all right
so hello bluetooth village and welcome
to my talk
so i'll be discussing for today a title
called forensicating endpoint artifacts
in the world of cloud storage services
my name is friends and crews
and then i'll be starting and sharing my
screen
i hope you can see my screen
there you go okay let's start
so again my name is renzon cruz i'm
a dfir guy i'm doing digital forensics
and incident response on my work in one
of the companies in uk
uh but i'm based here in dubai i'm also
an ex-security consultant
ir i'm part of the ncsa or they call it
a national
cyber security agency in one of the
countries in middle east
i'm also a co-founder of gaidem so we do
specialize
in a training program for aspiring um
cyber security professionals and we do
offer
like cyber defense threat hunting vapt
kind of thing
and also i got accepted um by various
conferences
um such as besides london vancouver doha
root call in philippines uh recently we
had the north sec
couple of months ago in montreal and now
here
in bluton village at defcon so thank you
so much
for those btv folks and
for the councils who accepted my top
and just a caveat there that this is
not a talk primarily related to the big
three
or uh the the big three cloud service
providers such as aws
from amazon gcp or google cloud
platform and also microsoft azure so if
you're here
uh just to learn more about this stuff
so this is not the talk for you
i'm particularly discussing
uh the cloud storage services and maybe
some
maybe probably in the near future i'll
be discussing this
and um we'll talk about cloud forensics
and ir
um that and also um the things that you
have to do
when there's an incident but for now uh
we're just going to discuss
the cloud storage and also the
footprints leaving behind on the
endpoints
and this is what i'm saying i will be
analyzing the footprints related to the
box
dropbox um google drive mega
and also uh onedrive okay so these are
the primary cloud storage apps that we
have today
uh there are a couple of versions or two
versions that we have
for this so number one is the personal
drive which typically used by the
consumers
and there is also a second one which is
the business version
okay so on the business versions the the
main difference there is the added
features such as
file on demands uh there's also a
different retention policy that you can
extend
from 90 days up to whatever you want
depends on
the storage that you have and also more
robust lagging
but on this stuff we're just gonna focus
and showcase
more on the personal version itself now
the question is in the world where the
most important data is
only present on probably third party
systems how do we effectively accomplish
our analysis and investigations is there
anything left
on the endpoint that can be used for
forensics
so that is the topic that i'm going to
discuss
mainly to to have a forensic goodness
and showcase this
uh forensic goodness of these five
predominate cloud storage apps
that we have and i also have um a logo
here
in icloud but basically um it's quite
popular
especially for those apple fanboys out
there but it tends to be used
by smaller organizations
and here's going to be the agenda for
today why do we care
okay some use cases some incidents that
we do
have from the past um what are the
forensics value and
the metadata the the informations that
we can get
by analyzing the metadata or the
evidence
and also i'll be showing you um a quick
rundown of how we can perform an
evidence acquisitions
using couple of tools
all right so now is this so
we have a problem and uh these cloud
storage
are being used by most of the adversary
nowadays
so you may be familiar with miter so you
may
see on on the right of my screen that
there is
um a screenshot related to miter
techniques
uh that talks about exfiltration over
web services
exfiltration to cloud storage so that is
exactly
a technique id 1567.002
which consists of subtechnics so
adversaries keeps on using this to
accelerate data
and also to store those stolen data from
their victim and we have here also a
couple of
adversaries that keeps on using it
number one here is
the camera so chimera abuses cloud
service
services to exfiltrate data they are
actually using
uh onedrive accounts to exfiltrate those
stolen data
purila which is um been here for a
couple of years already it's not new
but they also use a one drive and four
shared
the latest one uh which we do have a
couple of months ago from microsoft
which is the half new so hafnium as per
the reports
based from the threat intelligence uh
they also exfiltrates data
on file sharing sites like mega or mega
sin
and last thing is empire so there is
this kind of module
which is particularly for c2 that
leverage
dropbox to perform data exfiltration
um so now the question is why do we care
of course we do care so cloud storage
can be used uh to perform the
x fill so we need to look for those
remnants and also artifacts that could
lead us
to more granular information and more
data
it can also be used or heavily used by
insider threat especially if your
company
doesn't have proper policy or even like
uh data loss prevention tools
