SlideShare uma empresa Scribd logo
1 de 7
iPhone Forensics




          Satish B
          Email: satishb3@securitylearn.net
Chain Of Trust – Normal Mode

      BootRom


      Low Level
      Bootloader


         iBoot



        Kernel     User Applications




                                       2
Chain Of Trust – DFU Mode

     BootRom



       iBSS



      iBEC



      Kernel   RAM DISK




                            3
Breaking the Chain Of Trust
      limera1n        BootRom



       Patch            iBSS


       Patch           iBEC


       Patch           Kernel


                                Custom RAM
                                   DiSK



                                             4
Forensics
       Creating & Loading forensic toolkit on to the device without damaging the
        evidence

       Establishing a communication between the device and the computer

       Bypassing the iPhone passcode restrictions

       Reading the encrypted file system

       Recovering the deleted files




                                                                                    5
References
        iPhone data protection in depth by Jean-Baptiste Bédrune, Jean Sigwald
        http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-
        iphonedataprotection.pdf
       iPhone data protection tools
       http://code.google.com/p/iphone-dataprotection/
       ‘Handling iOS encryption in forensic investigation’ by Jochem van Kerkwijk
       iPhone Forensics by Jonathan Zdziarski
       iPhone forensics white paper – viaforensics
       Keychain dumper
       25C3: Hacking the iPhone
       The iPhone wiki




                                                                                     6
Thank You

            Satishb3@securitylearn.net




            http://www.securitylearn.net




                                           7

Mais conteúdo relacionado

Mais procurados

iOS Forensics: Overcoming iPhone Data Protection
iOS Forensics: Overcoming iPhone Data ProtectioniOS Forensics: Overcoming iPhone Data Protection
iOS Forensics: Overcoming iPhone Data Protection
Andrey Belenko
 
OWASP Melbourne - Introduction to iOS Application Penetration Testing
OWASP Melbourne - Introduction to iOS Application Penetration TestingOWASP Melbourne - Introduction to iOS Application Penetration Testing
OWASP Melbourne - Introduction to iOS Application Penetration Testing
eightbit
 
iOS backdoors attack points and surveillance mechanisms
iOS backdoors attack points and surveillance mechanismsiOS backdoors attack points and surveillance mechanisms
iOS backdoors attack points and surveillance mechanisms
Dario Caliendo
 

Mais procurados (20)

iOS Forensics: Overcoming iPhone Data Protection
iOS Forensics: Overcoming iPhone Data ProtectioniOS Forensics: Overcoming iPhone Data Protection
iOS Forensics: Overcoming iPhone Data Protection
 
Hacking and Securing iOS Applications by Satish Bomisstty
Hacking and Securing iOS Applications by Satish BomissttyHacking and Securing iOS Applications by Satish Bomisstty
Hacking and Securing iOS Applications by Satish Bomisstty
 
Hacking and Securing iOS Apps : Part 1
Hacking and Securing iOS Apps : Part 1Hacking and Securing iOS Apps : Part 1
Hacking and Securing iOS Apps : Part 1
 
Hacking and Securing iOS Applications
Hacking and Securing iOS ApplicationsHacking and Securing iOS Applications
Hacking and Securing iOS Applications
 
Pentesting iPhone applications
Pentesting iPhone applicationsPentesting iPhone applications
Pentesting iPhone applications
 
IOS security
IOS securityIOS security
IOS security
 
OWASP Melbourne - Introduction to iOS Application Penetration Testing
OWASP Melbourne - Introduction to iOS Application Penetration TestingOWASP Melbourne - Introduction to iOS Application Penetration Testing
OWASP Melbourne - Introduction to iOS Application Penetration Testing
 
iOS-Application-Security-iAmPr3m
iOS-Application-Security-iAmPr3miOS-Application-Security-iAmPr3m
iOS-Application-Security-iAmPr3m
 
iOS backdoors attack points and surveillance mechanisms
iOS backdoors attack points and surveillance mechanismsiOS backdoors attack points and surveillance mechanisms
iOS backdoors attack points and surveillance mechanisms
 
