Heather Mahalik and I teamed up again this year at the SANS DFIR Summit to present on iOS CarPlay and Android Auto.
Presentation is here. Will post a link to the video when it’s available.
Always a good time and love seeing friends every year. Still one of my favorite conferences! It was a nice surprise winning a couple of Forensic 4cast awards too! Thank for your votes! ☺️
I had the pleasure last week to attend MacDevOpsYVR in Vancouver, Canada. While I barely saw the city, I got to hang out with some awesome Mac Sys Admins and Dev Ops people. I’ve not been to a conference outside of Security/Forensics before so it was a delight to see the types of presentations and insight these fine folks had to offer.
The presentation includes how my APOLLO project has evolved over the last few months since it was introduced in November, 2018. I also go though some of my real life pattern-of-life examples from my iOS 12 device. We talked about everything including to my health, moving bodies (and chopping them up!), taking selfies, and how much I will spend for good food. Once the video is released I will be sure to upload a link to it, it will certainly provide more (humourous) context to the slides. [Edit 06/18/2019 - Video here!]
A unique addition to normal conference presentations was the use of a graphic recorder (Ashton of Mind’s Eye Creative) to provide additional context to the presentations. She records in real time key points of each presentation and does an absolutely fantastic job at it. This allows for additional context for discussions after the presentation with fellow attendees. Example of my talk is below:
As always, my presentations are always available on my Resources page.
Direct Link to the presentation is here!
Just got back from a wonderful time hanging out with the who’s who of Mac security folk in swanky Monaco at the Objective by the Sea conference. I’ve uploaded my presentation Watching the Watchers in my Resources section. This presentation goes through some of the forensically useful artifacts of the following 3rd party monitoring software:
Objective-See Tools (LuLu, BlockBlock, Do Not Disturb, Oversight)
Direct link to the presentation here.
I cannot recommend enough that the OBTS conference is absolutely worth going to if you are at all involved in Apple Security. Next one is ~Q1 2020 and back in Maui!
Many modules were updated to specially support iOS 12 including those below. Many were already available on iOS 12 (Powerlog, Passes, SMS, etc) without a jailbreak. As always, let me know if I missed something! Remember the ‘yolo’ option can always be used to attempt to get those entries if official support in the module has not been added.
KnowledgeC.db with new iOS streams!
App “Usage” – Still researching on how this one is different that App in Focus. Perhaps background usage?
‘Do Not Disturb’ Mode
Routined - Looks like Apple changed the database schema to change/remove much of the location reverse geolocation protobuf BLOBs that were in the Cache.sqlite, Local.sqlite, Cloud.sqlite databases. Queries have been updated to account for this.
Still working on a few other queries like Screen Time as well as a few more programatic updates.
I started filling in the gaps to missing APOLLO modules. While doing this I realized there was some capability that was missing with the current script that had to be updated. As far as script updates go the following was done:
Support for multiple database name -Depending on the iOS version being used the database names may be different but the SQL query itself is the same. Instead of creating many redundant modules I now have it looking for the different database filenames.
Support for multiple queries on different iOS versions- You will now notice that all the modules have been updated with iOS version indicators and multiple SQL queries compatible for that version. Some going back as far as iOS 8! I put in as much legacy support as I had data for. I will likely not add much more unless it is by special request. I can’t imagine there is a whole lot of iOS 8 analysis going on out there, but you never know! I have kept it to major iOS release numbers and have tested with the data I have but it may have changed with a minor point release, if you find this to be true please feel free to let me know!
Module Timestamp Rearrangement and Module Cleanup– I’ve started to go through some of the modules and move the items around to make it easier to see what is going on with each record. I’ve mostly just moved the timestamps toward the end since most of them are shown in the Key column. I’ve also removed some superfluous columns and extraneous junk in the queries. I’m really only trying to extract the most relevant data.
A few notes on script usage change. The script flags have changed, with the added arguments of -p = platform (iOS support only for now), and -v = iOS Version. You may also notice the new ‘yolo’ option – this one will likely be error prone if you are not careful. Use this when you what to run it on any database from any platform. It can also be used with your own custom modules if you don’t have versioning in them.
An example of the module changes is below. Notice the multiple databases listed. In this example, the same location data can be extracted from the cache_encryptedB.db or the cache_encrypted A.db databases depending on the iOS versions. The version information is listed in the “VERSIONS” key, while the specific queries have versions listed in the [SQL Query …] brackets, this is the version that the apollo.py script is following.
The big updates were with the modules, lots of new support! I now have support for 129 different pattern-of-life items! Most of the support is for iOS, however if you run the queries themselves on similar macOS databases you will find that many of them will work. Better macOS support is coming, I promise.
Application Specific Usage:
Chat – SMS, iMessage, & FaceTime messages extracted from the sms.db database.
sms_chat
Call History – Extracted from CallHistory.storedata database.
call_history
Safari Browsing – Extracted from the History.db database.
safari_history
Apple Pay/Wallet - Extracted from iOS passes23.sqlite database.
Apple Pay Transactions - passes23_wallet_transactions
Wallet Passes - passes23_wallet_passes
Location :
locationd - The following modules extract location data from the [lock]cache_encryptedA.db & cache_encryptedB.db databases. This will include various cellular and Wi-Fi based location tables as listed in the module filename.
locationd_cacheencryptedAB_appharvest
locationd_cacheencryptedAB_cdmacelllocation
locationd_cacheencryptedAB_celllocation
locationd_cacheencryptedAB_celllocationharvest
locationd_cacheencryptedAB_celllocationlocal
locationd_cacheencryptedAB_cmdacelllocationharvest
locationd_cacheencryptedAB_indoorlocationharvest
locationd_cacheencryptedAB_locationharvest
locationd_cacheencryptedAB_ltecelllocation
locationd_cacheencryptedAB_ltecelllocationharvest
locationd_cacheencryptedAB_ltecelllocationlocal
locationd_cacheencryptedAB_passharvest
locationd_cacheencryptedAB_poiharvestlocation
locationd_cacheencryptedAB_pressurelocationharvest
locationd_cacheencryptedAB_scdmacelllocation
locationd_cacheencryptedAB_wifilocation
locationd_cacheencryptedAB_wifilocationharvest
locationd_cacheencryptedAB_wtwlocationharvest
locationd – These modules extract motion data from the cache_encryptedC.db database. Not specific location data but will show device movement.
locationd_cacheencryptedC_motionstatehistory
locationd_cacheencryptedC_nataliehistory
locationd_cacheencryptedC_stepcounthistory
routined – Extracts location data from the cache_encryptedB.db database. If you have a keen eye you will notice the database name is the same as from ‘locationd’. Completely different database with different data stored in two different directories.
routined_cacheencryptedB_hint
routined_cacheencryptedB_location
Health Workouts – Using the healthdb_secure.sqlite database I’ve extracted much of the metadata from workouts. I’ve also determined some of the workout types (ie: HIIT, Rower, Run, Walk, etc), but have not enumerated all of them yet. Please let me know if you come across others – easier if you do this on your own data and can easily look it up. Same for weather conditions (Sunny, Rainy, etc.).
health_workout_elevation
health_workout_general
health_workout_humidity
health_workout_indoor
health_workout_location_latitude
health_workout_location_longitude
health_workout_temperature
health_workout_timeofday
health_workout_timezone
health_workout_weather
