AUTHORITY\SYSTEM
• %SystemRoot%\system32\wininit.exe
• Performs user-mode initialization tasks
• Creates %windir%\temp
• Runs within session 0

SERVICES.EXE - Service Control Manager

• Child to WININIT.EXE
• Parent to services such at svchost.exe, dllhost.exe, taskhost.exe, spoolsv.exe, etc. Services are defined in SYSTEM\CurrentControlSet\Services
• %SystemRoot%\System32\wininit.exe
• Username: NT AUTHORITY\SYSTEM
• Base Priority of 9
• Loads a database of services into memory
• Runs within session 0
• There should only be one services.exe process running

LSASS.EXE - Local Security Authority

• Child to WININIT.EXE
• Only one lsass.exe process
• %SystemRoot%\System32\lsass.exe
• Responsible for local security policy to include managing users allowed to login, password policies, writing to the security event log, etc.
• Often targeted by malware as a means to dump passwords. Also mimicked by malware to hide on a system (lass.exe, lssass.exe, lsasss.exe, etc.). These "fake" names will not be a children of wininit.exe.
• Base Priority of 9
• Username: NT AUTHORITY\SYSTEM
• Runs within session 0
• It should not have child processes

SVCHOST.EXE - Service Hosting Process

• Multiple instances of svchost.exe can/do exist/run
• %SystemRoot%\System32\svchost.exe
• Username: Should only be one of three options: NT AUTHORITY\SYSTEM, LOCAL SERVICE, or NETWORK SERVICE
• Should always have a parent of services.exe
• Base Priority of 8
• Often mimicked (scvhost, svch0st, etc.) When they are mimicked they will not be running as children to services.exe.
• Command Line: svchost.exe -k <name>
• -k <name> values should exist within the Software\Microsoft\Windows NT\CurrentVersion\Svchost registry key
• Often times when malware uses the actual svchost.exe to load their malicious service they will not include -k command line parameters and be running under a username that does not match on of the three listed in bullet 3.
• They should all be running within session 0

LSM.EXE - Load Session Manager Service

• Manages the state of terminal server sessions on the local machine. Sends the requests to smss.exe to start new sessions.
• Child to wininit.exe
• It should not have child processes
• Receives logon/off, shell start and termination, connect/disconnects from a session, and lock/unlock desktop
• I have not personally seen malware try and impersonate LSM.exe, but there is always a first so keep your eyes open.
• %systemroot%\System32\lsm.exe
• Base Priority of 8
• Username: NT AUTHORITY\SYSTEM
• Runs within session 0

WINLOGON.EXE - Windows Logon Process

• No parent process
• Could have a child process of LogonUI if smartcard, etc. are used to authenticate
• LogonUI will terminate once the user enters their password. Once password is entered the verification is sent over to LSASS and it's verified via Active Directory or SAM (the registry hive SAM), which stores local users and group information.
• Base Priority of 13
• Runs within session one
• Handles interactive user logons/logoffs when SAS keystroke combination is entered (Ctrl+Alt+Delete)
• Loads Userinit within Software\Microsoft\Windows NT\CurrentVersion\Winlogon
• The userinit value in the registry should be: Userinit.exe, (note the comma). Malware will sometimes add additional values to this key, which will load malware upon successful logons.
• Userinit.exe exits once it runs so you wont see this process running when you look.
• Userinit initializes the user environment. This includes running GPOs and logon scripts.
• Will run Shell value located at Software\Microsoft\Windows NT\CurrentVersion\Winlogon within the registry. The value of shell should be Explorer.exe. Malware will also use this sometimes to execute malware by adding values.
• Since Userinit exists this is also why Explorer.exe doesn't have a parent process.

Explorer.exe - AKA Windows Explorer

• No parent process since Userinit.exe exits
• The value "Explorer.exe" is stored in shell value within the registry. The registry location is here: Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
• Base Priority of 8
• Username: The logged on user account.
• %Systemroot%\Explorer.exe
• This will contain multiple child processes.
• Some of you might know this better as, "Windows Explorer"
• This process is often targeted by malware. Malware will often times inject this process. One indication of this is if Explorer.exe is connecting out to the internet. There are other indicators, but that's another post. We are keeping it simple here.

Let's sum this post up by creating a simple checklist to review while looking for malicious/suspect process activity.

• Check the parent/child relationships of processes.
• Check which users names the processes are running under
• Check their command line parameters for those processes that use them.
• Check their digital signatures
• Check their base priorities
• Check the location they are being from
• Check their spellings
• Leverage memory analysis to detect hidden and/or injected process. Some malware can hide processes by unlinking them (among other ways). Memory analysis is a must these days.
• When you get comfortable with everything here, dig deeper and check what modules are typically loaded for each process.
• Check and see if processes that should not be connecting out to the internet are not
• Check process privileges
• If wscript.exe process is running check the command line of what it is running.
• Investigate processes running inside %temp%, root of %appdata%, %localappdata%, recycle bin, etc.
• If rundll32.exe is running check its command line as well.
• "Most" legitimate user applications like Adobe, Web browsers, etc. don't spawn child processes like cmd.exe. If you see this, they should be investigated.
• Core Windows processes shouldn't be communicating out to the internet. If you see communication from these processes, dig deeper. Look for suspicious URLs/IPs, check process strings, etc.

So yeah, that's a quick run down. I'm sure I forgot some stuff so just hit me up via email if I missed something, or got something wrong. I've been wanting to get this out of my head and on-to paper for quite awhile.

Thanks to everyone that has documented bits of this over time. I likely wouldn't have been able to do it without your notes.

References

• Windows Internals 6th Edition, Part I - http://www.amazon.com/Windows-Internals-Part-Covering-Server%C2%AE/dp/0735648735
• Windows Internals 6th Edition, Part II
• http://www.amazon.com/Windows-Internals-Part-Covering-Server%C2%AE/dp/0735665877
• Windows Exploratory Surgery with Process Hacker by Jason Fossen
• http://blogs.sans.org/windows-security/files/ProcessHackerSANSJasonFossen.pdf
• The Volatility team and their Documentation and Source Code
• Art of Memory Forensics - http://www.amazon.com/gp/product/1118825098

I posted a blog post about Windows Processes and how knowing what's "normal" can be used to spot malicious activity. You can find it here Know your Windows Processes or Die Trying

I got quite a bit of positive feedback on that post so I figured I would write a similar one for spotting lateral movement on systems.

Let me make a quick comment before you keep reading.... NOT ALL of these artifacts WILL be created and even if they are, it's possible they aren't related. It will vary case-by-case. That's what makes this so much fun. Again... just because you see some of these DOES NOT mean you have been attacked or that you have lateral movement going on within your company/organization.

Prefetch Files Created

• AT.EXE (scheduled jobs/tasks)
• SCHTASKS.EXE (scheduled jobs/tasks)
• CMD.EXE (Obviously common, but I included it anyway. Especially if the prefetch hash doesn't match the legitimate ones. )
• NET.EXE (net view, etc.)
• NET1.EXE (net use)
• NETSTAT.EXE (netstat -ano)
• REG.EXE (reg query and reg add)
• SC.EXE (interact with services)
• SYSTEMINFO.EXE (system profiling)
• TASKKILL.EXE (kill running processes)
• TASKLIST.EXE (tasklist /v)
• POWERSHELL.EXE (interact with powershell)
• NBTSTAT.EXE (profile)
• XCOPY.EXE (copy files around)
• NSLOOKUP.EXE (profile)
• QUSER.EXE (profile)
• RAR.EXE (Exfil or Tool dropping) * And other archive utilities (Ex. 7zip)
• PING.EXE (check connectivity)
• FTP.EXE (download/upload)
• Various Sysinternal tools (Psexec, sdelete, etc.)
• BITSADMIN.EXE (download/upload)
• ROUTE.EXE (adding persistent routes)
• REGSVR32.EXE (services)
• MAKECAB.EXE (compression before exfil)
• Then obviously the name of any malware they use: .EXE

You will also see System Internals (ex. PsExec), various archiving tools (ex. winrar), etc. used as well but they often times rename them. Look at prefetch files for odd/suspicious names. Also keep an eye out for the prefetch hash value after the name as this can indicate a file was executed, but from a different location. For example, if cmd.exe was run from system32 and from %temp%, or even SysWOW it will have different prefetch hash values.

I will also quickly add that with the new(er) version of PsExec you can rename the PsExec service name (via -r) that's created on the remote host. This is something to keep in mind if you're looking for static naming conventions.

Event Logs

• 4624 Type 10 Successful Logon via RDP/Terminal Services
• 4624 Type 3 Network Logon
• 4648 Explicit Credentials (Ex. Run As - Priv. escalation)
• 4688 Process creations
• 4778 RDP Session connected and reconnected
• 4779 RDP Session disconnected
• 106 Registered a task (has user name) at.exe
• 140 Updated a task (has user name) * schtasks.exe
• 129 Launch action
• 201 Successfully completed a task
• 602 and 4698 (scheduled Task was Created)
• 7035 Service was successfully sent a start/stop control (Look for PsExec here)
• 7036 The service entered the running/stopping state
• 7045 A service was installed in the system (Look for PsExec service installs)
• 24/25 Remote Desktop Services: Session has been disconnected / Session reconnection succeeded
• Powershell Logs - Here is a script I wrote to parse out any .ps1 files run that were logged to the Powershell evtx files. You will need Powershell 3.0+ for this to work.

You can download a Python script I wrote to parse task scheduler evtx files here.

RDP Artifacts

• Default.rdp created (Hidden file in My Documents)
• %appdata%\Microsoft\Terminal Server Client\Cache\bcache22.bmc
• Event log entries (see above)

Networking

If you allow host-to-host communication, most likely they are simply moving around via SMB shares, pass-the-hash (mimikatz, Windows Credential Editor (wce), etc.)

• tcp/445
• tcp/135
• tcp/3389 (RDP)

This is where knowing what your systems do/are is important. RDP to a terminal server might be, ok but RDP between someone in Accounting and HR isn't a good thing (normally).

Registry

• NTUSER and Software Run Keys (don't forget about Wow6432Node keys)
• Services
• MountPoints2 (##ServerName#ShareName)
• Mount Network Drive MRU (WinXP)
• SysInternals Key (populated when EULA accepted)
• Archive Locations (WinZip, WinRar, 7-zip, etc.)
• ShellBags

There are MANY other places to hide (BHOs, Winlogon, App_Init, Shell, Active Setup, etc.) and tons of other artifacts created within the registry when malware/people run malware/perform lateral movements, but i'm only listing the more commonly used ones related to lateral movements (not persistence). The registry alone is 20+ blog posts so i'm trying to stay focused on just a few common areas (at least from what I personally see).

Jobs/Tasks

• Scheduled Tasks/AT Jobs for persistence and execution of malware
• See Event log entries above

Services

• Specifically Start Type 2 (auto-start) with Type 10
• Also look for ones that have ErrorControl set to 0x0.
• They will sometimes have weird names but sometimes they will have very convincing names
• Look for anything not running within System32 (autoreg-parse will do this for you)
• If it's in System32 they more than likely time stomped it so you won't see it without comparing $SI and $FN times. It's possible they only stomped the modification time to fool you when viewing it inside Windows Explorer. Add the "created" column in Windows Explorer before moving on to the the master file table (MFT).
• More than likely it's not signed

File Names

Not fool proof, but they like to use 1 - 3 character file names. This includes renamed tools, key logging logs, archived exfil data (ex. 4.rar), etc. Watch out for these. It doesn't mean they are malicious, but just something to make note of. A good place to look for these files names are within AppCompatCache.

Malware often Hides/Executes from

• %temp% (root)
• %temp%\ (a lot of times with single letters/numbers - %temp%\1_malare_
• %appdata%
• %localappdata% (Win7)
• %systemroot%\System32
• %systemdrive%
• %programdata%
• %allusersprofile%
• %commonprogramfiles%
• Recycle bin
• Startup Folder (As .vbs or .lnk)
• Replace startup folder location in registry
• Replaces system files that already have persistence set in the registry

Example

So here is an example of how this all might play out.

