Auditing Social Media Contacts

 

July 16, 2015

Auditing Your Social Media

Quick note: I’ve done some light research and seen where there are a few articles onlie about how companies should audit their social media for market effectiveness.  This article is not about that.  This article is about why YOU should audit your personal & professional social media contacts & connections on a regular basis.

While Pro Digital is primarily a digital forensic consulting company, a great deal of my early professional experience in criminal investigations involved online undercover investigations.  Yes, I’d create the persona of a young girl online and conduct sting operations a-la “To Catch a Predator”, only with many more measures put in place to ensure proper evidence handling and successful prosecution of these cases.  Because of my repeated creation of online undercover social media accounts and daily contact with others online conducting these types of investigations, I thought it might be useful to spread a little wisdom with regard to overall social media usage. 

Social media has become an intimate part of most of our lives.  While it’s true my octogenarian father has not embraced Facebook, my slightly younger mother-in-law has.  But Facebook is just the beginning!   There’s a pretty decent likelihood that you found this article on one of several social media outlets attributed to Pro Digital Consulting – Twitter, Linked In, Google+, Facebook Pages, etc. all create a universe for us to connect with other people, either personally or professionally, and network in a way our parents never even imagined.  But with this ability comes added responsibility.  While some other social media experts may disagree with me, I’ll offer a few tips from what I’ve seen over the years catching bad guys and conducting investigations online.

Separate or Post with Discretion

Years ago, I created a personal Facebook page under a pseudonym.  I did this because I was involved in gang and narcotic investigations and to insulate my family from potential threats from those I was investigating.  This pseudonym became (and still is) my account and one of the ways I connect with friends and relatives I may not see regularly, but still wish to remain in contact with.  Because of this, however I’m forced to abide by the same advice I give teenagers about social media: only contact those whom you know personally and those who you could call with relative ease.  Regardless, I still make a conscious effort to separate my personal and professional social networking.  Pro Digital has a Twitter page and I have a separate Twitter page.  This helps not only separate valued professional contacts from personal ones, but also serves to avoid alienating potential business associates.  It’s important and prudent to make the decision to separate your personal and professional social media OR post with extreme discretion if they are to be combined as part of your overall online persona.  This becomes a little more difficult when we connect with co-workers (or even bosses) on our personal social media pages.

Linked In is a somewhat different animal.  Because Linked In is a professional social networking site and digital forensics is a fairly small community, I will choose to connect with other digital forensic and investigative professionals that I have not (yet) met in person.  However, taking into account the normal traffic across list serves and browsing of blog articles published in the profession, it’s fairly easy to vet contacts as real or legitimate versus not.  Even still, I audit all of my social media accounts regularly and I suggest you do too.

Why Audit?

It seems to be an unfortunate side-effect to the world of social media that it’s the 21^st Century version of the popularity contest.  How many contacts can you amass in your social media world?  The winner has the most.  Facebook doesn’t expressly reward this, but interestingly enough, Linked In does!  I routinely see potential contacts on Linked In that boast 500+ or 1000+ contacts.  While that may be a measure of some sort of accomplishment, the sheer number of connection requests I get from people who fall into these categories suggests they’ll just connect with whomever for no apparent reason other than to connect with them.  That’s a bad idea.

Another side-effect to ubiquitous social media usage is that potential employers, clients, opposing parties in legal disputes, etc. can look at your profile(s) and see your activity, your accomplishments and with whom you associate.  Let’s face it, every profession has clowns.  I define a clown as a talker, not a doer.  Someone who makes a career out of doing as little as possible and talking about the little bit they do as much as possible.  Another sub-set of clown are the incompetents.  Think about your profession – You know people who fit these categories and your peers also know the same people who fit these categories, so why would you want to be associated with them, even if it’s just online?

Yet another reason to audit your contacts is things change.  People change.  That co-worker you went to multiple happy hours and worked on two major projects with at your previous company just got convicted of defrauding the same company… Do you still want to be connected or associated with him professionally?  Probably not.  The reality is that sometimes good people turn bad and sometimes good people let bad things carry them away through any number of motivations, so it really benefits YOU to stay abreast of who you’re connected with and what they’re up to.  Like it or not, we’re all judged by our friends & acquaintances.  Birds of a feather… well, you know.

