Cyber Dust Privacy Claims Debunked

April 2, 2015

Cyber Dust Privacy Claims Debunked

One of the most popular experiments we’ve performed, and associated blog articles we’ve written, through the first quarter of 2015 was our testing of “private” mobile app, Cyber Dust.  In fact, as of the publication of this article, that blog alone has garnered over 1600 views and climbing.  This is due in part to the popularity of the app, the consumer push for user privacy, the marketing efforts of app bank-roller Mark Cuban, a Cyber Dust Podcast interview we did with a big fan of the app and some feverish tweeting on our behalf.  But some recent updated and more in-depth testing by Heather Mahalik has brought up even more questions about the privacy claims of this app.  At this point, it’s probably safe to say the initial claims of the app’s privacy were very much false, calling into question any future claims the app developers may put forth about future iterations of the app.

Review

For those of you who may not have read our previous article about light forensic testing we performed on Cyber Dust (linked here: http://prodigital4n6.blogspot.com/2015/01/searching-for-artifacts-in-private.html) and in the interests of full disclosure, we’ll provide a brief review of what took place earlier this year, both by Pro Digital examiners and Heather Mahalik of SANS.

In December of 2014, I became aware about the mobile app Cyber Dust through the marketing efforts of Mark Cuban and my role as a digital forensic examiner.  Cuban was tweeting about the app’s privacy and we had this brief exchange on twitter subsequently:

Twitter conversation between @Prodigital4n6 and @mcuban from December, 2014

Putting Cuban’s ignorance about mobile data storage aside (in fairness, he may have been using “hard drive” as a layman’s term), I decided to take him up on what I saw as a definite forensic challenge to see if any artifacts could be recovered.

Long story short, we were able to recover some artifacts through some very basic controlled testing, including user names such as Cuban’s public user name on Cyber Dust and dictionary entries which translated to message strings typed into the device on an Android Smart Phone.  While these artifacts weren’t a direct indictment of Cuban’s claims, they certainly led to the conclusion that the app itself may be private, but the platform on which the app is installed will also have great bearing on what, if any, artifacts are recoverable.

Updated Findings

As I learned during a SANS webcast in March, SANS FOR585 Instructor & mobile forensic guru, Heather Mahalik performed some even more in-depth testing on a more recent version of the app and found much more.  As you can see in the SANS webcast linked here (https://www.sans.org/webcasts/smartphone-security-stronger-forensic-methods-weaker-99887) Heather was able to recover full message text that was double-encoded in base 64.  The translation of this double-encoding was simple and proved that the claim that “it never touches a hard drive anywhere” is simply not true.  Certain messages – perhaps all messages – are stored locally on the device.  They’re just not viewable in Unicode or ASCII as one would search for, thus requiring a trained forensic examiner to take some extra steps to translate the messages, but rest assured, they’re there! 

The responses both Heather and I received from Cyber Dust developers became aware of these findings were curious at best.  To paraphrase, the explanation was given that Heather’s tests were performed on an earlier version of the app in which the data was not encrypted.  The developer(s) insisted the same data is now encrypted in the current versions of the app and therefore, not recoverable.  Methinks they’re missing the point.

 

Take-Aways

I’d like to think the developers of Cyber Dust were simply unaware the curious contrarians like me, Heather Mahalik and other mobile forensicators wouldn’t put Cyber Dust through its paces, but that’s what we do.  Tell us we can’t find it and we’ll look through the weeds as long as we need to in order to find it and Heather certainly did just that.  What’s more disturbing and, arguably almost fraudulent is that Mark Cuban has repeatedly pushed forth in the media that the reason he bank-rolled Cyber Dust is so users could have complete privacy from both corporations and the government.  Indeed, his impetus for bank-rolling the app was a lengthy SEC investigation in which his emails, text messages & other electronic communications were requested as part of discovery in the case.  These tests have shown that, whether in government or in the private sector, there exists forensic examiners with the ability to recover messages stored within the Cyber Dust app, further disputing the claim that the data doesn’t get stored anywhere. 

The updated app may have encrypted the data that Heather recovered, but that still doesn’t address the fact that the data IS stored on the device.  And the fact that the data IS stored on the device, whether encrypted or not, is a direct contradiction to Cuban’s claims that the data “doesn’t touch a hard drive anywhere”.  The replies from Cyber Dust developers overlooks this contradiction and really doesn’t address it at all. 

Moving forward, Cyber Dust has some issues with it’s users who are truly interested in data privacy.  Now that Cuban’s claim(s) have been proven completely false, how are users supposed to believe claims of future privacy?  Are Cyber Dust developers simply preying on their user’s ignorance of technical terms like double-encoding and encryption?  And what if the alleged new encryption algorithm they’re using in current versions is cracked, thus allowing examiners to recover messages as Heather Mahalik did? Can the developers ever get to a place where no messages are stored on the device? 