• Machine gets owned
• systeminfo (or some other system profiling command(s))
• tasklist /v
• net view, netstat, etc.
• cd c:\
• dir
• reg query \CurrentVersion\Run
• Downloads some malware/tool kit
• reg add \CurrentVersion\Run /v malware.exe (or sets some other kind of persistence)
• archives some stuff up
• exfiltrates it
• escalates privs (if not done already)
• moves around your network (net use, psexec, etc.)
• steals more stuff
• repeats this for a year until you detect it or someone calls you.
• you take months to fix it (if ever)

Summary

By now you might be thinking, "That's all great, but that stuff happens all the time within my environment. Our System Administrators and Help Desk do that kind of stuff all the time." You're right... That is why they (read: attackers) do it.

No one said it was going to be easy. If you want easy, find a red light district.

I was on a case the other day and I could see the malware dropped, At jobs created (typical), then I went to work on parsing the job files and noticed two of them were pointing to what appeared to be gsec dumper tools dropped into System32. I went back into the MFT and couldn't find anything. The compromise happened March 2013, so there were no A/V/Application logs (assumed maybe A/V deleted them), nothing in the MFT, etc. BUT.... when I searched for the exe names in the MFT I got some hits. I got hits because I wrapped in the SOFTWARE hive and LANDESK (www.landesk.com) happen to be installed on the system. Before this I had never heard of LANDESK so I did a quick Google. It sounded Interesting.

Then I started digging into the entries in the registry. Here is a quick run down on some of them. I only had two registry hives to play with so consider this a WIP still. I'll update here if anything changes. I need to get a trial downloaded.

Here is a rough break down of the entries (I noticed there were some options for custom entries - so this can change from system to system.):

Interesting Keys

amtmon (Hostname and IP Address values). This was only on one of the two hives I looked at so I am not sure if this is optional or what.

MonitorLog (software/malware)

I don't know what the exact requirements, or conditions that need to be met in order for software to get added to this list. Again, i've only seen this tool once. There were what appeared to be over 100+ entries though.

In either case, you can see the path to the software.

• Key Value (C:/Windows/System32/gsec.exe) = Last Write Time
• Last Started (Time value): Last time the program was executed.
• First Started (Time value): I'm guessing first time it was seen.
• Total Runs (Number): Number of times the application has been run.
• Current User (Username): The user account used to execute the software/malware.
• Total Duration (Number): Total time application has been run is what it appears to be.
• Last Duration (Number): Time elapsed when the application last ran.

Logons

User Logons (Username/Time). You can see the value names are actually times. Then the values contain the username of the person that logged in. Where you see groups that also contains what appear to be all of the groups they belong to.

I am still exploring this set of artifacts, but they seem promising. It's almost like a prefetch file in the registry.

In the meantime I wrote a python tool for parsing these entries. You can download it here: Landesk Registry Entry Parser.

Ok, so I am taking a bit of a different direction and I am writing a quick post on interviewing. I don't claim to be an expert in conducting or participating in them. I have; however, conducted what seems like 100+ interviews over the last 14 months and I noticed some common trends and figured I would write them down for people looking to better their skills. I'm not going to cover technical topics, just some thoughts, suggestions, etc.

CAUTION: People conducting interviews are unique so I don't claim this to be a solution for everyone. Some of the things I do/like to hear from someone might actually turn others off. This is how; "I" look at it. There is no foolproof way, but "I" do think some of the items below can help you gain an advantage over others. At the very least make my life easier when i'm interviewing you.

First, let's put things into perspective on what "I" think about interviews and how "I" conduct them. I also included a bit about me and my personality to give you and idea of what kind of a person I am. This may help you understand why I like certain things and dislike others.

• I'm 32.
• I'm not "old school" in the traditional sense.
• I'm pretty laid back. More than most.
• At the time of writing this post I was not the sole-decision maker for hiring actions. My input was valuable to the decision (especially for my region - APAC), but was a combination of feedback from multiple sources.
• I do not conduct "formal" interviews. I prefer real conversations. On par with what you do with your friends.
• I prefer Skype and Webex interviews more so because I interviewed people from all over the world. We also do a lot of remote work so it makes sense at some level.
• I try and be 100% honest. If parts of the job suck/may suck I will tell you. I will usually tell you before you even ask me about it.
• I will typically turn the interview into a training session if I get the vibe you're not going to be a good fit. I've been known to send PDFs, URLs, etc. over Skype to people during interviews in an effort to help them grow. I've sent follow up emails as well. I try and get back to everyone, but sometimes I let HR do it. I also get busy.
• I've told people to go study for a few weeks and come back and we can chat again. Some people do it and some don't but at least I gave them a second chance.
• What I want to know is whether or not you can actually do the work. You can always Google for the specifics.
• I feel people put too much emphasis on verbal knowledge. I know a lot of book smart people who can't do shit.
• I don't ask riddles. I think they are stupid.
• There should be some hands-on at some stage of the interview process. I get there there is time issues. Reserve this for your final 2 - 3 candidates. If you're not willing to invest time in finding a person to join your team you're also likely not going to invest time in keeping them happy when they get there. Not everyone is good at verbal interviews where they might be really good at getting the job done, which includes myself.

The items below are in no specific order. Just some random thoughts off the top of my head where I see people doing things I don't particularly care for.

• Job descriptions. Don't trust them. They are rarely accurate from what actually goes on day-to-day. Effort is made to write them accurately, but things do change and the business goes where the money goes. This is where you should ask me what a normal work day/week/month is like. Don't be scared to ask deeper questions on this part. At the end of the day you're working 8+ hrs here week after week. You have a right to know what goes on. If the person doesn't tell you or is vague the job likely sucks. Move on....
• Likes and Dislikes. If I ask you what you don't like be honest with me. I know people don't like certain things. If you don't like documenting then tell me. I might tell you that unfortunately 20% of what you do is documentation, but you're better off finding out during the interview than when you join the company. When you say, "I like everything" I know you're lying. Be careful here though. Don't give me a list of 10 things you dislike. At times you need to suck it up and do what's required.
• Linkedin. A lot of recruiters use Linkedin. It's possible I might even look at your Linkedin profile if it is listed on your resume. Make sure the picture you use is professional, or at least not you smoking a cigarette throwing a peace sign (i've seen it). Clients WILL search your names out and find you on Linkedin. They do to me all the time and I shouldn't have to tell you that it is unprofessional to have such pictures there. Keep them on Facebook.
• Relax, and get comfortable. Talk to me like you talk to your friends. I don't want to know the fake person you become during an interview to impress me. I want to know the real you. Be open and let's have a good conversation.
• Time Don't be late. If you're going to be late text me, tweet me, email me, etc. This is an automatic failure if I don't hear from you. However, if you let me know you're going to be late then I pretend it didn't happen. No harm, no foul. Shit happens. This applies to the person conducting the interview. Have some respect for their time as well.
• Can you hear me? Really...? You couldn't find a quite place to chat? Most interviews are scheduled. If you can't find a quite place within 3 - 4 days you got issues. I also don't like to be placed on speakerphone. If I keep saying, "hello, can you hear me..hello...hello.." there is a problem. Ask to call me back from a quieter place. I shouldn't have to tell you I am going to call you back because it's too loud.
• Resume. You know if you're not qualified. Don't overstate your resume. We are not stupid. We wouldn't be the ones tasked with interviewing you if we didn't at least know something. You will likely fool HR, but you wont fool us. I get the fluff thing and trying to stand out, but be reasonable. A bit of fluff i'm cool with. We have all done it and it shows you know how to play the game.
• Be honest. Please don't waste my time. I don't expect you to know everything. I don't know everything, how can I expect you to know it all? If you don't know, say "I don't know". You will typically make yourself look worse trying to come up with something. Example: When I ask about search order hijacking and you think i'm talking about search engine optimization (it's happened more than once). I respect people that say I don't know. I don't like people that always think they know everything.
• Ninja vanish quickly. If you're not a ninja don't put, "Malware Ninja" on your resume. It's not cute, and it's a bit arrogant. Especially when you're not even a brown belt. I'll likely make your interview much harder than I normally would. It's a double edge sword and ninjas don't cut themselves with their own swords.
• Staying current. When I ask you what blogs, news, etc. you follow to stay current with research, etc. don't tell me, "ISC2 news feeds". I've never received anything useful from them so I know you haven't either. I also use RSS feeds for my news, but I know some of the better sites inside my feed. I don't believe you when you say, "I forgot. I just use RSS feeds." To me that means you don't actually read up on things and stay current with trending threats/research.
• Invest in yourself. If you're not going to be spending time after work hours to become good at this (any) field you likely wont succeed unless you're a very gifted individual. I suggest you look for another career path that isn't quite so demanding. This goes for older people as well. You're never too old to learn something new. I'm likely to give you a free pass if I see you will put in extra effort to get up to speed on things. If you're an 8-5 and spend no time outside of the office i'll likely pass you up for someone else.
• We are Global now. If you haven't realized we are a global world you're likely not on this planet. You are no longer competing among people in your own country anymore. That talent pool just got bigger and a hell of a lot harder. With Skype, Webex, and International airports it's only going to get harder still. Kids in countries such as Asia don't play basketball and football after a weak 6 hour school day. They are going to secondary schools learning hard sciences and math. They also speak multiple languages (including English). If your parents haven't yet, let me welcome you to the new world.
• *Memory forensics. *If you don't know anything about this yet you're likely not going to be selected. There is no reason you haven't at least taken a memory image of a system and run Volatility and/or Redline against it.
• College isn't everything. I don't mean college is a bad thing, but if you're a new graduate and you haven't made any effort to better your skill set outside of going to college courses you're also likely not going to be selected. You will never have as much free time in your life so if you can't find spare time to research, study, etc. during college you're likely never going to do it and I don't want someone who doesn't want to get better.
• Coding. This is for the older guys. You're going to be passed up by the younger generation who is growing up learning how to program. For the younger generation. Learn to code.
• Blogs, Github accounts, etc. show that you're at least interested in learning more. It's not a job requirement, but it's nice to see when people have these things listed on their resume. Especially new graduates with not a lot of real work experience.
• Certifications. Don't mean much.... Sorry. They are nice to see and show a bit of motivation, but i've seen too many people with certs that are no good so I don't read too much into them.
• Small world. It's a VERY small world. Don't be stupid and get a bad name by doing dumb things. I can't express enough how small of a world it is. I've traveled all over it and lived in multiple countries. You never know who you will run into. You also never know when a positive referral will help you or a bad one will hurt you.
• Linkedin. I'm torn on this one actually, but i'll bring it up anyway. I don't personally like when people add me on Linkedin until after we hire/pass on you. You searched my name out because HR told you who you would be interviewing with doesn't really mean you should add them as friends before the interview process is over. I get it, as you want to network, etc. but maybe give it awhile until the decision is made. Then make an effort and let me know why you want to add me. For example, "I understand I didn't get the job, but I'm going to study, etc. and I would like to stay in touch for when i'm ready, etc. I also notice that you blog and I figured this would be a good location where I could find other posts/comments you make." Something to that affect. It's not Facebook so please apply some reason.
• Prefetch and Run Keys. Please read up on artifacts other than prefetch and run keys. When I ask, "what are some artifacts you can use to identify program executions on a system BUT let's assume prefetch files are turned off." Please don't tell me prefetch files and then pause without knowing any other ones. Likewise, there are more persistence mechanisms than "run keys".

There are others, and i'll add some more as I think of them, but I wanted to write down a few items I feel people tend to get wrong and then just some general tips/comments/words of advice.

Happy interviewing.

In a previous post Build your own NSRL Server I showed people how to get a NSRL server setup so they could filter out whitelisted hashes from md5deep output. I found that I didn't like that method and never really used it. I had plenty of RAM, so I kept for-looping through my text file of whitelisted files. It was slow, but I ignored it because I usually kicked it off and went working in parallel on other stuff. But then I figured, why not setup an API? So I set one up with 12 lines of code using Flask and Python. I don't even know if you can call it an API, but we will because I don't know what else to call it.

You can get the Code here Whitelist API

Here is the workflow I more or less follow:

• Open the api_code.py file and edit it with your details.
• python api_code.py
• I run this server portion of code on a 4th Gen Intel NUC i3 running Ubuntu, 250GB SSD and 16GB of memory. The NUC is portable enough I could (if I wanted) take it with me on-site. I also run Elasticsearch/Logstash/Kibana (ELK) on it. It works great for a mini-SIEM.
• md5deep.exe -z -r -l -o e -s "%SystemDrive%\*" > hashes.txt
• This is automated via an IR collection script, but you could just as easy do this against a mounted image as well.

