Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not...
Transcript of Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not...
![Page 1: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/1.jpg)
Brian MoranDigital Strategy Consultant - BriMor Labs
Millersville, Maryland
JUNE 24 2016
![Page 2: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/2.jpg)
A Brief List of Topics
• Why use these confounded devices?
• Pebble Time– Data on phone
• Microsoft Band 2– Data on phone
• Ways to protect your data
• Future research goals
• Questions/Comments (if time permits)
BriMor Labs - 2016
![Page 3: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/3.jpg)
The Introductory Introduction
• Hello, my name is Brian Moran– Hi Brian!
• 13 years Air Force Active Duty– 10 years mobile exploitation/DFIR experience
• Co-winner: Unofficial Forensic 4Cast Awards 2012 -- Best Photoshop of Lee Whitfield
• Worked here….
BriMor Labs - 2016
![Page 4: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/4.jpg)
The Introductory Introduction
BriMor Labs - 2016
![Page 5: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/5.jpg)
![Page 6: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/6.jpg)
Hardware Used
• Samsung Galaxy Note II (SCH-i605) – rooted
– Running Android 4.4.2
• Pebble Time
– Running 3.10
• Microsoft Band 2
– Running 2.0.4215.0 26R
BriMor Labs - 2016
![Page 7: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/7.jpg)
Software Used • ES File Explorer app – Android
– Version 4.0.4.5
• Microsoft Health app – Android– Version 1.3.20213.1
• Pebble Time app – Android– Version 3.10.0-976-0c219e8
• SQLite Spy– Version 1.9.6
• Hex Workshop– Version 6.8.0.5419
• Perl/PythonBriMor Labs - 2016
![Page 8: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/8.jpg)
iOS data shout out• Special thanks to likely 2017 Forensic 4Cast
Awards “Digital Forensic Book of the Year” nominee Heather Mahalik for providing me Pebble related iOS data*
– Let’s make this happen!
*Only cost me a couple pairs of LuLaRoe leggings
BriMor Labs - 2016
![Page 9: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/9.jpg)
BriMor Labs - 2016
![Page 10: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/10.jpg)
What Was NOT Used • Cellebrite
– Don’t want to rely on ~$10k worth of equipment
• During the course of this research, no lying dormant cyber pathogens were harmed
BriMor Labs - 2016
![Page 11: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/11.jpg)
Why not Apple/Samsung/LG/etc?
• Wanted to choose smartwatches that can be used regardless of brand of phone or phone operating system
• Microsoft Band 2 – Android, iOS, Windows Phone
• Pebble – Android, iOS, “unofficial official” Windows Phone
BriMor Labs - 2016
![Page 12: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/12.jpg)
Why use smart watches?
• Helpful notifications (especially when driving)
BriMor Labs - 2016
![Page 13: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/13.jpg)
Why use smart watches?
BriMor Labs - 2016
![Page 14: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/14.jpg)
Why use smart watches?
BriMor Labs - 2016
![Page 15: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/15.jpg)
Why use smart watches?
• Fitness/workout tracking
BriMor Labs - 2016
![Page 16: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/16.jpg)
Why use smart watches?
• Fitness/workout tracking
BriMor Labs - 2016
Inactive and out of shape
![Page 17: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/17.jpg)
Why use smart watches?
• Fitness/workout tracking
BriMor Labs - 2016
Lee Whitfield – “Brotato Chip” version
![Page 18: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/18.jpg)
Why use smart watches?
BriMor Labs - 2016Tracking a weekend bike ride
![Page 19: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/19.jpg)
Why use smart watches?
BriMor Labs - 2016Tracking a round of golf
![Page 20: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/20.jpg)
Why use smart watches?
BriMor Labs - 2016Tracking your run
![Page 21: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/21.jpg)
Why use smart watches?
BriMor Labs - 2016Remotely change music from this …
![Page 22: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/22.jpg)
BriMor Labs - 2016… to this
![Page 23: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/23.jpg)
Why use smart watches?
BriMor Labs - 2016Tracking your sleep
![Page 24: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/24.jpg)
Pebble Time Specs• Processor: ST Micro STM32F439ZG 180 MHz ARM
Cortex-M4-based-MCU (100 MHz, single core)
• Storage: Spansion S29VS128R 128MB, 65 nm MirrorBit Flash
• Display: 1.25” color e-paper screen (144 x 168 pixels, 182 ppi)
• Battery: 150 mAh, (average battery life of 7 days)
• Bluetooth: TBD
• Source: https://www.ifixit.com/Teardown/Pebble+Time+Teardown/42382
BriMor Labs - 2016
![Page 25: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/25.jpg)
Pebble Time storage (Android mobile device)
• Path: /data/data/com.getpebble.android.basalt
– Make sure it is NOT “emulated”
BriMor Labs - 2016
![Page 26: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/26.jpg)
BriMor Labs - 2016
![Page 27: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/27.jpg)
• “data\data\com.getpebble.android.basalt\databases\pebble” is primary file of interest
– SQLite database (as are most files on mobile devices these days)
– Easy to view in any SQLite viewer or parse via scripting languages
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 28: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/28.jpg)
BriMor Labs - 2016
![Page 29: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/29.jpg)
• Table “android_apps” contains a listing of every application and application version installed on the device
• Information is obviously needed for notifications sent to Pebble
• Useful location if looking for an application/version
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 30: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/30.jpg)
BriMor Labs - 2016
![Page 31: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/31.jpg)
• Table “notifications” contains a listing of every notification that happened on the mobile device
• Data is stored by Pebble app regardless of it is sent to the device or not
• Can obviously contain INCREDIBLY useful information
– NOTE: Database does get cleaned when user chooses to clear all notifications
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 32: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/32.jpg)
BriMor Labs - 2016
![Page 33: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/33.jpg)
• Table “timeline_items” contains a listing notifications actually sent to device
• This data is stored as json inside of a SQLite database
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 34: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/34.jpg)
BriMor Labs - 2016
![Page 35: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/35.jpg)
• Table “weather_locations” contains a list of “locations” that the device receives weather updates
• Can be useful to determine if an individual was in a certain place at a certain time
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 36: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/36.jpg)
BriMor Labs - 2016
![Page 37: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/37.jpg)
• SMS message notifications are stored under “notifications” table.