These are all serious questions Cyber Dust, the developers and even Mark Cuban himself need to answer before they will be able to restore any faith in their app’s privacy.  Don’t forget, roughly the same thing happened to Snap Chat when they claimed nothing was saved.  Is the same fate in store for Cyber Dust? 

Only time will tell…

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: ProDigital4n6

Note:  While much of the forensic work in this article was conducted by Heather Mahalik, please note, she is not an author of this blog.  Her forensic work on Cyber Dust was cited to reinforce the statements made in this article.

UPDATE:
Yes, this is an update to an update...
Shortly after posting this article and tweeting the link to Mr. Cuban, I received this email from an address reportedly belonging to Mark Cuban:

At this time, no reply has been sent.  It is interesting that the "f word" was cited in the email.  In the attempt to give more benefit of the doubt to Cuban and the developers of Cyber Dust, I edited the phrase "...almost fraudulent" to "arguably almost fraudulent".

When writing these articles, I make every effort to be transparent and objective within the subject matter (yes, I edited Mr. Cuban's email address for his privacy), but as a trained investigator, forensic examiner and former law enforcement officer, it's been ingrained in me, and those in the field, to seek facts and point them out, no matter who likes them or how popular they may be.

As far as good business, I won't argue with a billionaire about what is or is not good business.  I'll only state that in every contact with every client, we are as honest, truthful, forthright and pragmatic as possible, even if it means doing so doesn't earn their business.  Maybe that will end up being a bad business model, but it's worked pretty good so far and I will continue to push forward the Pro Digital model of business integrity as long as I own the company.  If you're interested in our Mission Statement, you may read it at: http://www.prodigital4n6.com/about.html

Thanks for your continued readership.
Verital et. Aequitas

-Patrick Siewert

Link to Cyberdust Podcast

February 3, 2015

Patrick Siewert, owner of Pro Digital Forensic Consulting, was recently interviewed by "Stan the Man" on his Cyberdust Podcast about our digital forensic testing of the private messaging app, Cyber Dust.

Bank-rolled by Mark Cuban of "Shark Tank" fame, Cyber Dust purports to be the most private of all messaging apps.  As you'll see and hear, Cuban claimed that the app messages "never touch a hard drive" and we put those claims through some paces using Cellebrite UFED for PC and Lantern by Katana Forensics.

Check out the original article post here:
http://prodigital4n6.blogspot.com/2015/01/searching-for-artifacts-in-private.html

And the subsequent podcast interview with "Stan the Man" here (approx 7 mins long):
http://cyberdust.buzzsprout.com/38199/242447-episode-10-duster-spotlight-with-prodigital4n6

(If the link is dead, the podcast may have cycled out of rotation)

Enjoy!

Author:

Patrick J. Siewert
Owner & Lead Forensic Examiner
Pro Digital Forensic Consulting
Based in Richmond, Virginia, USA
Available Globally
Email:  ProDigitalConsulting@gmail.com
Web:  ProDigital4n6.com
Twitter: @ProDigital4n6
Google Plus: +Professional Digital Forensic Consulting, LLC 

Searching for Artifacts in Private Messaging App: Cyber Dust

January 14, 2015

Searching for Artifacts in Private Messaging App: Cyber Dust

As a burgeoning entrepreneur, I'm a big fan of the TV Show "Shark Tank".  I often tell people that when I was a young cop, I used to watch "Cops" to see what to do and, more importantly, what NOT to do.  The same is true for my affinity for "Shark Tank".  Several very successful business people from various industries get to bid or pass on business opportunities from likely entrepreneurs.  It's not only great advertising for the young business owners, but it has the potential to be very lucrative if one of the "Sharks" happens to make them an offer on their proposal.  One of the more entertaining Sharks is Mark Cuban, outspoken owner of the Dallas Mavericks NBA team and shrewd, modern business man. 

 

Recently, Cuban has been hard at work promoting a mobile app that was brought to him while on “Shark Tank” called Cyber Dust.  According to his own description from The Tonight Show, “…it’s text messaging, but within 24 seconds after it’s read, the message disappears. So that way you can talk to your agent, you can talk about your friends, you can talk about anything… I don’t want to leave a digital footprint, so we came up with Cyber Dust.Once it’s gone, it’s gone.”  In fact, when I recently posed the question about a possible forensic footprint being left behind by Cyber Dust to Cuban on Twitter, he replied promptly:

Being the consummate contrarian that I am, I decided to take Cuban up on his quasi-challenge and use a couple of different mobile forensic tools to try and recover data from a mobile device that was using Cyber Dust.  My results were admittedly mixed, but interesting nonetheless.