WhatsApp Forensic
WhatsApp ForensicWhatsApp Forensic
WhatsApp Forensic
 
iOS secure app development
iOS secure app developmentiOS secure app development
iOS secure app development
 
IoT security zigbee -- Null Meet bangalore
IoT security zigbee -- Null Meet bangaloreIoT security zigbee -- Null Meet bangalore
IoT security zigbee -- Null Meet bangalore
 
Smart Bombs: Mobile Vulnerability and Exploitation
Smart Bombs: Mobile Vulnerability and ExploitationSmart Bombs: Mobile Vulnerability and Exploitation
Smart Bombs: Mobile Vulnerability and Exploitation
 
Code protection
Code protectionCode protection
Code protection
 
Operating Systems: Computer Security
Operating Systems: Computer SecurityOperating Systems: Computer Security
Operating Systems: Computer Security
 
Jailbreaking iOS
Jailbreaking iOSJailbreaking iOS
Jailbreaking iOS
 
Stealing sensitive data from android phones the hacker way
Stealing sensitive data from android phones   the hacker wayStealing sensitive data from android phones   the hacker way
Stealing sensitive data from android phones the hacker way
 
CNIT 128 Ch 3: iOS
CNIT 128 Ch 3: iOSCNIT 128 Ch 3: iOS
CNIT 128 Ch 3: iOS
 
CNIT 128 5: Mobile malware
CNIT 128 5: Mobile malwareCNIT 128 5: Mobile malware
CNIT 128 5: Mobile malware
 
Operating Systems: Computer Security
Operating Systems: Computer SecurityOperating Systems: Computer Security
Operating Systems: Computer Security
 

Destaque (6)

Pentesting web applications
Pentesting web applicationsPentesting web applications
Pentesting web applications
 
Forensic analysis of iPhone backups (iOS 5)
Forensic analysis of iPhone backups (iOS 5)Forensic analysis of iPhone backups (iOS 5)
Forensic analysis of iPhone backups (iOS 5)
 
Forensic Expert Cross Examination
Forensic Expert Cross ExaminationForensic Expert Cross Examination
Forensic Expert Cross Examination
 
iPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes BackupiPhone Forensics Without iPhone using iTunes Backup
iPhone Forensics Without iPhone using iTunes Backup
 
iCloud keychain
iCloud keychainiCloud keychain
iCloud keychain
 
Reverse Engineering iOS apps
Reverse Engineering iOS appsReverse Engineering iOS apps
Reverse Engineering iOS apps
 

Semelhante a iPhone forensics on iOS5

iPhone forensics course overview
iPhone forensics course overviewiPhone forensics course overview
iPhone forensics course overview
Satish b
 
CSFI Stuxnet Report
CSFI Stuxnet ReportCSFI Stuxnet Report
CSFI Stuxnet Report
Amr Ali
 
Information security questions
Information security questions Information security questions
Information security questions
gamemaker762
 
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docxCase StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
wendolynhalbert
 
(Pdf) yury chemerkin def_con_2013
(Pdf) yury chemerkin def_con_2013(Pdf) yury chemerkin def_con_2013
(Pdf) yury chemerkin def_con_2013
STO STRATEGY
 

Semelhante a iPhone forensics on iOS5 (20)

IT Essentials Chapter 9
IT Essentials Chapter 9IT Essentials Chapter 9
IT Essentials Chapter 9
 
Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS Defending Against the Dark Arts of LOLBINS
Defending Against the Dark Arts of LOLBINS
 
CONFidence 2015: iOS Hacking: Advanced Pentest & Forensic Techniques - Omer S...
CONFidence 2015: iOS Hacking: Advanced Pentest & Forensic Techniques - Omer S...CONFidence 2015: iOS Hacking: Advanced Pentest & Forensic Techniques - Omer S...
CONFidence 2015: iOS Hacking: Advanced Pentest & Forensic Techniques - Omer S...
 
iPhone forensics course overview
iPhone forensics course overviewiPhone forensics course overview
iPhone forensics course overview
 
EkoParty 2010: iPhone Rootkit? There's an App for that.
EkoParty 2010: iPhone Rootkit? There's an App for that.EkoParty 2010: iPhone Rootkit? There's an App for that.
EkoParty 2010: iPhone Rootkit? There's an App for that.
 