Output

• _file_size_  _hash_ _file path_
• python vt_api_white.py -f hashes.txt > hashes.csv
• VT API Code

Output is a csv file with four columns

Usually people at this point are saying, "well, yeah, but you still have a lot of files to review". Sure, you are right, but i've found that this process filters out around 75%+ of any random system just from the whitelist alone.

After filtering via the API, I am typically left with something around 800 - 4,000 remaining hashes, which is pretty good considering my whitelist is; 3.5 GB. I use NSRL (only the md5 hashes), Mandiant's Readline whitelist, and then some stuff I have done on my own.

A real/recent example: I had an initial list of 27,323 hashes from a system. After filtering against my API I was able to get that number down to 4,174. After taking the 4,174 remaining hashes and bouncing it against VT while also filtering out the 0 hit VT entries and only looking at >= 1 hits and files not previously submitted I was down to 47. So we went from 27,323 down to 47 in about 20 - 25 mins.

One of the the 47 was 27/54, one was 9/50, two were 1/55, and 43 were non-scanned/submitted (unknown to VT). Of those 43 unknown, 3 were PUP/malware in the users download folder.

As analysts, we don't have time to review 27,323 entries or even 4,174, but if we can get the number down to 47, or even a couple hundred. That's a heck of a start. Then add on the fact that it's all automated. It's a win-win.

Is it always helpful? No. But it works when it does.

Example output if you query direct:

{ "in_set": true, "md5_hash": "392126e756571ebf112cb1c1cdedf926" }

{ "in_set": false, "md5_hash": "392126e756571ebf112cb1c1cde00000" }

If you have code suggestions drop me an email. At some point I would like to make it more robust.

Businesses of all sizes seem to be moving at least some operations to the cloud. It’s only a matter of time before you get a phone call asking you to conduct some kind of cloud forensics and/or incident response.

Why wait for that phone call before you start diving into the "know how" of conducting it. I figured why not explore a few common scenarios over a series of blog posts and take a look at some of the tools and techniques we as analysts can do to make it easier on ourselves when we receive that phone call.

PART I - Snapshot Suspect System

Let's start off with a scenario. Client is running an <insert_purpose> server on Amazon's cloud. It gets compromised, or they think it's been compromised. Let's say they are running; " Microsoft Windows Server 2012 with SQL Server Standard - ami-a09d30c8". It's running default MS SQL - 1433 and RDP - 3389.

It looks something like this:

So you got the call, you signed your statement of work, and you're ready to begin. In parallel we will start with the following:

First, have the client halt what they are doing and have them take a, "snapshot" of the system ASAP. You can do this as follows:

• Go to Instances - Write down the Instance-ID of the system of being compromised. In this case we can see from above it's i-54fecdbf.
• Go to "Volumes" under Elastic Block Store. Write down the Volume ID of the instance id above.
• You can see here in the image that: Instance ID:i-54fecdbf and Maps to Volume ID: vol-2364126b

• Go to Snapshots on the right hand side under Elastic Block Store.
• Click, Create Snapshot and fill out the proper information in the box.

• Now your snapshot will be created in a few mins. Once it's created, right click it, and select, Create Volume

• Now you need to create a Volume from this snapshot. You will need to configure the Type (SSD, Magnetic, etc.), Size of the Volume and then specify the availability zone. The zone should be in the same location as your suspect system. In this case, us-east-1a.

• Now navigate to the Volumes on the left hand side under, Elastic Block Store. You should now see your Volume in there.

• Write down the Volume ID: vol-3f5c2a77
• Now before we do anything else let's move to Part II.

PART II - Analysis System Creation

Now, we have our snapshot and volume created. We do that first for evidence preservation. I skipped memory collection as the real Part I, but i'll get into that in another post. Let's just assume we already collected memory from the live system and now we are moving to analyze the HDD.

We now need to build our analysis system.

Navigate back into your AWS console and then click the, EC2 link under, Compute Networking.

Then click, Launch Instance.

The obvious choice is Ubuntu (Ex. Ubuntu Server 14.04 LTS (HVM), SSD Volume Type - ami-9eaa1cf6). Click, Select then choose your specs. I went with a m3.large, but if this was a real case maybe I would want something larger/more powerful to process/analyze.

Whatever fits your budget. The m3 large is $0.14 an hour pricing so it's very cheap so no need to hold back on specs for a few days work IMO.

When you're launching your Ubuntu analysis system make sure you select the same geographic region. If you see above our SQL server instance is located in us-east-1a, so we will want to have ours be the same. There are some ways around this that i'll get into at the end of the post, but for sake of argument let's just do this.

After this you will need to configure your security keys, and if required (and suggested) lock down the IP addresses allowed to access your new analysis system. I locked down SSH to my remote IP address.

Now you should have something like this with our Forensics Analysis System being the one we just created.

Now we want to log into the analysis system and start configuring it. Do the following - I'm using Linux to ssh into it, but putty, etc. will suffice:

• chmod 400 name.pem
• ssh -i name.pem ubuntu@yourpublicdns
• yes
• sudo apt-get update
• sudo apt-get upgrade
• y
• wget https://raw.github.com/sans-dfir/sift-bootstrap/master/bootstrap.sh
• sudo bash bootstrap.sh -i
• Wait for about 30+ mins.

• Installation Complete!

• You may get an error when you try running log2timeline.py (EwfFile requires at least pyewf 20131210). I don't know why, but just do the following to get it working again:

• sudo apt-get autoremove libewf2 (not sure if that's 100% solution, but it worked)

So yeah, congrats. You now have a functional SIFT 3.0 analysis system in the Amazon EC2 cloud. Let's go ahead and create an AMI from it.

• Go to Instances on the left hand side.
• Right click the instance you want to create an image from.

• Configure the settings and create it. If you want to add additional storage go ahead, but I choose to do so when I need it vs. pre-allocating it.

• Now if you go into AMIs you will see your image. This is pretty much like having a deployable SIFT 3.0 image in the cloud ready at anytime.

PART III - Analysis

Ok, so now we have our snapshot of the suspect system and it's respective volume. We also have our analysis system and we have created an AMI of our SIFT 3.0 analysis system so we can revert to a clean image if/when we want. Do the following:

• Navigate to Volumes under Elastic Block Store (left hand side).
• Right click our Volume from earlier (vol-3f5c2a77) and click, Attach Volume.

• Click, Attach

Ok, now it's attached. Let's SSH back into our analysis system.

• ssh -i name.pem ubuntu@yourpublic_dns
• sudo fdisk -l
• Disk /dev/xvdf: 53.7 GB, 53687091200 bytes
• sudo md5sum /dev/xvdf
• 55342cdb2fb7d3787648a7e11bb3156c

You could do a couple things here. You could DD the image to another attached volume and have Amazon ship it to you, download it, or you could simply mount it and analyze it in the cloud. As long as you can prove the integrity I see no issues analyzing it in the cloud. It's also cheaper.

Mounting the Drive

• mkdir suspect_mount2
• sudo mmls /dev/xvdf

Units are in 512-byte sectors

Slot Start End Length Description
00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
01: ----- 0000000000 0000002047 0000002048 Unallocated
02: 00:00 0000002048 0000718847 0000716800 NTFS (0x07)
03: 00:01 0000 718848 0104855551 0104136704 NTFS (0x07)
04: ----- 0104855552 0104857599 0000002048 Unallocated

512 * 718848 = 368050176 (system partition)

• sudo mount -o ro,noexec,showsysfiles,loop,offset= 368050176 /dev/xvdf suspect_mount2
• ls suspect_mount2

Building a Timeline

• sudo log2timeline.py -o 718848 suspect.dump /dev/xvdf
• py -z UTC suspect.dump suspect_timeline.csv
• Timeline: suspect_timeline.csv

So at this point you can pretty much do what you want with the system. It's mounted as read only.

Reference

SANS DFIR Slides - Incident Response and Forensics in the Cloud w/ Paul Henry

I released a tool called, Python Registry Parser (or regparse for short), which is a plugin based Windows Registry parser written in Python.

Main reasons for writing regparse

• I don't like the output that current registry parsers (Gui/non-Gui) provide.
• I like RegRipper, but didn't want to learn Perl.
• I wanted to improve my Python skills.

Tool choice is subjective. There is no perfect tool for everyone. Most people just live with the shortfalls of tools and adjust their analysis process as needed. Whether it's poor output, Gui vs command line, paid vs. free, etc. That's really more or less why I started down this path. I wanted something that fit my needs and I don't know C/C++/C# or Perl so I couldn't modify some of the ones I did like. This is when I decided to leverage python-registry by Willi Ballenthin and build on-top of it.

So let's take a quick look at regparse and some of its features and you can decide for yourself if you think it's useful or not. If not, no harm, there are plenty of other really good registry tools out there.

Help

regparse.py -h

usage: regparse.py [-h] [--plugin PLUGIN] [--listplugins] [--plugindetails] [--hives [HIVES [HIVES ...]]] [--search [SEARCH [SEARCH ...]]] [--format format] [--format_file format_file] Parse Windows Registry hives.
optional arguments:
-h, --help show this help message and exit --plugin PLUGIN Specify plugin to run. --listplugins Lists all of the available plugins. --plugindetails Lists details available plugins. --hives [HIVES [HIVES ...]] Registry Hives. --search [SEARCH [SEARCH ...]] Provide a search value and search the hive(s). --format format Custom output. --format_file format_file Custom output template.

Listing Plugins

regparse.py --listplugins

activesetup appinit
bhos
knowndlls
mounts
recentdocs
runkeys
runmru
services
sysinfo
sysinternals
terminalserver
typedpaths
typedurls
usbstor
winlogon
wordwheel

So far I have around 25+ plugins written. I am in the process of rewriting them to accept the new user defined output and I will be posting them as I update them. I'll post them on GitHub.

Plugin Details

To get details about the plugins you can do the following.

regparse.py --plugindetails

ACTIVESETUP

*Plugin:    ACTIVESETUP
Author:     Patrick Olsen
Version:    0.5
Reference:  http://sysforensics.org
Print Fields:   "{{ last_write }}|{{ key_name }}|{{ stub_path }}"
Description:    Parses the SOFTWARE hives and returns Active Setup entries.*

APPINIT

Plugin:     APPINIT
Author:     Patrick Olsen
Version:    0.1
Reference:  http://sysforensics.org
Print Fields:   "{{ last_write }}|{{ key }}|{{ loadapp_data }}|{{ appinit_data }}"
Description:    Parses the SOFTWARE hive and returns AppInitDLL entries.

BHOS

Plugin:     BHOS
Author:     Patrick Olsen
Version:    0.2
Reference:  http://sysforensics.org
Print Fields:   "{{ clsids_lastwrite }}|{{ value }}|{{ inproc_lastwrite }}|{{ data }}"
Description:    Parses the SOFTWARE hive and returns Browser Helper Object entries.

KNOWNDLLS

Plugin:     KNOWNDLLS
Author:     Patrick Olsen
Version:    0.4
Reference:  http://sysforensics.org
Print Fields:   "{{ last_write }}|{{ name }}|{{ value }}"
Description:    Parses the SYSTEM hive and returns Known DLLs.

MOUNTS

Plugin:     MOUNTS
Author:     Patrick Olsen
Version:    0.4
Reference:  http://sysforensics.org
Print Fields:   "{{ last_write }}|{{ name }}|{{ value }}"
Description:    Parses the NTUSER and SYSTEM hives and returns mount points (MountPoints2, Map Network Drive MRU, & MountedDevices).

RECENTDOCS

Plugin:     RECENTDOCS
Author:     Patrick Olsen
Version:    0.2
Reference:  http://sysforensics.org
Print Fields:   "{{last_write}}|{{key_name}}|{{key}}|{{value}}|{{data}}"
Description:    Parses the NTUSER hive and returns RecentDocs MRU entries.

Writing a plugin is very simple. Sometimes just a few lines of code. You can most likely copy 90% of existing plugins I have written. If you can't write one, or don't want to, but think one would be useful just add an issue via Github and I will write it for you. Plugin requests go to the top of the priority. If it's something unique I might need a sample hive. If that's the case I can sign a NDA if required. I have no problem with doing that.