uh to detect those internal documents
being shared
uh being uploaded being downloaded by
someone by your employees
then you will be on a mass condition
extremely useful of course especially
when we are doing some analysis
as it leaves tons of trails and also
artifacts
that can be used to track down the
activities uh what are
the tasks that are being done by your
employees or by the adversary by just
looking
into these footprints um
so these are the things that we have um
collect or we can collect from the
evidence standpoint
so we can collect local files or even
the cloud files uh the sync files on the
local drive
or even on the cloud file itself
so we have here something like
databases and cloud and logs so
databases and logs can be beneficial
to get most of the metadata that we need
especially the the modified time the
timestamp
um the different hashes you will be
surprised that there are a couple of
hashes that are available
depending on the cloud storage that we
are using so there are
storages that are using xiao one there's
a storage that is using
md5 hashes and also the file names of
the file itself other thing that is also
useful for us
is the deleted items so of course every
forensic examiner loves to examine
deleted items especially in ir we would
like to know what are those files that
they're trying to hide for us
and last thing is the operating systems
artifacts
this could be a bunch of windows
artifacts such as lnk files
prefetch files registry entries and even
event logs
jump lists uh and also memory dump so if
ever
you guys are using uh these kind of
cloud storage apps
then once you execute this once you use
this this will be existing
almost everywhere almost um everywhere
on the os
uh artifacts that we have known
next is the endpoint footprint so
technically cloud storage
applications leave large footprints on
the endpoint
so by checking the local systems you can
see a lot of artifacts
that can be useful for our analysis so
one thing
is account details so what file success
currently being shared with the user
uh what files may be available not on
the system but available potentially
in the cloud storage what is also the
files that are being downloaded
being transferred what are the accounts
that
they've used to share these files so in
addition to that we have also a bunch of
timestamps
um that we can correlate with the user's
activities
so other thing is like the hashes that's
what i've mentioned
um depending on the cloud storage it
gives us the information of the hash
uh that we can use uh to perform some
comparison
uh that they can use for being stored or
being transferred
uh from different um recipients
now let's start so welcome to dropbox
this is one of my favorite
and uh not favorite when it comes to
investigations but one of the first
stories that i've used so a couple of
years ago but this is also the worst
cloud storage not in terms of the
features of scalability and the ui
it's actually awesome it's actually good
it's just that
it's hard when it comes to analysis and
investigations because um
it is difficult cloud storage because of
the primary databases
are encrypted using windows dp api so
you have to decrypt it
so you have to use some tools you have
to get the keys for you to decrypt it
but once you decrypted it
it will be easy to navigate because it
is also using um
a normal um type of database
which is on an sqlite so if you have
like an sqlite viewer
then you can easily see this kind of
format they used to be pretty
straightforward a couple of years ago
but
uh they changed how they did things um
so there
is one metadata here which is what we
call the file cache that dbx
so this is the most important artifacts
that you can have in dropbox
as it contains most of the metadata that
is locally synchronized
files um also uh the file cache and the
config again
these are actually encrypted but there
is an open source tool that we can use
to decrypt this
uh using the api toolkit made by
francesco
picasso okay so he's a researcher and
then he created this turkey to decrypt
this kind of stuff
so i have also mentioned here uh one of
the good talk
a couple of years ago since year 2012
so during 2012 there was a talk in
hectatlou which is a conference in
luxembourg
by two grade gens in the topic of a
critical analysis
of dropbox software security so they
discovered
that the encryption key used for the dbx
files that are encrypted
is kept in the registry and it's
protected by again the dp api
so i just mentioned here the link so you
can just
visit this and look at the paper it's
kind of interesting
next is onedrive which is the most
popular
due to the windows having it as
installed by default started
um on windows 8 plus version
so in most cases you may see this on the
default old
folder onedrive but sometimes it can
also be
as skydrive so if you're examining uh
let's say
uh a case and then you can see that
there's a skydrive that is actually a
onedrive so
skydrive was the old name of onedrive
which is microsoft
acquired for from years ago
and uh as what i mentioned there is a
two variants of this
um one is the personal and the second is
the business variant of onedrive so the