When to Audit?

There’s no “best practice” for how often to audit your social media contacts.  I would suggest at the very least to do it once a year, but it also depends on the volume of your social media usage.  If you’re a 500+ or 1000+ connector on Linked In, you may need to audit more frequently.  If, like me, you’re more cautious and discriminating about who you connect with, you may need to do it less frequently.  Just don’t let it get away from you.  Speaking as one who has seen respected friends, co-workers, clergy and professional contacts get caught up in situations that reflect horribly on themselves and badly on those with whom they associate, it really is an important piece to maintaining professional integrity.

What Now?

Auditing your social media is like cleaning out your filing cabinet.  It sits over there in the corner, you use it when you need to and don’t pay attention to it when you’re not looking at it, but it’s still very important to maintaining your professional reputation.  So use these suggestions and log-on to your Linked In, Facebook, Twitter, etc. and take a look at who you’re connected with.  If you find yourself saying “yikes” or simply “who the hell is that?”, maybe it’s time to make the decision to disconnect. 

Trust me, they won’t be the wiser and you’ll be better off for it!

 

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Searching for Artifacts in Private Messaging App: Cyber Dust

January 14, 2015

Searching for Artifacts in Private Messaging App: Cyber Dust

As a burgeoning entrepreneur, I'm a big fan of the TV Show "Shark Tank".  I often tell people that when I was a young cop, I used to watch "Cops" to see what to do and, more importantly, what NOT to do.  The same is true for my affinity for "Shark Tank".  Several very successful business people from various industries get to bid or pass on business opportunities from likely entrepreneurs.  It's not only great advertising for the young business owners, but it has the potential to be very lucrative if one of the "Sharks" happens to make them an offer on their proposal.  One of the more entertaining Sharks is Mark Cuban, outspoken owner of the Dallas Mavericks NBA team and shrewd, modern business man. 

 

Recently, Cuban has been hard at work promoting a mobile app that was brought to him while on “Shark Tank” called Cyber Dust.  According to his own description from The Tonight Show, “…it’s text messaging, but within 24 seconds after it’s read, the message disappears. So that way you can talk to your agent, you can talk about your friends, you can talk about anything… I don’t want to leave a digital footprint, so we came up with Cyber Dust.Once it’s gone, it’s gone.”  In fact, when I recently posed the question about a possible forensic footprint being left behind by Cyber Dust to Cuban on Twitter, he replied promptly:

Being the consummate contrarian that I am, I decided to take Cuban up on his quasi-challenge and use a couple of different mobile forensic tools to try and recover data from a mobile device that was using Cyber Dust.  My results were admittedly mixed, but interesting nonetheless.

Background

Cyber Dust is available in both iOS and Android platforms and indeed was examined on both (detailed later).  The app is a simple messaging app where users can send messages that have a half-life and disappear 24 seconds after being opened.  Pictures can also be sent back-and-forth and, if you are “sneaky” enough to try and take a screen shot of the picture that the other party sent, it notifies them of this.  Messages you send can also be “pinned” (saved for a time) on your device, but you cannot “pin” the messages of the person with whom you are communicating.  There are other features too like “blast” messaging and searching for users by user name.  It’s a fairly simple, easy-to-use app that has it’s plusses and minuses, as with all things.

For this [admittedly] very basic experiment, I downloaded the Cyber Dust app on both my iPhone 5s running iOS 8.1.2 and my lab test phone, a pre-pay Samsung Android phone (model SPH-M830) running OS version 4.1.2 (Jelly Bean).  Full disclosure: I am NOT an Android user as my primary device. 

I used two mobile forensic tools to try and locate data on the devices – Lantern v. 4.5.4 and Cellebrite Universal Forensic Extraction Device (UFED) for PC, v. 4.1.0.178. 