Example Output

This section is going to be a bit longer because output was one of my biggest issues with some of the other tools available.

Coming to the realization that not everyone will be happy with any output I choose as the default I decided to use user defined output as the default.

What is user defined output you ask? It's exactly that. You (the user) defines what the output will look like.

I got the idea from Willi's list-mft.

We will use the services plugin as our example. If you do a regparse.py --listplugins you will see that services has the following variables we can use:

{{ lastwrite }}|{{ keyname }}|{{ imagepath }}|{{ typename }}|{{ displayname }}|{{ starttype }}|{{ service_dll }}.

So in all for services you have a total of seven fields we can choose from and customize.

First up we can define the output as standard CSV format via commas.

regparse.py --plugin services --hives SYSTEM --format "{{ lastwrite }},{{ keyname }},{{ imagepath }},{{ typename }},{{ displayname }},{{ starttype }},{{ service_dll }}"

• 2010-11-21 03:29:41.027386,1394ohci,systemrootsystem32drivers1394ohci.sys,1,1394 OHCI Compliant Host Controller,3,None
• 2015-02-28 03:48:46.640400,ACPI,system32driversacpi.sys,1,Microsoft ACPI Driver,0,None
• 2010-11-21 03:29:41.027386,AcpiPmi,systemrootsystem32driversacpipmi.sys,1,ACPI Power Meter Driver,3,None*

Let's say you want the last write of the service key, only the service dll path, and no entries that have system32.

regparse.py --plugin services --hives SYSTEM --format "{{ lastwrite }}|{{ servicedll }}" |egrep -v '(S|s)ystem32'

• 2015-01-12 18:52:47.224211|%ProgramFiles%Windows Defendermpsvc.dll

Let's say you don't like commas and you want abcdefghijk between each value for some weird reason. Maybe it makes running awk -F'abcdefghijk' easier to run or something?? You simply define it at run time like this:

regparse.py --plugin services --hives SYSTEM --format "{{ lastwrite }}abcdefghijk{{ servicedll }}"

• 2009-07-14 04:54:53.422861abcdefghijk%SystemRoot%System32dnsrslvr.dll
• 2009-07-14 04:54:09.493183abcdefghijk%SystemRoot%System32dot3svc.dll
• 2009-07-14 04:54:32.191223abcdefghijk%SystemRoot%system32dps.dll

Lastly, let's say you don't want to type anything into the command line for whatever reason. You can use a prebuilt, or (custom) template by using the --formatfile templates/nameyoupick>.html.

Here is an example of a simple html template I created for the runkeys plugin. As you can see with Jinja you are able to conduct loops, etc. within an HTML page and it will render as necessary the output as you will see.

!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html lang="en">
<head>
<h2>Windows Registry - Runkeys Plugin</h2>
</head>
<body>
{% block body %}
{% for item in runkey_list %}
<strong>{{ item[0] }}</strong>
<p>{{ item[1]|indent(4, true) }} {{ item[2]|indent(4, true) }}</p>
<blockquote><li>{{ item[3]|indent(4, true) }}</li></blockquote>
{% endfor %}
{% endblock %}
</body>
</html>

regparse.py --plugin runkeys --hives SYSTEM NTUSER.DAT > test.html

Now all you need to do is open test.html and you have a rendered webpage with your runkeys plugin results. You could expand this to be a table, chat, etc. Pretty much anything you can add to a website you could include in your output template. Heck, if you have standard reporting templates you could have it generate the correct format for you on the fly. This is an area I plan to expand on when I get some spare time.

Summary

Outside of that it's pretty self explanatory. It parses Windows registry hives.

If you want to help improve what I have so far I welcome you to do so. Just open up an issue on GitHub, and if you're not a GitHub user just hit me up offline. That goes for plugin ideas, plugin development, etc. too.

Happy hunting and I hope you find this useful.

I was playing around with WinZIP today and noticed something and wanted to write it down before I forgot to document it. I still need to do some analysis, but wanted to make it known if it wasn't already.

This has to do with the following WinZIP registry entry: Software Nico Mak ComputingWinZipmruarchives most recently used registry entry.

While writing a new plugin for my python-regparse tool that I released and blogged about yesterday I noticed that my old plugins were not parsing the data correctly. Then I ran a few more well known tools and in one case didn't see some of the entries at all, and in another case saw the entries, but no context was provided.

Here is what a sample entry looks like within:

SoftwareNico Mak ComputingWinZipmruarchives

You will see in the image the MRUList.

01 00 00 00 = The order in, which I did my test was: 01 and 00 with 01 being the second entry, or the "most recently used" one, which would then inherit the last write time of SoftwareNico Mak ComputingWinZipmruarchives (03/08/2015 21:56:56.804 UTC).

Testing MRU entries start getting overwritten when they reach 15 (0 - 14).

Let's look at the following:

0 - REG_SZ C:UsersLabDesktopParent.zip

Then you will see the corresponding xd name (xd0). Let's break it down:

0|ChildFolder1:ChildText1.txt:ChildText2.txt:ChildText3.txt:EXEforsize509440Bytes.exe|5|234285:509440||

0 - Unsure - It's not a 1:1 mapping based on names. ChildFolder1 - Folder I added for reference. ChildText1.txt - File I added for reference. ChildText2.txt - File I added for reference. ChildText3.txt - File I added for reference. EXEforsize509440Bytes.exe - File I added for size reference. 5 - Five files within the Parent.zip 234285 - Unsure what this is. It doesn't match the archived size of Parent.zip. The size of Parent.zip archived is 234,933 bytes (648 byte difference). It doesn't match the unarchived size either. 509440 - Over all size of the files within the Parent.zip unzipped. You will see that it matches the EXE reference, with all other files being 0 Bytes.

0|Parent.zip|1|234933:234933||

0 - Unsure Parent.zip - Name of file 1 - One file. 234933 - Here the sizes match, but in our previous example these two numbers didn't match. There was a 648 byte difference. I'll need to do some more testing to figure this one out. 234933 - Size of Parent.zip

7z gave different results.

0|509440Bytes.exe:ChildText1.txt:ChildText2.txt:ChildText3.txt:ChildFolder_:Paren|6|180814:509440||

0 - Unsure EXEforsize509440Bytes.exe - File for reference ChildText1.txt - File for reference ChildText2.txt - File for reference ChildText3.txt - File for reference ChildFolder - File for reference, but truncated. Paren - Parent.zip (the parent folder) 6 - This time it shows 6. It appears to have counted the Parent folder and also truncated it to Paren. So Parent.zip -> Parent 180814 - Unsure size doesn't match anything (better compression vs. WinZip though) 509440 - Unarchived size

Obviously more testing is necessary.

Anyway, I just wanted to jot this down. If you're simply relying on the output of a tool you're possibly missing some good information. This was a very quick analysis. I hope to get some more time in the next few days to do a more thorough check. Feel free to shoot me an email if you (or know of another source) that has done some of this already. I more or less ignored Google on this one.

Update 8APR15 - Works on .msg files now.

I wasn't going to write a blog post on this, but figured I would go ahead and share it anyway.

I often find myself searching VirusTotal for tag:email and checking out the various phishing emails that get posted to VT.

Well, today I had some of my Yara rules trigger on some various domains that I track in the To: line.

So I downloaded them and then I am left trying to pull out the attachments and decode them so I can perform analysis. That's when I saw the email module for Python and started playing around with it.

An hour or so later I came up with extachment.py (extract attachments). So far i've only tested it on 25 emails that I pulled down on VT and some test emails from Outlook for Mac. It works especially well under a controlled environment where you know you have legitimate eml files and not just an upload text file in VT marked with an email tag.

Having said that, if you run into any errors just let me know and i'll see what I can do to fix the code, or if you have any ideas on how to improve it i'm all ears.

Help

python extachment.py -h

usage: extachment.py [-h] [-p PATH] [-o OUT] Attempt to parse the attachment from EML messages.
optional arguments:
-h, --help show this help message and exit -p PATH, --path PATH Path to EML files. -o OUT, --out OUT Path to write attachments to.

Here is a sample of the output

I print out the magic so you can get an idea of what the file is. Then I use the attachment name as the file name to save to so you get "real" names and proper extensions. If it's a simple text file you will get something like, "Could not process .DS_Store. Try manual extraction."

python extachment.py -p eml/ -o out/

*Could not process .DS_Store. Try manual extraction.
    Header of file: Bud1*

*Email Name: 04c275b76dabf0cff85119942429e266e09394a1f4b2e47d0459544ae14cf904
    Magic: {\rt
    Saved File as: BL Draft.doc*

*Email Name: 0beb40c866e815f000643064e8d3c2186dd1ca4ad60e3c4757795a56d39a85e5
    Magic: %PDF
    Saved File as: April invoice 963536.pdf*

*Email Name: 1aa085f82eee9b74f4f88b5af03d46a428e15647b99e3a2b73768c1960de0177
    Magic: {\rt
    Saved File as: Order.doc*

*Email Name: 21e6932ec611b3592811104f7e4165edc20ffb9d7c76a1060d597c3724e2c552
    Magic: {\rt
    Saved File as: bluegrill_bus_card.doc*

*Email Name: 2cb553ffe1c898a1b6a586d4c232262d47ae1d390c66581cddf1387303e8ceed
    Magic: {\rt
    Saved File as: Airwaybill#-258-85695.doc*

*Email Name: 423e753de0baad6fc755cb5a1118531ef21825883775c38b3ffdb76a7c360020
    Magic: {\rt
    Saved File as: PRODUCTION ORDER LIST.doc*

Directory listing of the output folder

• 116TRAILDRIVER-3172015123PM.PDF
• Purchase Order.doc
• Purchase Order.zip
• Airwaybill#-258-85695.doc
• bluegrillbuscard.doc
• April invoice 415878.pdf
• image003.png

Sample

xxd out/invoice7Q85M3KYN6YXOLRQOP.doc |head

0000000: 7b5c 7274 6631 5c61 6e73 695c 616e 7369  {\rtf1\ansi\ansi  
0000010: 6370 6731 3235 315c 6465 6666 305c 6465  cpg1251\deff0\de  
0000020: 666c 616e 6731 3034 397b 5c66 6f6e 7474  flang1049{\fontt  
0000030: 626c 7b5c 6630 5c66 7377 6973 735c 6663  bl{\f0\fswiss\fc  
0000040: 6861 7273 6574 3020 4172 6961 6c3b 7d7b  harset0 Arial;}{  
0000050: 5c66 315c 6673 7769 7373 5c66 6368 6172  \f1\fswiss\fchar  
0000060: 7365 7432 3034 7b5c 2a5c 666e 616d 6520  set204{\*\fname  
0000070: 4172 6961 6c3b 7d41 7269 616c 2043 5952  Arial;}Arial CYR  
0000080: 3b7d 7d0d 0a7b 5c2a 5c67 656e 6572 6174  ;}}..{\*\generat  
0000090: 6f72 204d 7366 7465 6469 7420 352e 3431  or Msftedit 5.41  

I added some support for parsing .msg files, which are in OLE2 structured storage file format.

OLE2

*Email Name: emails/Resume.msg
    Magic: %PDF
    Saved File as: Resume.pdf*

*Email Name: emails/Resume.msg
    Magic: �PNG
    Saved File as: DD744063-E192-47B2-98FA-36E554EF627A[193].png*

Hopefully it's useful. I sort of just started playing around and found that it could be useful so kept going. If there is a better tool let me know. I spent my time writing one vs. looking on Google.

You can download the code from my GitHub

I do not consider these next steps complex but I still wanted to document it because I didn't really find much online except a few Stack Overflow comments here and there and I had it in my draft posts for a few days. So this is my effort to consolidate some information for others to use.

So what's Pyinstaller? According to their website, "PyInstaller is a program that converts (packages) Python programs into stand-alone executables, under Windows, Linux, Mac OS X, Solaris and AIX."

Simply put for those running Windows it takes your .py file and turns it into an EXE file so you can run Python files on your system without needing Python installed.

Unfortunately (or fortunately for job security purposes) malware takes advantage of Python's ease of use and it's ability to be packaged into an exe easily and then subsequently used to pwn people and organizations.