Background

Cyber Dust is available in both iOS and Android platforms and indeed was examined on both (detailed later).  The app is a simple messaging app where users can send messages that have a half-life and disappear 24 seconds after being opened.  Pictures can also be sent back-and-forth and, if you are “sneaky” enough to try and take a screen shot of the picture that the other party sent, it notifies them of this.  Messages you send can also be “pinned” (saved for a time) on your device, but you cannot “pin” the messages of the person with whom you are communicating.  There are other features too like “blast” messaging and searching for users by user name.  It’s a fairly simple, easy-to-use app that has it’s plusses and minuses, as with all things.

For this [admittedly] very basic experiment, I downloaded the Cyber Dust app on both my iPhone 5s running iOS 8.1.2 and my lab test phone, a pre-pay Samsung Android phone (model SPH-M830) running OS version 4.1.2 (Jelly Bean).  Full disclosure: I am NOT an Android user as my primary device. 

I used two mobile forensic tools to try and locate data on the devices – Lantern v. 4.5.4 and Cellebrite Universal Forensic Extraction Device (UFED) for PC, v. 4.1.0.178. 

Testing Parameters

I actually conducted two tests in this case.  For both, I compiled a list of key words which would be used in the message strings between me and another user (iPhone) and between me and myself on a separate account (Android).  These key words were:

• Cyberdust (all one word)

• Bababooey

• Xylophone (which was also “pinned” in the message string)

• BlogMaverick (all one word, with the B and M capitalized, “pinned” in the message string”.  This is Mark Cuban’s public user name on Cyber Dust)

• SharkTank (all one word, S and T capitalized)

Additionally, I sent one picture of the cover of a book entitled “Google Hacking” from the iPhone to the Android device via Cyber Dust.

The theory behind inputting specific key words and a unique picture into the message string(s) was to be able to quickly search for and identify artifacts that are unique in nature to our “case” after a successful extraction of the data on the devices.  My results were admittedly mixed.

iPhone Results

As many in the mobile forensic world may know, a full physical extraction on any iPhone model 4s and later is not currently possible with commercially-available or open-source forensic tools.  Nevertheless, I attempted to recover data from Cyber Dust on an iPhone 5s running the most current iOS as of the writing of this article using what I have found to be the most effective iOS examination tool on the market - Lantern.  To be blunt, I found nothing.  Of course, there was evidence that the app was installed on the device, which in and of itself should tell a trained examiner something, but that’s about it.  I surmised that the reason for this is probably that the user-input portion of the app runs mainly in the device RAM volatile memory and therefore, absent a full physical extraction, I was not able to recover any probative data from the device.  Often times, some artifacts from device RAM may be written to the empty or unallocated space on the storage medium, but as I was unable to examine that part of the system memory on the iPhone, none of those artifacts could be recovered, even if present.

Android Results

The results from the Android pre-pay/test phone were much more interesting.  I used Cellebrite UFED for PC to make a full physical extraction of the Samsung phone for examination.  I further created a logical extraction and a file system extraction, just to see if there would be any additional evidence found.  Naturally, in an app of this nature, not much data was recovered from either the logical or file system extractions, but the physical extraction yielded some interesting artifacts.

I conducted key word searches at the physical level to try and find all of the above-listed key words on the device.  The search was conducted for both ANSII and Unicode characters to account for any variance.  I did not make the search case-sensitive because I knew that any hits would return, whether capitalized or not.  The key word "Xylophone" was searched first.  Two hits were located, but not from within any app data of Cyber Dust.  Rather, they were recovered from the Samsung key log file, which logs all recent key strokes input into the device and is active by default (file: root/data/com.sec.android.inputmethod/…).  In fact, there were two unique hits for the same key word (Xylophone) in the same key logger.  This is interesting because, while on it’s face, the claim that Cyber Dust does not keep your data may be true, these artifacts(as well as other) were located in a secondary source.  This gives a digital forensic examiner something to work with because it tells us that the data may be recoverable from more than one area. It should be noted, however, that only the sender’s messages (those that were typed on the device being examined) were recovered, not the messages received on the device by whomever he was messaging.

The same evidence was found in the same place for the key words “Bababooey” and “BlogMaverick.”  Both of these key words, as well as the entire text string from the messages containing those key words (as well as some older messages from standard SMS), were recovered from the Samsung key logger file.  While the logger is on by default on Samsung phones, it can sometimes be turned off or replaced by another keyboard.  The limitations of this pre-pay phone prevented us from testing this further with alternative key boards.  I captured some screen shots in Cellebrite UFED that show the key word hits below:

Key Word: Xylophone

Key Word: Bababooey

One interesting thing of note is the presence of the key word “BlogMaverick”.  This turned out to be the only key word that was found in more than one place.  As mentioned earlier, BlogMaverick is Mark Cuban’s public user name on Cyber Dust.  When a user downloads and installs Cyber Dust on his device, several “friends” are added by default.  Among these are “BlogMaverick” and “CDteam” (short for Cyber Dust Team).  Interestingly enough, those two screen names were located within the Cyber Dust app files at: Root/dalvik-cache/data@app@com.radicalapps.cyberdust-1.apk@classes.dex.   