Testing Parameters

I actually conducted two tests in this case.  For both, I compiled a list of key words which would be used in the message strings between me and another user (iPhone) and between me and myself on a separate account (Android).  These key words were:

• Cyberdust (all one word)

• Bababooey

• Xylophone (which was also “pinned” in the message string)

• BlogMaverick (all one word, with the B and M capitalized, “pinned” in the message string”.  This is Mark Cuban’s public user name on Cyber Dust)

• SharkTank (all one word, S and T capitalized)

Additionally, I sent one picture of the cover of a book entitled “Google Hacking” from the iPhone to the Android device via Cyber Dust.

The theory behind inputting specific key words and a unique picture into the message string(s) was to be able to quickly search for and identify artifacts that are unique in nature to our “case” after a successful extraction of the data on the devices.  My results were admittedly mixed.

iPhone Results

As many in the mobile forensic world may know, a full physical extraction on any iPhone model 4s and later is not currently possible with commercially-available or open-source forensic tools.  Nevertheless, I attempted to recover data from Cyber Dust on an iPhone 5s running the most current iOS as of the writing of this article using what I have found to be the most effective iOS examination tool on the market - Lantern.  To be blunt, I found nothing.  Of course, there was evidence that the app was installed on the device, which in and of itself should tell a trained examiner something, but that’s about it.  I surmised that the reason for this is probably that the user-input portion of the app runs mainly in the device RAM volatile memory and therefore, absent a full physical extraction, I was not able to recover any probative data from the device.  Often times, some artifacts from device RAM may be written to the empty or unallocated space on the storage medium, but as I was unable to examine that part of the system memory on the iPhone, none of those artifacts could be recovered, even if present.

Android Results

The results from the Android pre-pay/test phone were much more interesting.  I used Cellebrite UFED for PC to make a full physical extraction of the Samsung phone for examination.  I further created a logical extraction and a file system extraction, just to see if there would be any additional evidence found.  Naturally, in an app of this nature, not much data was recovered from either the logical or file system extractions, but the physical extraction yielded some interesting artifacts.

I conducted key word searches at the physical level to try and find all of the above-listed key words on the device.  The search was conducted for both ANSII and Unicode characters to account for any variance.  I did not make the search case-sensitive because I knew that any hits would return, whether capitalized or not.  The key word "Xylophone" was searched first.  Two hits were located, but not from within any app data of Cyber Dust.  Rather, they were recovered from the Samsung key log file, which logs all recent key strokes input into the device and is active by default (file: root/data/com.sec.android.inputmethod/…).  In fact, there were two unique hits for the same key word (Xylophone) in the same key logger.  This is interesting because, while on it’s face, the claim that Cyber Dust does not keep your data may be true, these artifacts(as well as other) were located in a secondary source.  This gives a digital forensic examiner something to work with because it tells us that the data may be recoverable from more than one area. It should be noted, however, that only the sender’s messages (those that were typed on the device being examined) were recovered, not the messages received on the device by whomever he was messaging.

The same evidence was found in the same place for the key words “Bababooey” and “BlogMaverick.”  Both of these key words, as well as the entire text string from the messages containing those key words (as well as some older messages from standard SMS), were recovered from the Samsung key logger file.  While the logger is on by default on Samsung phones, it can sometimes be turned off or replaced by another keyboard.  The limitations of this pre-pay phone prevented us from testing this further with alternative key boards.  I captured some screen shots in Cellebrite UFED that show the key word hits below:

Key Word: Xylophone

Key Word: Bababooey

One interesting thing of note is the presence of the key word “BlogMaverick”.  This turned out to be the only key word that was found in more than one place.  As mentioned earlier, BlogMaverick is Mark Cuban’s public user name on Cyber Dust.  When a user downloads and installs Cyber Dust on his device, several “friends” are added by default.  Among these are “BlogMaverick” and “CDteam” (short for Cyber Dust Team).  Interestingly enough, those two screen names were located within the Cyber Dust app files at: Root/dalvik-cache/data@app@com.radicalapps.cyberdust-1.apk@classes.dex.   