The sample I will look at now is: MD5 (test.exe) = 43adebf0983a5fc74d5b696bcbfd5f93, which isn't anything special. It just happened to be a sample that triggered on one of my VT Yara rules so I decided to take a look at it.

First you will need a couple tools for this little demo.

archive_viewer.py - This will allow you to "expand" the .exe file and see into it similar to how you would with an archive tool to look into a .zip, .7z, etc.

pyinstxtractor.py - This one works more often than archive_viewer.py, so it's good to have a couple to choose from.

I haven't run into any pieces of malware where either one of these didn't do their job. I'm sure there are samples, but I haven't found them yet. Please let me know if you do.

So now, let's take a look.

python pyinstxtractor.py test.exe

Successfully extracted Pyinstaller archive : test.exe

Now in the directory where you ran pyinstxtractor you should have some files. Let's ignore all of them except "test". Open it up in a text editor.

It looks like a blob of junk, yeah? Something similar to this. I've removed some code to conserve space.

from Crypto.Cipher import AES as DvMfw;from datetime import date;from base64 import b64decode as fBPSR;import struct, socket, binascii, ctypes, random, time;from datetime import datetime  
exec(fBPSR("ZXhlYyhEdk=="))  

Let's make it a bit more readable:

from Crypto.Cipher import AES as DvMfw;  
from datetime import date;  
from base64 import b64decode as fBPSR;  
import struct, socket, binascii, ctypes, random, time;  
from datetime import datetime  
exec(fBPSR("ZXhlYyhEdk=="))  

So we can see that fBPSR is actually base64decode, which makes since considering there is a big base64 blob in the code. Let's clean it up a bit more and then run it.

import struct, socket, binascii, ctypes, random, time  
from Crypto.Cipher import AES as DvMfw  
from datetime import date  
from base64 import b64decode  
from datetime import datetime  
print(b64decode("ZXhlYyhEdk=="))  

Now we have some more obfuscated code, but we are getting somewhere.

exec(DvMfw.new("@ZKWogab)$o8Gi1)cA6zo3(.P244jRdn").decrypt(fBPSR("oBpFHK")).rstrip('{'))  

Let's fix it up again. I removed some of the base64 blob to preserve space.

from Crypto.Cipher import AES  
from datetime import date  
from base64 import b64decode  
import struct, socket, binascii, ctypes, random, time  
from datetime import datetime  
print(AES.new("@ZKWogab)$o8Gi1)cA6zo3(.P244jRdn").decrypt(b64decode("oBpFHK")).rstrip('{'))  

And now you have some readable code that you can continue to analyze. I actually watched this person upload this code to VT about 10 times. Ultimately they set the IP to some no-ip domain, but it appeared down/not responding when I attempted to infect my lab machine(s).

So yeah, in case you're curious how this works that's pretty much it. It's pretty simple. This is of course if the attackers aren't using some custom packaging tool and they are relying on stock pyinstaller to build their EXEs.

So I was reading Trend's blog post Without a Trace: Fileless Malware Spotted in the Wild and although not totally new, it got me thinking a bit. I downloaded some of the MD5s they posted and started infecting my lab box. I noticed a couple different behaviors when infecting my lab machine with two different samples.

• As mentioned in the blog: Creations of Rc4Encoded32 and Rc4Encoded64 registry values in HKEYCURRENTUSER\Software\Microsoft\Active Setup\Installed Components{Bot GUID}
• A couple of the hashes created a Software entry: Software\ xsw\binaryImage32 and the data was an EXE.

How the malware uses these blobs of data is not the objective of this post. You can read the Trend blog for that information.

Both entries were binary blobs and were large relative to everything else I had in my test hives so I wondered how feasible it would be to recurse through a hive and return any entry larger than a user specified size.

I started writing some Python code and came up with: reghexdump (i'm terrible at coming up with script names). You can download the code here from my GitHub page.

Let's take a look at what I ended up with.

Help

python reghexdump.py -h

usage: reghexdump.py [-h] [--hive HIVE] [--size SIZE] [--write WRITE]  
Parse Registry hive looking for malicious Binary data.  
optional arguments:  
  -h, --help     show this help message and exit
  --hive HIVE    Path to Hive.
  --size SIZE    Size in bytes.
  --write WRITE  Write the binary values out to a directory.

Output - No Write

You will see here we have Path, LastWrite MD5 along with VT lookups on the binary blobs of data. In one of the instances you can see it's hitting 35/57, and lastly I also included the data size and a hex preview.

You're able to change up the --size to any size you want to help reduce FPs.

python reghexdump.py --hive NTUSER.DAT.copy0 --size 20000

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\ xsw\binaryImage32  
LastWrite: 2015-04-21T14:17:17.642979Z  
MD5: 5be923a9a323667dc6ae33fb2f4a80a6 - 35/57  
Size: 223744  
00000000   4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00    MZ..............  
00000010   B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00    ........@.......  
00000020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................  
00000030   00 00 00 00 00 00 00 00 00 00 00 00 E8 00 00 00    ................  
00000040   0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68    ........!..L.!Th  
00000050   69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F    is program canno  
00000060   74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20    t be run in DOS  
00000070   6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00    mode....$.......

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Active Setup\Installed Components\{72507C54-3577-4830-815B-310007F6135A}\Rc4Encoded32  
LastWrite: 2015-04-21T14:17:26.051649Z  
MD5: 26ef08eb9dd49c53e0526bf148d23e3d - None  
Size: 54669  
00000000   87 87 3F 5C D1 25 67 7D C8 47 0F 5A 9C B7 D1 3E    ..?..%g}.G.Z...>  
00000010   0B 34 AB 0E 9D 2E 59 D6 A2 51 C7 66 18 54 5A C2    .4....Y..Q.f.TZ.  
00000020   1D 6B C0 B8 17 F6 23 C3 7D CA B2 2F E3 10 82 5A    .k....#.}../...Z  
00000030   C8 99 9C 83 C9 4C 58 FB C7 FC 14 3E 15 9C B4 70    .....LX....>...p  
00000040   82 3B 35 AF E3 B9 B2 E3 34 47 7F 50 46 74 01 B6    .;5.....4G.PFt..  
00000050   F2 72 D1 76 44 71 B2 F5 82 21 F6 79 0F FE EE 68    .r.vDq...!.y...h  
00000060   CE 04 8E 0F 51 2D C3 FE 70 BC 78 BC 2C 6E 94 1D    ....Q-..p.x.,n..  
00000070   E9 0C 40 C5 98 DD 2F 09 2D 27 7E 14 B6 DA 28 3C    ..@.../.-'~...(<

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Active Setup\Installed Components\{72507C54-3577-4830-815B-310007F6135A}\Rc4Encoded64  
LastWrite: 2015-04-21T14:17:26.051649Z  
MD5: 233ec524cd7b88e18661298d8de549dd - None  
Size: 68909  
00000000   87 46 53 6F 96 A7 6B AA E8 65 C2 DA AE 96 4C 98    .FSo..k..e....L.  
00000010   43 B5 8E E5 99 2E 59 9E 2B CD E3 66 1C 54 5A 8A    C.....Y.+..f.TZ.  
00000020   C1 5E 01 31 FF EE 27 8B F4 F7 0B D7 1C EF 7D 9F    .^.1..'.......}.  
00000030   F4 D1 43 64 32 C5 E5 42 B5 D1 51 B5 50 94 3D 0A    ..Cd2..B..Q.P.=.  
00000040   B0 A6 AC 36 F8 A2 D8 F8 8E 95 7F 05 9F 70 01 B6    ...6.........p..  
00000050   86 4F 04 2E 46 F8 A6 F1 4B 56 7F 79 4F 77 18 05    .O..F...KV.yOw..  
00000060   76 F8 71 F0 6C 93 7F FE 70 CE 89 BC 2C 6E 94 1D    v.q.l...p...,n..  
00000070   EB 0C 40 C5 98 9A E4 99 D2 E4 84 9D 6D 9B A9 94    ..@.........m...

Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache  
LastWrite: 2015-04-21T12:53:08.684547Z  
MD5: 630f44e2a9ae05d72f5aecb471d608e3 - None  
Size: 74419  
00000000   13 00 00 00 C3 53 5B 62 48 AB C1 4E BA 1F A1 EF    .....S[bH..N....  
00000010   41 46 FC 19 00 80 00 00 00 7E 00 31 00 00 00 00    AF.......~.1....  
00000020   00 69 42 79 3F 11 00 50 72 6F 67 72 61 6D 73 00    .iBy?..Programs.  
00000030   00 66 00 08 00 04 00 EF BE 69 42 50 3F 69 42 79    .f.......iBP?iBy  
00000040   3F 2A 00 00 00 3F 01 00 00 00 00 02 00 00 00 00    ?*...?..........  
00000050   00 00 00 00 00 3C 00 00 00 00 00 50 00 72 00 6F    .....<.....P.r.o  
00000060   00 67 00 72 00 61 00 6D 00 73 00 00 00 40 00 73    .g.r.a.m.s...@.s  
00000070   00 68 00 65 00 6C 00 6C 00 33 00 32 00 2E 00 64    .h.e.l.l.3.2...d  

Write

You also have the option to write out the binary blobs to disk. When using the --write arguement you will also have an additional message included. In this example it says, "Writing Data: binaryImage32 to out/"

reghexdump.py --hive NTUSER.DAT.copy0 --size 20000 --write out/

Writing Data: binaryImage32 to out/  
Path: CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}\Software\ xsw\binaryImage32  
LastWrite: 2015-04-21T14:17:17.642979Z  
MD5: 5be923a9a323667dc6ae33fb2f4a80a6 - 35/57  
Size: 223744  
00000000   4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00    MZ..............  
00000010   B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00    ........@.......  
00000020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................  
00000030   00 00 00 00 00 00 00 00 00 00 00 00 E8 00 00 00    ................  
00000040   0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68    ........!..L.!Th  
00000050   69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F    is program canno  
00000060   74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20    t be run in DOS  
00000070   6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00    mode....$.......  

List Output

If you use the --write option it will write out and of the "hits" into the directory specified as seen below.

ls out/

• ProgramsCache
• Rc4Encoded32
• Rc4Encoded64
• binaryImage32

file out/*

• out/ProgramsCache: Spectrum .TAP data BASIC program
• out/Rc4Encoded32: data
• out/Rc4Encoded64: data
• out/binaryImage32: MS-DOS executable

Summary

I hope this is useful. I'll add some additional features over the next few days. I'm short on time these days. Let me know if you would like to see any additional features/functionality. I don't know how practical it is yet, but saw the blog and wanted a quick script to detect it if I needed.

You can download the code here from my GitHub page.

Blog Series

• Part 1: Introduction to Hardware and Embedded Forensics
• Part 2: UART Intro. and Sniffing UART with a Logic Analyzer
• Part 3: TBD

Introduction to Hardware and Embedded Forensics

I started thinking about cell phones and how people acquire data from them. I read about hacking pin codes with electronic devices, rooting methods and their shelf life/practicality, chip off, JTAG, etc.

What? JTAG and chip off...? After a bit of time on Google I sent a Tweet on April 19th, 2015 asking, "JTAG opinions: RIFF, Smart-Clip2, Octoplus, or Sigma Box? Looking to "play" around a bit"? I got a few replies. I didn't know much about what they tweeted back to me. Below is what has happened since that tweet...

That's when I realized I had a knowledge gap. I don't know much about hardware and/or electronics and if I ever needed to do something with either one of those forensically I would need to ask for some help. But I also like new hobbies and learning new things so this is where my road begins.

So to learn more about hardware, hardware "hacking", and other techniques used to acquire forensic data off hardware devices (outside of desktop/laptop computers) I have decided to start poking around with some different consumer electronics. Specifically home automation. At least initially to get my feet wet, but more so because my cell phone is hundreds of dollars and it has some super small electronics on it. I figured I would start with something a bit bigger. So I hit up Amazon and ordered a few different home automation hubs to take a look at. I'm less interested in the "hacking" part, but if I find something interesting along the way I will write about it as well.

First things first. I need to buy some equipment before I get started.