CSFI Stuxnet Report
CSFI Stuxnet ReportCSFI Stuxnet Report
CSFI Stuxnet Report
 
Nand mirroring
Nand mirroringNand mirroring
Nand mirroring
 
Mobile security - Intense overview
Mobile security - Intense overviewMobile security - Intense overview
Mobile security - Intense overview
 
ASFWS 2011 - Secure software development for mobile devices
ASFWS 2011 - Secure software development for mobile devicesASFWS 2011 - Secure software development for mobile devices
ASFWS 2011 - Secure software development for mobile devices
 
N.sai kiran IIITA AP
N.sai kiran IIITA APN.sai kiran IIITA AP
N.sai kiran IIITA AP
 
128-ch3.pptx
128-ch3.pptx128-ch3.pptx
128-ch3.pptx
 
Information security questions
Information security questions Information security questions
Information security questions
 
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docxCase StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
Case StudyA recent theft of Cisco Systems Inc,’s Internet Operat.docx
 
SOK:An overview of data extraction techniques from mobile phones
SOK:An overview of data extraction techniques from mobile phonesSOK:An overview of data extraction techniques from mobile phones
SOK:An overview of data extraction techniques from mobile phones
 
AusCERT - Developing Secure iOS Applications
AusCERT - Developing Secure iOS ApplicationsAusCERT - Developing Secure iOS Applications
AusCERT - Developing Secure iOS Applications
 
Yow connected developing secure i os applications
Yow connected   developing secure i os applicationsYow connected   developing secure i os applications
Yow connected developing secure i os applications
 
Firmware analysis 101
Firmware analysis 101Firmware analysis 101
Firmware analysis 101
 
(Pdf) yury chemerkin def_con_2013
(Pdf) yury chemerkin def_con_2013(Pdf) yury chemerkin def_con_2013
(Pdf) yury chemerkin def_con_2013
 
3 Nir Zuk Modern Malware Jun 2011
3 Nir Zuk Modern Malware Jun 20113 Nir Zuk Modern Malware Jun 2011
3 Nir Zuk Modern Malware Jun 2011
 
Bulletproof IT Security
Bulletproof IT SecurityBulletproof IT Security
Bulletproof IT Security
 

Último

Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
ZurliaSoop
 
Spellings Wk 3 English CAPS CARES Please Practise
Spellings Wk 3 English CAPS CARES Please PractiseSpellings Wk 3 English CAPS CARES Please Practise
Spellings Wk 3 English CAPS CARES Please Practise
AnaAcapella
 

Último (20)

Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024Mehran University Newsletter Vol-X, Issue-I, 2024
Mehran University Newsletter Vol-X, Issue-I, 2024
 
80 ĐỀ THI THỬ TUYỂN SINH TIẾNG ANH VÀO 10 SỞ GD – ĐT THÀNH PHỐ HỒ CHÍ MINH NĂ...
80 ĐỀ THI THỬ TUYỂN SINH TIẾNG ANH VÀO 10 SỞ GD – ĐT THÀNH PHỐ HỒ CHÍ MINH NĂ...80 ĐỀ THI THỬ TUYỂN SINH TIẾNG ANH VÀO 10 SỞ GD – ĐT THÀNH PHỐ HỒ CHÍ MINH NĂ...
80 ĐỀ THI THỬ TUYỂN SINH TIẾNG ANH VÀO 10 SỞ GD – ĐT THÀNH PHỐ HỒ CHÍ MINH NĂ...
 