The screen shot of this artifact is below:

Naturally, I’m not a programmer, so I can’t answer the question whether or not these user names were part of the Cyber Dust app by default and permanently implanted in the code or if they appear in this file because messages were routinely received from both of these user names, but the fact remains that there were these two artifacts recovered from within the Cyber Dust app which indicates two contact names at the very least.  If other screen names are added to this list through constant contact as a user, it could prove to be worthwhile recoverable data in the course of an investigation.  Obviously, more prolonged testing should be conducted to help answer these questions.

Picture Recovery on Android Device

As stated earlier, one picture of the cover of a book was sent from the iPhone 5s to the Samsung Android phone for testing purposes.  After conducting a review of the allocated images from the physical extraction as well as the carved unallocated images from the extraction, I found no evidence of the picture.  I further performed a key word search at the physical level for the file name of the picture (IMG_4153.jpg) and no traces of that file name were recovered.  I purposely did not take a screen shot of the picture, suspecting it would be found very easily in the picture database on the device.  Albeit a basic test, this seems to verify that the pictures received on Cyber Dust do not get saved in any form on the device without affirmative action being taken by the user.  It is theoretically possible that a highly trained examiner might be able to recover the image(s) from the device RAM with the proper training and tools, however I’m not aware of any such tools that capture volatile memory from a mobile device. 

This search was not attempted on the iPhone 5s because of the limitations on data recovery on iOS devices as stated previously.

Conclusions

This test has served to not only demonstrate some of the potentially recoverable artifacts on a device using Cyber Dust, but also demonstrates the differences in mobile device security and indeed, some of the purported security of the Cyber Dust app itself.  It’s obvious that Cyber Dust users on an iOS (Apple) platform with a model 4s or later can probably rest easy that their messages are deleted after having been sent and received for 24 seconds.

However, the multitude of difference in Android-platform devices presents us with a little more muddled conclusion as to whether any evidence can be obtained from the use of Cyber Dust.  This initial test dealt with the use of a basic Samsung smart phone running an older operating system.  This begs the questions:  What (if anything) could be recovered from other manufacturer’s devices?  What could be recovered from a Samsung with a newer operating system and/or a device where only a logical extraction is possible?  What might a theoretical examination of the volatile memory of the device present insofar as evidence?  All of these questions and more lead us to the inevitable conclusion that further testing and reverse-engineering of Cyber Dust needs to be conducted. Make no mistake, there were artifacts recovered from the full physical image of the Android device using Cellebrite UFED for PC.  But the artifacts were not all recovered from the Cyber Dust app database and the recovered artifacts were somewhat sporadic in nature (the term SharkTank was not found, although a visual inspection showed it as part of the Samsung key logger file as well).

For Digital Forensic Examiners, the take-away from this test is clear: Even if you are dealing with a case that involves Cyber Dust (or any other private messaging app), it may still be possible to recover data that is valuable to your case.  Will you get the entire picture?  Probably not. But the role of a Digital Forensic Examiner is often to put pieces of a puzzle together and these pieces may certainly prove valuable in many types of investigations.

It’s certain that Mark Cuban and company have come up with a pretty decent app as far as privacy goes.  What’s too early to tell is whether the reverse-engineers and programmers at companies like Cellebrite, XRY, Oxygen Forensics, Magnet Forensics, AccessData and/or Katana Forensics will uncover the need and the skills to work around the app engineering and what implication that may have on future iterations of Cyber Dust.  One thing is universally true in Mobile App Development and thus, Mobile Device Forensics – things are always changing, so it’s a constant game of catch-up between developers and forensic tool engineers to see who can keep up.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Owner, Lead Forensic Examiner

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com
Twitter: @ProDigital4n6
Google Plus: +Professional Digital Forensic Consulting, LLC 

AUTHOR'S NOTE: I welcome any and all feedback on these tests as this is the first time I’ve attempted anything like this.  I do realize this was not an all-encompassing scientific exploration, more of an experiment, but I welcome your feedback and comments on this and possibly future testing of apps and tools.

Update: May, 2015:  This is still the most viewed article on our blog, which indicates there's a high degree of interest in it.  We did a follow-up to this article you may want to check out.  It's linked right here: http://prodigital4n6.blogspot.com/2015/04/cyber-dust-privacy-claims-debunked.html
Thanks for all your interest!