My Shopping List

• Shikra - This will allow me to speak with various low(er) level data interfaces such as; JTAG, SPI, I2C, UART, and GPIO.
• JTAGulator - This will allow me to brute force the PIN configuration for UART and JTAG interfaces so we can the use something like Shikra (or the JTAGulator) to talk with those.
• Saleae Logic 8 - This is a logic analyzer and will allow us to more or less perform a "Wireshark"capture on various data interfaces so we can see what's being passed around the wire. It does this with the software, which has protocol analyzers that will decode the various protocols (SPI, I2C, serial, JTAG, etc.)
• J-Link EDU Debugger - This is the same as the J-Link Base, but I am not using it for commercial purposes so you save some money.
• DSLogic Pro Kit - Logic Analyzer
• Tekpower TP1803D Linear Digital Variable DC Power Supply
• Triplett 1101-B Compact Digital Multimeter
• Ultra-Efficient Desk Clamp-Mount 56 SMD LED Spring-Arm Magnifying Lamp
• Kendal 2 IN 1 SMD Rework Soldering STATION 852D++
• Olympia Tools 88-670 iWork 15-Piece Smart Phone Repair Tool Kit
• Klein Tools 32525 32-Piece Tamperproof Bit Set
• SMARTScope by LabNation
• Make: Electronics (Learning by Discovery)
• Hot Glue Gun
• Fishing lure tackle boxes - Keep all my stuff nice and neat so my wife doesn't kill me.
• Various Jumper wires, solder kits, bread board, parts, etc.
• Some random stuff here and there.

Things I already had

• Raspberry Pi 2 Model B
• Caldigit Thunderbolt Docking Station 2 - I ran out of USB ports...

Here is where I get to justify my purchases. It is about 50% of a graduate class and I will learn a hell of a lot more than I would there so I consider it justified. However, I couldn't stomach adding all of it up so you will need to do that on your own. Go home or go big I guess..

References

Below is a list of sites, links, videos, courses, books, etc. that I am finding useful or are on my to-do list. This will continue to grow as I add more and more sites. Feel free to send me links. Some of these are way above my head, but I keep them around for references more than anything. Maybe they wont be for others.

I suggest reading/watching the "free" stuff first before you start buying a bunch of books and what not. Do as I say, not as I did. :)

Protocol References

UART:
* How does the UART work? - https://www.youtube.com/watch?v=FQpbIvhY7es * Serial Port Complete 2nd Ed: http://www.amazon.com/dp/193144806X (Also referenced in Books section) * https://en.wikipedia.org/wiki/Universalasynchronousreceiver/transmitter

SPI:
* https://learn.sparkfun.com/tutorials/serial-peripheral-interface-spi * Serial Port Complete 2nd Ed: http://www.amazon.com/dp/193144806X (Also referenced in Books section) * https://en.wikipedia.org/wiki/SerialPeripheralInterface_Bus (See references section as well)

I2C:
* http://www.8051projects.net/wiki/I2CTWITutorial * https://en.wikipedia.org/wiki/I%C2%B2C (See references section as well)

JTAG:
* https://en.wikipedia.org/wiki/JointTestAction_Group (See references section as well)

SMBus:
* https://en.wikipedia.org/wiki/SystemManagementBus

Wikipedia

It's not the articles themselves. It's the references that contain the gold.

Hardware RE/Hacking Sites

• https://www.exploitee.rs
• forum.xda-developers.com
• http://www.devttys0.com

Reference Books (Google goes a long way here)

• Hacking the Xbox (Free) - http://www.nostarch.com/xboxfree
• Serial Port Complete 2nd Ed: http://www.amazon.com/dp/193144806X
• USB Complete: The Developer's Guide 5th Ed: http://www.amazon.com/USB-Complete-Developers-Guide-Guides/dp/1931448280

Educational Courses

• https://www.coursera.org/course/introtoelectronics
• https://www.coursera.org/course/hardwaresec
• https://www.newbiehack.com

Tools

• Jtagulator - http://www.grandideastudio.com/wp-content/uploads/jtagulator_slides.pdf
• Jtagulator - https://www.youtube.com/watch?v=GgMOBhmEJXA
• Jtagulator Part 1 - Discovering Debug Interfaces with the JTAGulator https://www.youtube.com/watch?v=4StBmkAsCr4
• Jtagulator Part 2 - Discovering Debug Interfaces with the JTAGulator https://www.youtube.com/watch?v=xi5jSN7NCi4

Overview Presentations/Videos/Blogs/Websites (in no order)

• http://www.slideshare.net/balgan/hardware-hacking-101
• http://www.slideshare.net/mattb/hardware-hacking-for-fun-and-profit-1049183
• http://www.slideshare.net/guest3bd2a12/advanced-hardware-hacking-techniques-presentation
• http://www.slideshare.net/Sudar/open-hack-2011hardwarehacks
• http://www.slideshare.net/fusionmkx/hackers-and-painters-hardware-hacking-101-10th-oct-2014
• http://www.slideshare.net/watsonsteve/arduino-forensics
• http://www.slideshare.net/watsonsteve/wearable-device-forensics
• http://www.devttys0.com/2012/10/jailbreaking-the-neotv
• http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug
• https://www.newbiehack.com

ELF Binary Reversing

• http://www.hackercurriculum.org/elf
• http://althing.cs.dartmouth.edu/local/reverse-talk.pdf
• http://www.linuxsa.org.au/meetings/reveng-0.2.pdf
• https://raw.githubusercontent.com/corkami/pics/master/ELF101.png

Summary

So yeah, that's the "kit" I have and will be playing with. I'm not really sure where this "series" of blog posts are going to go, or even if i'll get anywhere. I really know nothing about hardware/electronics so i'm more or less putting this out to the public as a means to keep me on task and hopefully learn something along the way. I can already see some C coding in my future. At the very least I will keep notes and make a good record of where people can go to at least get started if they are also interested.

DISCLAIMER: EVERYTHING HERE WILL VOID YOUR PRODUCT WARRANTY

This is Part II in a series of blog posts I will be doing. The main tracking page is here.

Before we get into the process I used for sniffing a UART connection that ultimately lead to a root shell on a Home Automation hub we will go over UART quickly in an effort to understand what it is and what it is used for.

Overview of UART

UART stands for Universal Asynchronous Receiver (RX)/Transmitter (TX). It is a general-purpose component for transmitting and receiving data independent of the processor. Devices with asynchronous serial ports typically contain hardware UART. When devices communicate with each other via asynchronous communication they aren't relying on an external clock signal between the receiver or the transmitter. It uses a bitrate/baudrate.

Here is a picture of what UART PINs may look like on a PCB. Note the TX and RX PINs, which are used for communication. For this discussion we care more about the TX and RX PINs as that's what we will connecting to; however, we will also want to connect a ground wire to the ground PIN. We can ignore the Vcc pin for now.

Some products that contain UART are SMART card readers, home automation hubs, etc. Lots and lots of electronic devices contain UART so it is important to get a good understanding of what it is and how it works.

We will be using a configuration as such = 8 bits with no parity and one stop bit (8-N-1). [StartBit][0][1][2][3][4][5][6][7][StopBit]

Keep in mind that when data is sent it is sent least significant bit (LBS) first.

So when you add up the 8 bits of data and the start and stop bits you will have a total of 10 bits. If we would have sent 7 bits instead of 8 bits of data we would need to set a parity bit and configure it to be even or odd (0 or 1).

I mentioned above about bit rate/baud rate. Baud rate translates to symbols per second. So assuming a baud rate of 9,600, we will transmit data at 9.6 kilobits per second.

When UART is idle (not transmitting data) it's set to "high", or logic 1 and when it sends it's first bit (start bit) it will be set to "low", or logic 0.

I learn better from pictures, so let's take a look at what this all looks like using one of the home automation systems I sniffed using my Saleae Logic 8.

You will see right before we hit the +0.5 ms marker the transmission is idle, or "high" (logic 1), which makes sense because nothing has crossed the wire yet and as a result it's idle, but then you see it drop into its start bit ("low"), and then 8 bits of data are sent. In this case, 0100 1010, which is hex 0x4A, or ASCII J. Notice the "bars' when the data is sent. When a 0 is sent the wave pattern is set to low, and when a 1 is sent it's set to high. Now you can more or less read the patterns even without some special software.

Here is an example with the HEX and ASCII decoding turned on, which is normally what I do for ease of reading.

You will see here what actually crossed the wire was ASCII JFFS2, which is the magic header for journaling flash file system, which is used with flash memory devices. Now we know we are getting somewhere!

Sniffing with a Logic Analyzer

So now that we have a quick overview of what UART is and how it is used I figured I would show you how I went about sniffing the data transmissions.

Below is an image of the home automation system PCB. With the information above you're able to easily spot the UART pins on this particular board (VCC, GRD, TX, RX). The next thing to do is see if they are hot, which I used a multimeter for. It's a bit hard to show you here how I went about doing this so hopefully you will have some idea how a multimeter works. It's pretty simple. If not, read SparkFun's how-to on multimeters.

Now that we know the PINs are hot we can place our Logic Analyzer clamps on the PINs we want to monitor. In this case we want to hook up to GRD, TX and RX. More specifically TX, because TX is the transmit PIN so that's where the data will come from, but in either case we will connect to GRD, TX and RX. When you connect the logic analyzer it will look something like this.

Once the logic analyzer pins are connected to the UART pins we can start our capture. Once we start the capture power on the home automation hub. Once it's finished you will see something like this:

I call it (and i'm sure others do) the Wireshark for electronics. The screen output is really nice, but it doesn't scale. This particular Saleae product allows you to output the data in CSV format, which is nice, but it is also hard to read in its raw form. In it raw form it looks like this:

Time [s],Value,Parity Error,Framing Error 2.115247380000000,n,,
2.115420420000000,r,,
2.115593460000000,n,,
2.115766520000000,r,,
2.115939560000000,U,,
2.116112600000000,-,,
2.116285660000000,B,,
2.116458700000000,o,,
2.116631740000000,o,,
2.116804800000000,t,,
2.116977840000000,' ',,

In this case I really only care about the value data and after seeing this output I know I needed something better so I wrote a quick python script to parse the data and make it more readable.

import sys  
with open(sys.argv[1], 'r') as f:  
    value_list = []
    next(f)
    for line in f:
        initial_cleanse = line.split(',')[1].strip()
        value_list.append(initial_cleanse)
    final_cleanse = " ".join(value_list).replace(" ", '').replace("nr", "n").replace("n", "n").replace("r", "").replace("''", ' ')
print(final_cleanse)  

And here is the output from saleaeparse.py. As you can see it is much easier to read. It's more or less the same as you would see if you were to connect to the serial port and watch the screen while spits out all the text.

python saleaeparse.py homehub.txt |head -20

U-Boot 1.1.3 (Jan 19 2012 - 17:57:52) Board: Ralink APSoC DRAM:
Return Real size =67108864 !!
64 MB
relocate_code Pointer at: 83fa8000
Ralink UBoot Version: 3.4.0.4
Model:
ASIC 3883_MP (MAC to 100SW Mode)
DRAM component: 512 Mbits DDRCOMMA width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: NAND Flash
Date:Jan 19 2012 Time:17:57:52

Much easier on the eyes, yeah? You can download the code from my GitHub account.

Although not pasted above, while reviewing the full output of the 90 second collection I saw the following message, "Press the [f] key and hit [enter] to enter failsafe mode".

This is interesting, so let's take a deeper look using another piece of equipment called Shikra. This will allow me to speak with various low(er) level data interfaces. In this case we will be interfacing with UART as we already discussed.

Connecting to the Home Automation Hub's UART PINs

The Shikra is the device on the right hand side plugged into my USB port.

Pins layout

• Shikra: TX ---connected_to---> RX of Home Automation Hub
• Shikra: RX ---connected_to---> TX of Home Automation Hub
• Shikra: GRD --connected_to---> GRD of Home Automation Hub

Now that the pins are hooked up properly we can attempt to connect to the home automation hub through Shikra. To do this we will use the screen command, but before we can do that we need to know the path of our Shikra.