How to setup Pycharm environment for Odoo 17.pptx
How to setup Pycharm environment for Odoo 17.pptxHow to setup Pycharm environment for Odoo 17.pptx
How to setup Pycharm environment for Odoo 17.pptx
 
Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The Basics
 
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptxHMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
HMCS Vancouver Pre-Deployment Brief - May 2024 (Web Version).pptx
 
Understanding Accommodations and Modifications
Understanding  Accommodations and ModificationsUnderstanding  Accommodations and Modifications
Understanding Accommodations and Modifications
 
Basic Civil Engineering first year Notes- Chapter 4 Building.pptx
Basic Civil Engineering first year Notes- Chapter 4 Building.pptxBasic Civil Engineering first year Notes- Chapter 4 Building.pptx
Basic Civil Engineering first year Notes- Chapter 4 Building.pptx
 
Google Gemini An AI Revolution in Education.pptx
Google Gemini An AI Revolution in Education.pptxGoogle Gemini An AI Revolution in Education.pptx
Google Gemini An AI Revolution in Education.pptx
 
Accessible Digital Futures project (20/03/2024)
Accessible Digital Futures project (20/03/2024)Accessible Digital Futures project (20/03/2024)
Accessible Digital Futures project (20/03/2024)
 
FSB Advising Checklist - Orientation 2024
FSB Advising Checklist - Orientation 2024FSB Advising Checklist - Orientation 2024
FSB Advising Checklist - Orientation 2024
 
Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
Jual Obat Aborsi Hongkong ( Asli No.1 ) 085657271886 Obat Penggugur Kandungan...
 
This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.
 
ICT role in 21st century education and it's challenges.
ICT role in 21st century education and it's challenges.ICT role in 21st century education and it's challenges.
ICT role in 21st century education and it's challenges.
 
Spellings Wk 3 English CAPS CARES Please Practise
Spellings Wk 3 English CAPS CARES Please PractiseSpellings Wk 3 English CAPS CARES Please Practise
Spellings Wk 3 English CAPS CARES Please Practise
 
How to Manage Global Discount in Odoo 17 POS
How to Manage Global Discount in Odoo 17 POSHow to Manage Global Discount in Odoo 17 POS
How to Manage Global Discount in Odoo 17 POS
 
Python Notes for mca i year students osmania university.docx
Python Notes for mca i year students osmania university.docxPython Notes for mca i year students osmania university.docx
Python Notes for mca i year students osmania university.docx
 
General Principles of Intellectual Property: Concepts of Intellectual Proper...
General Principles of Intellectual Property: Concepts of Intellectual  Proper...General Principles of Intellectual Property: Concepts of Intellectual  Proper...
General Principles of Intellectual Property: Concepts of Intellectual Proper...
 
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdfUnit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
 
HMCS Max Bernays Pre-Deployment Brief (May 2024).pptx
HMCS Max Bernays Pre-Deployment Brief (May 2024).pptxHMCS Max Bernays Pre-Deployment Brief (May 2024).pptx
HMCS Max Bernays Pre-Deployment Brief (May 2024).pptx
 
Making communications land - Are they received and understood as intended? we...
Making communications land - Are they received and understood as intended? we...Making communications land - Are they received and understood as intended? we...
Making communications land - Are they received and understood as intended? we...
 

iPhone forensics on iOS5

  • 1. iPhone Forensics Satish B Email: satishb3@securitylearn.net
  • 2. Chain Of Trust – Normal Mode BootRom Low Level Bootloader iBoot Kernel User Applications 2
  • 3. Chain Of Trust – DFU Mode BootRom iBSS iBEC Kernel RAM DISK 3
  • 4. Breaking the Chain Of Trust limera1n BootRom Patch iBSS Patch iBEC Patch Kernel Custom RAM DiSK 4
  • 5. Forensics  Creating & Loading forensic toolkit on to the device without damaging the evidence  Establishing a communication between the device and the computer  Bypassing the iPhone passcode restrictions  Reading the encrypted file system  Recovering the deleted files 5
  • 6. References  iPhone data protection in depth by Jean-Baptiste Bédrune, Jean Sigwald http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam- iphonedataprotection.pdf  iPhone data protection tools  http://code.google.com/p/iphone-dataprotection/  ‘Handling iOS encryption in forensic investigation’ by Jochem van Kerkwijk  iPhone Forensics by Jonathan Zdziarski  iPhone forensics white paper – viaforensics  Keychain dumper  25C3: Hacking the iPhone  The iPhone wiki 6
  • 7. Thank You Satishb3@securitylearn.net http://www.securitylearn.net 7