The screen shot of this artifact is below:

Naturally, I’m not a programmer, so I can’t answer the question whether or not these user names were part of the Cyber Dust app by default and permanently implanted in the code or if they appear in this file because messages were routinely received from both of these user names, but the fact remains that there were these two artifacts recovered from within the Cyber Dust app which indicates two contact names at the very least.  If other screen names are added to this list through constant contact as a user, it could prove to be worthwhile recoverable data in the course of an investigation.  Obviously, more prolonged testing should be conducted to help answer these questions.

Picture Recovery on Android Device

As stated earlier, one picture of the cover of a book was sent from the iPhone 5s to the Samsung Android phone for testing purposes.  After conducting a review of the allocated images from the physical extraction as well as the carved unallocated images from the extraction, I found no evidence of the picture.  I further performed a key word search at the physical level for the file name of the picture (IMG_4153.jpg) and no traces of that file name were recovered.  I purposely did not take a screen shot of the picture, suspecting it would be found very easily in the picture database on the device.  Albeit a basic test, this seems to verify that the pictures received on Cyber Dust do not get saved in any form on the device without affirmative action being taken by the user.  It is theoretically possible that a highly trained examiner might be able to recover the image(s) from the device RAM with the proper training and tools, however I’m not aware of any such tools that capture volatile memory from a mobile device. 

This search was not attempted on the iPhone 5s because of the limitations on data recovery on iOS devices as stated previously.

Conclusions

This test has served to not only demonstrate some of the potentially recoverable artifacts on a device using Cyber Dust, but also demonstrates the differences in mobile device security and indeed, some of the purported security of the Cyber Dust app itself.  It’s obvious that Cyber Dust users on an iOS (Apple) platform with a model 4s or later can probably rest easy that their messages are deleted after having been sent and received for 24 seconds.

However, the multitude of difference in Android-platform devices presents us with a little more muddled conclusion as to whether any evidence can be obtained from the use of Cyber Dust.  This initial test dealt with the use of a basic Samsung smart phone running an older operating system.  This begs the questions:  What (if anything) could be recovered from other manufacturer’s devices?  What could be recovered from a Samsung with a newer operating system and/or a device where only a logical extraction is possible?  What might a theoretical examination of the volatile memory of the device present insofar as evidence?  All of these questions and more lead us to the inevitable conclusion that further testing and reverse-engineering of Cyber Dust needs to be conducted. Make no mistake, there were artifacts recovered from the full physical image of the Android device using Cellebrite UFED for PC.  But the artifacts were not all recovered from the Cyber Dust app database and the recovered artifacts were somewhat sporadic in nature (the term SharkTank was not found, although a visual inspection showed it as part of the Samsung key logger file as well).

For Digital Forensic Examiners, the take-away from this test is clear: Even if you are dealing with a case that involves Cyber Dust (or any other private messaging app), it may still be possible to recover data that is valuable to your case.  Will you get the entire picture?  Probably not. But the role of a Digital Forensic Examiner is often to put pieces of a puzzle together and these pieces may certainly prove valuable in many types of investigations.

It’s certain that Mark Cuban and company have come up with a pretty decent app as far as privacy goes.  What’s too early to tell is whether the reverse-engineers and programmers at companies like Cellebrite, XRY, Oxygen Forensics, Magnet Forensics, AccessData and/or Katana Forensics will uncover the need and the skills to work around the app engineering and what implication that may have on future iterations of Cyber Dust.  One thing is universally true in Mobile App Development and thus, Mobile Device Forensics – things are always changing, so it’s a constant game of catch-up between developers and forensic tool engineers to see who can keep up.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Owner, Lead Forensic Examiner

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com
Twitter: @ProDigital4n6
Google Plus: +Professional Digital Forensic Consulting, LLC 

AUTHOR'S NOTE: I welcome any and all feedback on these tests as this is the first time I’ve attempted anything like this.  I do realize this was not an all-encompassing scientific exploration, more of an experiment, but I welcome your feedback and comments on this and possibly future testing of apps and tools.

Update: May, 2015:  This is still the most viewed article on our blog, which indicates there's a high degree of interest in it.  We did a follow-up to this article you may want to check out.  It's linked right here: http://prodigital4n6.blogspot.com/2015/04/cyber-dust-privacy-claims-debunked.html
Thanks for all your interest!