You can accomplish this via the following:

ls /dev/serial (on Mac)

• /dev/cu.usbserial-141
• /dev/tty.usbserial-141

python -m serial.tools.list_ports

• /dev/cu.Bluetooth-Incoming-Port
• /dev/cu.Bluetooth-Modem
• /dev/cu.usbserial-141
• 3 ports found

On Linux it will look like this:
* /dev/ttyUSB0

If you go the python route you will need to install pyserial via pip install pyserial

Now that we know our serial device information we can connect.

screen /dev/ttyUSB0 57600

Once we kick off the command we will turn on the home automation hub and once you start seeing a bunch of text we can hit either f + enter or simply hit enter a few times. Either one will drop us into root, although there are a few additional commands in failsafe mode.

Root Please?

So if everything worked as discussed we should now have our root shell and we can pretty much do anything we want at this point. We can dump memory, image mounted drives, grab the firmware, etc.

If you decided to go into failsafe mode your root prompt will look something like this: root@(none):/#

If you simply hit enter a few times your root shell will look like this.

enterBusyBox v1.17.3 (2012-01-09 12:40:42 PST) built-in shell (ash) root@redacted:/#

The redacted parts show the serial number of my device, which I don't want published. I don't feel like buying a new one because someone locks me out.

Summary

So there we have it. Overview of UART, how to connect to the pins, and ultimately how we got root. I guess you could say, I got lucky, but I have to assume a lot of consumer electronics are configured in a similar fashion and you don't know what you don't know until you do it for yourself.

Again, my main point of this series was to look at the forensic evidence more than the hacking. In the next blog I will look at the forensics side of gaining root so this device and see if we can uncover any forensic evidence from the device.

It can be an expensive learning experience, but so far this is some really cool work. I've learned a lot just in the few days playing with this. Now I just need to figure out how I can do this day-in-day-out and get paid for it! Haha. #InTime... #InTime...

I've also added some more resource links to my into post so make sure to keep an eye on the original post of this series for the latest sites I found helpful.

References: How does UART Work Wikipedia - UART

I got this idea awhile back when I wrote a tool called, BARFF - Browser Artifact Recovery Forensic Framework. It was more or less a glorified SQLite parser, which is again, more or less what SLARF is, but it uses a plugin based architecture similar to RegRipper, or my take on RegRipper, python-regparse (written in Python). BARFF was "complex" and not easy to add additional plugins too. It didn't scale well either so I found myself not using it much.

Why SLARF?

Why not? When I wrote python-regparse I wrote it in such a way that it can be extended and more or less copy/pasted to apply to multiple artifacts, not just the registry. Because of this SLARF took me about 1.5 hours to modify and now I have a completely different set of artifacts that are able to be parsed more or less the same way as my registry parser. It uses the same user generated output as well so I can have consistency among artifacts as well, which isn't easy to find with other tools.

On top of that, if you have looked at a cell phone these days it is pretty much just a device full of SQLite databases. Likewise with modern browsers and a whole bunch of other programs from Garmin GPS backups to everyday applications like Evernote. They all use SQLite DBs to store data in some form or fashion. So rather than writing a tool for each application I decided to just leverage what I already had with python-regparse and build SLARF.

So let's take a look and see how it works.

Help

python slarf.py -h

usage: slarf.py [-h] [--plugin PLUGIN] [--listplugins] [--plugindetails]  
                [--database DATABASE] [--format format]
                [--format_file format_file]
Parses SQLite Databases.  
optional arguments:  
  -h, --help            show this help message and exit
  --plugin PLUGIN       Specify plugin to run.
  --listplugins         Lists all of the available plugins.
  --plugindetails       Lists details available plugins.
  --database DATABASE   SQLite Database.
  --format format       Custom output.
  --format_file format_file
                        Custom output template.

Plugins Right now I do not have a lot of plugins written for SLARF, but I will be adding to them over the coming weeks. If there is one you want now let me know and I can write it for you, or you can simply pass me the query and I can build the Python shell for you to test out.

python slarf.py --listplugins

nuvi2757lm_rs (This was a test plugin. I'll write more soon.)  

python slarf.py --plugindetails

NUVI2757LM_RS  
    Plugin:     NUVI2757LM_RS
    Author:     Patrick Olsen
    Version:    0.1
    Reference:  http://sysforensics.org
    Print Fields:   "{{ rank }}|{{ string }}"
    Description:    Parses the searches table from the recent_searches.db on the Garmin Nuvi 2757LM GPS.

Templates

The HTML output uses predefined templates. You can see an example of one here on my GitHub.

The output when using templates look like this:

python slarf.py --plugin nuvi2757lmrs --database recentsearches.db --formatfile templates/nuvi2757lmrs.html

User Defined Output

python slarf.py --plugin nuvi2757lmrs --database recentsearches.db --format '{{rank}}|{{string}}'

0|Nordstrom  
1|Washington DC, DC  
2|Starbucks  
3|Kroger  
4|Radisson Hotel-Nashville International  
5|St Louis, MO  

Summary

So yeah, there it is. I have to write a bunch more plugins, and to be quite honest I don't do much analysis of SQLite DBs so if you have some ideas, or common queries, etc. by all means let me know and I'll see what I can do to create some for you. I'll have some browser ones written hopefully in the next couple weeks. I find myself short on time these days.

One more point. It really doesn't have to be just SQLite DBs... You could write your plugins to process any kind of database really. You will just need to add the respective imports.

You can download SLARF on my GitHub.

A few people have asked me recently why I have not posted any blogs or updated any of my code on GitHub.

Simply put, my employer does not allow it. I knew upfront that I would not be able to blog so there were no surprises. It was a personal choice I made.

I will keep paying hosting fees so it stays online for as long as the information is still relevant/current.

Outside of that I have enjoyed blogging and have come to miss it. If the rules change or if I change jobs I will be back online. I have a few posts already written for when that day comes :)

In the meantime, take care and feel free to reach out to me. If anyone else would like to write posts hit me up. I am more than happy to have other people contribute while I am unable to.

Thanks,

@patrickrolsen

In Part 1: Introduction to Hardware and Embedded Forensics I went over some tools I am using to perform hardware and embedded forensics analysis. In Part 2: UART Intro. and Sniffing UART with a Logic Analyzer we were able to get root on a home automation hub.

Now for Part 3: Home Automation Hub Forensics, which is this post we are going to go over getting root access on another home automation unit, and then proceed to perform some initial forensic analysis.

Why I decided to perform analysis on this particular unit is because it functions as both a home automation hub and also a wifi router. It seems more practical to me vs. purchasing a wifi router and a home automation hub. I hate duplicate devices so this all-in-one unit is nice.

Before we were able to obtain Root access I need to open the device and take a look at its inside. Right away I noticed the UART pinout. They were nice and labeled for me and allowed for easy access.

In this image I have already connected the female jumper wires to the TX, RX and GND pins.

And here you can see the connection is made to my Shikra so I am ready to talk to the device over serial.

So now that we are connected we can simply connect to the device once it powers up. In this case I kept hitting Enter and in due time I was dropped into a login prompt. The problem with this is that it was password protected. I tried some simple passwords like root, admin, etc. but none of them seemed to work.

Then I remembered when I setup the device there was a default password already configured in the device. I can't verify is these are unique, but my password was haars (if I recall correctly). So I decided to use root as the user and haars as the password and guess what?

If you change the internal password of your device that same password will follow forward so if you change yours from haars to helloworld you would use root as the username and helloworld as the password.

I also wanted to mention that at least on my device SSH seemed to be enabled by default and I was able to SSH into that same root account with the preconfigured user/password (root/haars) so you really wouldn't even need to go to the extent I did with the hardware to get the same level of access. In either case, we will continue as if SSH was not enabled.

Once connected I started to poke around a bit.

cat /proc/mtd

dev: size erasesize name mtd0: 00100000 00020000 "uboot-env0"
mtd1: 00100000 00020000 "uboot-env1"
mtd2: 00100000 00020000 "sb0"
mtd3: 00100000 00020000 "sb1"
mtd4: 02e00000 00020000 "rootfs"
mtd5: 00600000 00020000 "kernel_standby"
mtd6: 02e00000 00020000 "rootfs_standby"
mtd7: 01000000 00020000 "rootfs_data"
mtd8: 00100000 00020000 "log"
mtd9: 00100000 00020000 "cal"
mtd10: 00100000 00020000 "man"
mtd11: 00500000 00020000 "SNIP_Data"
mtd12: 000e0000 00020000 "uboot0"
mtd13: 00100000 00020000 "uboot1"

I dumped mtd4, rootfs, which is the squashfs firmware file.

Once we have this we can unpack it and look at the filesystem contents and review all of the data.

I will look at this more in the next post.

I am back online after a year. My previous employer did not allow blogging or code contributions, but that's behind me now so I am free to do what I want.

I actually debated whether or not to start writing again, but I found that I actually missed it over the past year. Blogging takes a lot of time and you rarely (if ever) get praise for it. On the positive side, it kept me on task and focused on learning new and exciting things at a much quicker pace.

The blogsphere is getting crowded, so if you can think of any topics you want covered by all means let me know. I am always up for suggestions, but rarely (if ever) get feedback from readers. If I know nothing about your suggestion I will learn about it. That's the fun part about having a blog.

I created a GitHub repo where people can submit blog ideas as issues. You can submit them here. This will give me a running list of ideas to write about.

Everything seems to be incident response and malware related these days since it's all the buzz so maybe I can get creative and find some other areas to write about.

I will write some new posts over the next few days. I am in the process of moving across the country.

Enjoy!

I started playing around with the Arduino Uno Rev 3 awhile back but never got around to documenting anything via a blog post (until now).

I read Steve Watson's slide series here on Arduino forensics, and decided to write up a blog on some of the stuff I was playing around with, too.

Overview

Most Arduino projects you find online seem to be more of a novelty and may not hold much forensic value overall, but there are some really neat projects and it is a rather easy process so I thought it is was worth writing down in case someone comes across the need in the future.

You never know when an Ardunio controlled drone will fall out of the sky and cause someone serious brain injury.

Arduino Uno Rev 3

So here we have the Arduino Uno. I will be using this one for demo purposes. I purchased mine from Adafruit for $24.95 + Shipping. Go get yourself a few of them. If only to keep them on your shelf and not touch them like most people do... You know I am right.. :)

Sources of Evidence

By looking at the schematics and reading the technical specifications I came up with a list of possible sources of evidence. There may be more depending on how the Arduino is configured and what it's purpose is.

• Arduino itself
  • Microcontroller
  • Onboard Storage
• Web Services (APIs)
  • Charting, Messaging, etc. services
  • Webserver hosting the services
• Router/Network Devices
  • Internet communication via a breakout/shield board.
• Myriad of Arduino shields, sensors, etc.
• Development System(s) (Writing Code)

Onboard Storage

• Flash Memory 32 KB (ATmega328)
  • 0.5 KB used by bootloader
• Static Random Access Memory (SRAM) 2 KB (ATmega328)
• Electrically Erasable Programmable Read-Only Memory (EEPROM) 1 KB (ATmega328)

You can read more about the Arduino memories here

Wiring up the Uno

To dump the Flash and EEPROM I used Newbie Hack's AVR User Programmer. I went this route because I had some issues with the Bus Pirate v4 and Shikra.

Sometimes it is just easier to throw money at the problem. In this case, $9.95.

So to get this working it's simple. I installed the usbasp drivers via CrossPack on my Mac system. I then installed Avrdude via Homebrew.

Once this was installed I wired up the Arduino. The 10 pin pinout and the device I am using can be found/purchased here.

If you want to reference the official schematics, which would also be useful when tracing the pins back to the MCU for "chip-off" acquisition as well.

The Arduino Uno Rev 3 SPI pinout can be found in Google Images quite easy as well. Here is an example if the above is too cryptic.

If you were to perform "chip-off" and analyze the chip via a breadboard you would need to have this reference of the chip pinout for the ATmega328P.

Now it's time to connect our USBAsp programmer to the Arduino. In this example I used a stripped down board to make it easier to see in the picture.

In the image you can see our AVR programmer and the ICSP pins connected up to the Uno. It really is as simple as that. Just follow the pinout diagrams above and you should be fine.

Dumping Contents

Now that we are wired up and have a solid connection let's attempt to dump the data for analysis.

We will be using avrdude to dump flash memory and EEPROM.

Linux: sudo apt-get install avrdude

Mac: brew install avrdude  

EEPROM

EEPROM is non-volatile so it's not impacted by power off/on cycles like flash memory.