good thing about the business one is
that gives you um a log called unified
unified
audit logs or ual so ual is
enabled by default now for every user in
the corporate which gives you a 90 days
retention by default okay so once
you extract certain of certain logs uh
in ual
like for example you are investigating a
user on your
um company and then if you extract the
report could be
via csv or it could be the web ui that
they have there then you can get the
audit logs
like the user's iap address um the
account itself
and the file stats whether the the user
modified an account
or modify the certain file on the
sharepoint if he deleted something
if he accessed something or even a copy
so that is
existing on a uil or unified audit logs
but for this talk i'll be just focusing
on the personal
variant of onedrive so
we also have here a metadata called
that d80 file a user seed that d80 file
which basically gives us the list of
local files
and cloud files names so
here these are the three types of the
states
when onedrive
do some files on demand so one of the
cool things about this
onedrive is the concept of this the
files on demand
so only a subset of available files
are likely resident in the local file
systems
so as you may see here on my screenshots
that there are three types so number one
the first one the cloud icon that states
that
the file or folder that is only existing
on the cloud itself okay so it's not
existing
on your local drive the second thing is
the green check mark states
that it is temporarily cached so
if a user um go to this directory and
then
when when they open it then that
actually gives them a temporary cache of
the file itself
and then the last thing which has the
white check icon inside the green circle
that states that the file has been
always kept on this device or
it is stored locally so if you right
click a certain file
then that gives you an option of always
kept on the device
so that means that this will be
available on the local file
as well as on the cloud file but uh
most of the time when you see this cloud
icon on the first one this is being
called as reports point
so these are actually just a
placeholders so the files is not
existing on the hard disk
but you can get the metadata and it is
um um it will be the reference
uh file to the existing file on the
cloud okay so sometimes
once you image a certain hard disk then
you'll be surprised that
the file is not existing but this is
existing on the cloud
because of that because the reason why
is this is just
a reports point unless the user click
the available um put this as
available or always kept this on the
device or on the local file
then once you image your machine then
you will get the exact file and not just
the metadata
another metadata or artifacts that
we can use for our investigations here
are the dot
ina file because that gives us the
one rev location information also
there's also a time stamp like a last
time
that one drive was synchronized with the
cloud and
also the bytes transfer the request sent
which is the amount of activity
during the sync file there is also a
text file here
as you can see on my screen the profile
service response.txt file this is
actually in the json format
and it gives us the information of the
first and the last name of the user
plus their microsoft account okay and
the email address
and the last one thing here which
doesn't have the red box
so there is this file called um that
d8t file so it shows the active file on
the sync folders
including the local files and the files
available on the cloud
so here what i did here is to perform a
b strings
or a tool from eric zimmerman so i think
they call it better strings
so once you perform a b strings here on
a d80 file
then that gives us a result of all the
files that exist
on our local local drive
okay so um that identifies also
whoever the user is and also
uh the file names itself and on the
right side of my screenshot you can see
there the notepad
that i've just opened which basically
gives you the name
and also the last name of the user as
well as his microsoft account so you may
see there
that my user email that i've used there
is cruise runs on
gmail.com this is based on the json
format
next is box which is the most
forensically uh
and friendly app that we can deal with
okay so this is one of my favorite
when it comes to performing an analysis
because it's easy to navigate and also
it's easy
to investigate they're also using an
sqlite
databases that provides the metadata
like timestamps the sha one
and for online and offline files okay
so also the the directories that you can
find the local files
are residing on the user profile
and then box so this is by default but
this can be um changed by the adversary
too
so on the box file you can see here that
there's a database called sync
that db so this is um
this contains more of the identifying
the items currently tracked by the box
drive application
you can see here that there are tons of
useful information
uh when you go to box item column or
table from the sync.db database
um you can see there that there is a
parent item
column there's also a file name there's
also
um the checksum you can see there that
this is on a show one
there's also uh some time stamp which
you need to convert in an ewatch time
next thing is google drive uh there are
two types of google drive that we need
to consider here
there is a google drive or google backup
and sync
so that is the new term now which they
replaced the original google drive
applications
uh on the year 2018 so this is the
default
desktop applications for consumer that
uses
google drive okay so the other one is
when let's say when you are when your
company is using an enterprise version
of that then
they call it google workspace or they
call it g
suite or g-suite fs or g-suite file
stream
so it is available on the g-suite
customers always the same
features or backup and sync with the
additions of
files on demand like the box and the
one drive okay so still the databases of
this
google drive or the google backup and
sync uses the form of
sql sqlite version of database
[Music]
and we do have here some metadata uh
which are useful databases uh so it's
not encrypted so you can see here
um the cloud grub dot db
so you will get tons of information such
as a modified time which is
again in unix epoch time we can also get
here the md5 hashes of the files
so we can run some comparison of the
existing files
whether there is a file that has been
changed modified
by the adversary or maybe if it's being
deleted
uh by someone okay so there is also a
shared column here which is kind of
interesting
okay shade column here um means if it's
one then it is being shared but if it's
zero if it's the data
um have zero value then it means that
this is not shared
another column here that is kind of
interesting to me is the dot type
okay you can see there that the doc type
consists of two values on my screenshots
there is a zero and one so if the
doctype
has a value of zero it means that that
is a folder
but if the doctype has a value of one
that means that these are
real files like if it's a pdf it could
be a text
it could be a document or powerpoint
excel
etc okay next
is or the last thing that we'll be
discussing right now
is mega sync okay so mega heavily used
by adversary
because they said that mega is one of
the most secured
applications or cloud storage services
that are being used
by the people okay so mega so
mega actually is um having a word or
it stands for mega encrypted global
access
so they are claiming that they are
focused um
uh that um i mean their service is
focused heavily on security and they are
using an end-to-end encryption
and they are also the one who is
claiming that they're using a zero
knowledge
encryption okay so zero knowledge
encryption means that
uh in this case uh there's no one
besides you
has the keys to your data and not even
the service
you're starting your files with so they
are claiming
that we don't have any access to the
keys that you have there
so you only have you are the one who
only have
the access to your files so if you lose
the keys
or if you lose uh some sort of the pass
price that they gave to you once you
register your account
then they don't have any um
a way to recover it okay so that's why
attackers love using mega because of
this claim
and some of the local files that you can
see from the window sides
is uh existing on the user profile app
data
mega limited mega sync slash lags
as you can see on my screenshot that you
can see there
the log files if you open it you can see
there
uh what was the file that has been
recently
downloaded from my mega account and also
in mega
on the web ui you can see there that
they also stored
deleted files on the rubbish bins
so i'm not sure how they started
um i think um for 30 or 90 days as well
like the same cloud storage apps there
but
once you delete a file then that would
be stored on the rubbish bin
it acts like the recycle bin on windows
there's also this local folder and a
cloud folder where you can just drop
anything there so
i have here a test folder existing on my
local drive
so if ever i drop anything there then
that will automatically upload
on my mega account as long as i have my
internet
and um like what we have on other cloud
storage apps
you can also see most of these once you
execute this
in most of the os artifacts such as lnk
and even in event logs as you can see on
my screenshots
prefetch files this that will
automatically exist
of course because that's an artifact for
executions and also on the
master file table you can see that
there's a lot of mega
applications or traces that
i'm i'm the one or the user is using
mega
sync cloud storage apps so that would be
the last one
and now let's have a discussions on
how can we perform an acquisition okay
so
on the cloud storage uh collections most
of these
are uh leveraging the api functions so
you need to um you need to to give them
the credentials so that they can perform
the activities such as evidence
acquisition acquisitions
so there are a couple of stuff here so i
have here another github repo that could
be
good to perform um evidence acquisitions
on the g suite platform
uh so it's free there's also a default
um take out from google over in you can
dump
most of the logs that you need from your