Per the data sheet we know that the EEPROM size is 1KB.

avrdude -p m328p -P usb -c usbasp -U eeprom:r:eeprom.bin:r  

And this is what it looks like when it's dumping the contents.

avrdude: AVR device initialized and ready to accept instructions

Reading | ####################### | 100% 0.00s

avrdude: Device signature = 0x1e950f (probably m328p)  
avrdude: reading eeprom memory:

Reading | ####################### | 100% 0.40s

avrdude: writing output file "eeprom.bin"  
avrdude: safemode: Fuses OK (E:FD, H:D6, L:FF)  
avrdude done.  Thank you.  

So we successfully dumped the EEPROM as seen here.

-rw-r--r-- 1 root staff 1.0K Mar 11 19:03 eeprom.bin

There is also an EEPROM library that you can use to read data out of EEPROM.

Flash

Now to dump the flash contents.

avrdude -p m328p -P usb -c usbasp -U flash:r:flash.bin:r  

And we can see here that we dumped the flash memory successfully. Flash memory - think USB drive.

avrdude: AVR device initialized and ready to accept instructions

Reading | ############################ | 100% 0.00s

avrdude: Device signature = 0x1e950f (probably m328p)  
avrdude: reading flash memory:

Reading | ############################# | 100% 6.11s

avrdude: writing output file "flash.bin"  
avrdude: safemode: Fuses OK (E:FD, H:D6, L:FF)  
avrdude done.  Thank you.  

SRAM

At present I do not have a solution for dumping SRAM from Arduino. If you have a solution let me know and I can update this post so everyone can take advantage of it. This would be the most artifact rich source of evidence.

I suspect this is more of a coding deficiency on my part, vs. it being difficult.

Analysis of the Data

Now it's time for analysis, which in this case isn't too difficult since we used a bare Arduino with nothing really running on it.

EEPROM

We can do a quick check with xxd to see if there are any contents available.

xxd eeprom.bin |head -1024  

0000000: 69ff ffff ffff ffff ffff ffff ffff  
0000010: ffff ffff ffff ffff ffff ffff ffff  
0000020: ffff ffff ffff ffff ffff ffff ffff  
0000030: ffff ffff ffff ffff ffff ffff ffff  

Flash

Simply running strings against the flash contents produces some good information that could be relevant to a case.

MAC Address :  
Unable to retrieve MAC Address!  
DNSserv:  
DHCPsrv:  
Gateway:  
Netmask:  
IP Addr:  
Unable to retrieve the IP Address!  
Request DHCP  
Connected!  
Failed!  
Check your wiring?  
Initializing...  
localhost  
Free RAM:  
alucard_almond24 <-- SSID of my WLAN  
<redacted_wifi_password> <-- WLAN password  
www.adafruit.com <-- GET request I made  
localhost  

That's really about it. Not too exciting. I'm sure it's more exciting for more complex projects.

Summary

All and all that's about all of the information you get. Granted, I do not have any fancy code/configurations running on my Arduino, but this should be a good starting point for some deeper analysis.

For anyone running a drone or similar hardware setup and wants to donate their EEPROM/Flash dumps let me know. I will add the analysis to this post.

Enjoy!

Overview

I always thought JTAG was hard, then I tried it, and realized it was actually very easy (most of the time). Pretty much anyone can learn to do this in 8 hours of soldering practice. Really, it's dead simple. Don't let anyone fool you by trying to convince you it's not.

I said, most of the time, because there are going to be instances where the following may happen and prevent some people from being able to JTAG a phone:

1. Phone not supported by popular tools - Let's face it. For the majority of analysts if the tool doesn't work, they don't work. That's just life so we might as well accept that fact and list it first. Sooner or later you will get a phone that isn't supported and you likely wont be able to analyze it. The barrier of entry to write support for non supported chips is going to be too difficult for most people. That's fine. That's life. Analyze the other 95%+ of phones that come through your door and outsource the remaining 5%.
2. JTAG taps are unknown and you need to figure them out on your own. This can take time and more skills. Again, see first bullet (outsource the 5%).
3. Micro Controller (MCU) does not support JTAG requiring ISP/ICSP or Chip-off. This may or may not be possible in your environment. I would suggest additional training for Chip-off. Also, for ISP you will be soldering some crazy small wires. It's very doable, you will just need practice (eBay).
4. Encryption - Think new iPhones and new Samsung devices. This quite possibly spells the end of JTAG.

NOTE: I do not do this in my day job.  I purchased damaged phones off Ebay and played around with them. This is even more proof that anyone can learn how to do this.  

What is JTAG?

First, let's define what JTAG is so we can better understand it going forward.

Joint Test Action Group (JTAG) is the group of companies that came together in 1985 to define a standard for boundary-scan testing of integrated circuits.

In 1990, the specification resulted in IEEE 1149.1, Standard Test Access Port and Boundary Scan Architecture. It's main purpose is to allow engineers to perform debugging and diagnostics of the system/device.

JTAG Interface Signals

UPDATED 10/02/2016 - Removed this section. This senr.io write up explains JTAG much better. No reason to repeat it.

Tools for JTAGing Phones

I use the following tools and have NO issues with JTAGing phones. You can buy better equipment if you want, but below is proof you do not need the best equipment.

I will assume you already have forensic software to process the data we will dump from the phone. If not, you can get a lot of good content with X-Ways, Net Analysis, Bulk Extractor, Carving Tools and Autopsy before diving into some of the more expensive commercial mobile forensic solutions (IEF, Cellebrite, Encase, etc.) But again, I will assume you have this already and if you're in Law Enforcement you likely already have at least Cellebrite and something like Encase.

• RIFF Box - $150
• Z3X Easy JTAG box - $250
• Hakko FX888D solder Iron - $98
• AmScope SE400-Z Stereo Microscope - $185
• Multimeter - I use Extech EX330 - $50
• Bench Power Supply - Tekpower - $75
• Flux - $10 - $12
• Solder - $25 - $35 (Lasts a long time) - Smaller the better.
• 20, 30 and 40 AWG Magnetic wire - $10 - $15
• Other wire as necessary (smaller the better) - $10 - $15 - Adjust the size as necessary.
• Alligator Clip Test Leads - $6 - $12
• Hakko CHP 3-SA Stainless Steel Non-Magnetic Precision Tweezers - $5
• Cell Phone Repair Tools $15 - $50
• Faber-Castell Perfection Eraser Pencil with Brush - $5 - Used to clean JTAG taps before soldering
• A Tooth Brush - $1 - Cleaning PCB/Taps
• Rubbing Alcohol - $2 - Cleaning PCB/Taps
• Kapton Tape - $10 - $15 - For those without steady hands, this can help cover surrounding components from getting solder on them.
• Hakko FA400-04 Fume Extractor - $68 - Or make one with a CPU fan and a Carbon filter for $20
• JPIN JTAG Molex Flex Kit - $60
• Hakko T18-BR02 - T18 Series Soldering Tip - $5
• Kohree 110V LED Digital 858D SMD Hot Air Rework Station Solder - $60 - Not needed for JTAG, but nice to have on your desk in case any JTAG taps are covered in epoxy

Total: For < $1,400 you can JTAG most phones from what research I have done. If you are in law enforcement and not doing this you are missing out. It is very simple.

There is another tool called, JTAGulator - $159 - that can help brute force JTAG tap layouts. This tool can be useful when you do not know what the layout of the taps are.

It's not necessary as most of the popular phones are supported and documented. I have used it and it worked on some phones, but not on others. It seems to be hit or miss. The Z3X also has a JTAG tap identification tool built into it so I recommend starting with the Z3X before shelling out another $159 for the JTAGulator.

If you do not want to invest in gear, but want something JTAG'd I can help you. Just ask.

Nokia Lumia 521

I decided on this phone after someone posted on the SANS mailing list asking how to acquire data from it.

I purchased two phones off Ebay. $15 each + shipping for a grand total of $40.69. The condition of the phone doesn't matter for JTAG if it powers on. So if you can confirm power (multi-meter), the broken screen doesn't matter and that will save you some money buying test phones.

Phone Research

• Phone Scoop - Nokia Lumina 521
• Internal Photos Per FCC ID
• GSM Forum via Google Search
• Google Image Search: "Nokia Lumia 521 JTAG" - Looking for JTAG pinout images

What we know

• 1 GHz Qualcomm Snapdragon S4 MSM8270
• Windows Version 8
• 8GB
• Labeled JTAG Pinouts
• JTAG Box Support

JTAG Box Verification

As we can see here the ZX3 supports the Nokia Lumina 521.

And here were can see the JTAG pinouts provided by the Z3X JTAG box.

Phone Disassembly

Now that we have confirmed that at least one of our tools supports our Nokia Lumina 521 let's move forward with phone disassembly.

Prep and Clean the Taps

First our Taps are under a heat shield. I use my SMD re-work station (hot air) to remove the shield. Be careful not to burn up the board. Use a swiping motion when using the rework hot air gun as not to apply direct heat to the board for too long.

In this step we want to make sure our JTAG taps are clean. I do this by scratching away the layer to expose the copper taps. If we leave the layer of coating (not sure the name) it will not attract the solder and you will not be able to solder it.

After scratching them off I cleaned them with a Q-tip and some alcohol. After you do this blow on the board to dry the alcohol (happens quickly).

Soldering our JTAG Taps

These are some shots under my Microscope. It's too small without the microscope so I do all of the soldering this way. Some people will use medical glasses (think Dentist). I like the Microscope.

Here are some completed taps that I have applied solder to. At this stage I need to scratch off a few more taps, and then solder them as well.

Wiring the Phone

After all of the solder was placed on the taps I moved forward with wiring up the phone per the wiring diagram above.

I have connected it to the Z3X JTAG box. The device in the middle between the phone and the Z3X is a custom connector I created via OSH Park. It's just an easy medium that allows me to interface with the JTAG box more easily. If you want the schematics let me know and I can send it. It's about $4 - $5 per device in parts. It is not necessary. The Z3X and Riff box will come with a small PCB to interface with.

Dumping Phone Contents

Here is a copy/paste from the console log.

CPU IDCODE: 0x4F1F0F0F  
Mfg: 0x787  
Part: 0xf1f0  
CPU Manufacturer: Samsung  
CPU Name: ARM7GEN  

JTAG device: MSM8227  
CPU IDCODE: 0x207D00E1  
Mfg.: 0x070  
Part: 0x07d0  
CPU Manufacturer: QUALCOMM  
CPU Name: MSM8227  

EMMC 0:  
ID: 0x004A0090  
Name: H8G2d  
Size: 7.2 G  
Blocks: 15155200

EMMC 1  
ID: 0x004A0090  
Name: H8G2d  
Size: 2.0 M  
Blocks: 4096  

eMMC Flash Device(s) found:  
Device ID: 0x0090004a  

The dump is being read from EMMC address 0x000000000000 -> 0x000200000000 and being saved to the following location:

C:\Users\sysforensics\Desktop\NOKIA_LUMIA_521_0x00000000_0x200000000.bin  

The dumping process can take 2+ days with an 8GB phone. It's not something you can turn around to your department in an afternoon.

Now that we have the dump here:

NOKIA_LUMIA_521_0x00000000_0x200000000.bin  

Let's begin analysis.

Analysis

You will have a single bin file. Simply load it up in your analysis tool of choice and have at it. In this example I loaded it up in X-Ways and started carving for photos.

Analysis Results

There were a few boob pictures, multiple selfie pictures, some porn, family birthday party and my favorite a selfie with the couple smoking a joint and holding a bag of pot.

Yes.... Some people really are that stupid.

Finding Help

So you read the blog and you are still stuck. Here are a few sites that have some good information.

• GSM Hosting Forum
• Google and Google Images
• Baidu (Chinese Google)
• Unlock Forum
• GSM India
• Phone Scoop
• FCC ID Search
• The RIFF and Z23 Box themselves - They have pictures of JTAG taps, etc.
• I'm sure you have internal police mailing lists. Ask around for supported devices.

Summary

I hope you learned how to JTAG. Assuming the phones are supported by the tools it's dead simple. Don't let the solder iron and wires scare you away. You really can do this. If you can't, or don't want to let me know. I would be happy to help.