investigation
and on the predominant
enterprise um applications that you can
find uh
from the collection sites which are the
f response
uh celebrite so celebrate has this
um cloud forensics um analysis module
two
and of course magnet forensics so magnet
axiom
so useful i've used this before um they
are
very good when it comes to providing and
parsing
um a lot of fields artifacts that you
can find
on any cloud storage that you are using
so these are um the things that are
commonly being seen
that investigators are using so just
check it out
and this is the summary of the cloud
storage um
files that we can get on each um
applications
so it would be better to have this as a
reference guide
and right now what if we need to get
this
from the endpoint so let's say we need
to get the artifacts the footprints
um that we can get from from the host
level so what could be the tool that we
can use
so if you're not familiar with cape so
this is an absolutely amazing tool
made and written by eric zimmerman so
there are two modules from cape there is
a target and and then there's also
a module which could be done by parsing
all of the files and gives you a result
on an x
an excel format or csv format
which i will be performing in demo so
again this
is free you just have to
subscribe to crawl go to the crawl
website
and then you just have to supply your
email
and then they will just give the link to
you okay so there are a couple of
modules here
which is entirely for cloud storage
contents and
metadata so that is an absolutely
amazing tool
um all you have to do is just just click
uh like few clicks and then you have to
wait for it to finish
now it's demo time i will be just uh
be presenting it to you let me just
um share my screen again
okay so now this
is the video that i'll be showing to you
so here this is my um computer this is
my desktop so
what we'll be doing is to perform an
evidence acquisitions
based on the footprints based on those
artifacts those locations
directories that we have just discussed
by using a tool called cape by eric
zimmerman
okay so i will be launching here cape uh
on my
um desktop and then
after a few seconds it will be appearing
here so i'll be using your target which
is basically
uh where should i get those evidences
so i just have to put um my c drive here
and the next thing is where should i put
uh the output or where it will dump most
of those artifacts that
it will be collecting and the next is
getting um the modules or getting
um the or putting the cloud storage
there
so as you can see there that if i click
that option then that gives me the
artifacts from the dropbox
from the onedrive from the google drive
and also there's the sugar sync here
okay so after confirming
that this will be the options that i
need to do
i just have to convert and also put a
container in the hdx
so that i can easily just open it into
whatever computers that i have
and then i'll be putting a cloud base
name which is a cloud storage
um underscore artifacts okay so
once i'm done then that's it you just
have to click the execute
and then let's wait for this to finish
okay so um so this would take me
um less than a minute i think and
um after that then it will be dropped on
the folder that we have just stated on
the target destinations
and then we can start our investigation
so this will ease us because sometimes
we tend to forget
where are the artifacts located um
where are the default path where are the
database being located
then this could be so um this could
solve our
problems and it's very easy and it's
very
um fast as well as you can see here it's
already done
and uh it took us only 40 seconds to
finish
and now let's extract what are the files
that we just got
using
okay so now so i just dump
everything on the cape output target as
you can see here
that those files are
copied already on my directory
so you can see here the app data if you
go to that
you can see here the box the dropbox the
google drive and also the microsoft
or the onedrive so if you go to the box
you can see here
oh most of the logs that we've just
discussed on the data you can see there
the databases
where we can extract a couple of
evidences and information
and yeah
and dropbox you can see here here the
sync history
the config dbx files and
things like that
okay so that's how you perform evidence
acquisitions by using
cape as a tool which is a free tool and
uh it took us only a minute
to get those artifacts that we need are
based on the cloud storage apps that we
are using
and uh that's it for me that's my demo
and let's go back to my slides and uh
actually that's it um
is there any question
right
so that's it for me that is my talk
and if ever you have um questions
uh related to the topic please do let me
know
um and these are a couple of the
references
related to this stock and
yeah these are my handles are my twitter
handler a runzeck
and my link in uh and also my email so
if you have any questions
please do let me know please reach out
and that's it
thank you so much bluton village for
um having me here of course and um
i'll be opening the floor for any
questions that we have from the audience