– The “package_name” is bank, the “SOURCE” is “SMS”
• Remember, this can potentially contain messages that were deleted from the phone but stored within this database!
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 38: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/38.jpg)
BriMor Labs - 2016
Pebble Time storage (Android mobile device)
![Page 39: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/39.jpg)
• Obligatory Pebble data on iOS devices slides
• Main database of interest is named “PBMyPebbleAppDataCoreDataManager.sqlite”
BriMor Labs - 2016
Pebble Time storage (iOS mobile device)
![Page 40: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/40.jpg)
BriMor Labs - 2016
![Page 41: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/41.jpg)
Microsoft Band 2 Specs• Processor: ARM Cortex M4 MCU CPU
• Storage: 64MB onboard storage
• AMOLED Gorilla Glass 3 screen, 12.8mm x 32mm (0.5” x 1.25”), 320 x 128 pixels, 255ppi
• Battery: Lithium Polymer battery (average battery life 48 hours)
• Bluetooth: Bluetooth 4.0
• GPS
• Source: http://www.pcadvisor.co.uk/review/activity-trackers/microsoft-band-
vs-band-2-comparison-3626883/#productSpecificationFullBriMor Labs - 2016
![Page 42: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/42.jpg)
Microsoft Band 2 storage (Android mobile device)
• Path: /data/data/com.microsoft.kapp
– Make sure it is NOT “emulated”
BriMor Labs - 2016
![Page 43: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/43.jpg)
BriMor Labs - 2016
![Page 44: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/44.jpg)
Microsoft Band 2 storage (Android mobile device)
• Primary folder of interest is “responseCache”
– Found under “com.microsoft.kapp/files”
• Folder contains files in json format with GUID type names
– Names correlate to entries in SQLite database “cache.sqlite” found under the path “com.microsoft.kapp/databases”
– IMPORTANT NOTE: Not all names have an entry, depending on Band usage
BriMor Labs - 2016
![Page 45: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/45.jpg)
Microsoft Band 2 storage (Android mobile device)
• Data in SQLite database notes a file related to “Golf” is stored as “/data/data/com.microsoft.kapp/files/responseCache/9524a205-d3d6-4d7c-ad31-cbfba2e25840”
BriMor Labs - 2016
![Page 46: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/46.jpg)
Microsoft Band 2 storage (Android mobile device)
BriMor Labs - 2016
![Page 47: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/47.jpg)
Microsoft Band 2 storage (Android mobile device)
BriMor Labs - 2016
![Page 48: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/48.jpg)
Microsoft Band 2 storage (Android mobile device)
• Highlights
– Distance is stored in “cm”
– Par was 71
– Total score was 85
– Scored par or better on 10 holes
(Had a good front nine (+2), but ran into trouble on the back. Not too bad all in all considering I have an exploded hip)
BriMor Labs - 2016
![Page 49: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/49.jpg)
Microsoft Health - website
BriMor Labs - 2016
![Page 50: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/50.jpg)
Microsoft Health - website
BriMor Labs - 2016
![Page 51: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/51.jpg)
Microsoft Health - website
• Remember the text data from golfing earlier?
• The data viewed in the application or on the web is much easier to understand
BriMor Labs - 2016
![Page 52: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/52.jpg)
Microsoft Health
BriMor Labs - 2016
Golf data viewed on Microsoft Health website
![Page 53: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/53.jpg)
BriMor Labs - 2016
Golf data viewed on Microsoft Health app
Microsoft Healthapp
![Page 54: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/54.jpg)
Microsoft Health
• Same methodology can be applied for all “tracking” aspects
– Running
– Workouts
– Sleep
– Calories
– Etc.
BriMor Labs - 2016
![Page 55: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/55.jpg)
Microsoft Band 2 storage (Android mobile device)
BriMor Labs - 2016
Look at database for file associated with “Sleeping”
b0d94bd7-4b17-46f9-9733-090aebcbf0ae
![Page 56: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/56.jpg)
Microsoft Band 2 storage (Android mobile device)
BriMor Labs - 2016
Browse to “com.microsoft.kapp/files/responseCache/b0d94bd7-4b17-
46f9-9733-090aebcbf0ae”
![Page 57: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/57.jpg)
Microsoft Band 2 storage (Android mobile device)
BriMor Labs - 2016
Raw sleep data on mobile device
![Page 58: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/58.jpg)
Microsoft Health - website
BriMor Labs - 2016
Sleep data viewed on Microsoft Health website
NOTE: Asleep at 12:04AM
![Page 59: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/59.jpg)
Microsoft Healthapp
BriMor Labs - 2016
Sleep data viewed on Microsoft Health app
NOTE: Asleep at 12:05 AM
![Page 60: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/60.jpg)
Important Take Away
• Smart watches are essentially content notification devices
– Require another device (smart phone) to “fully” work
• Most of the interesting data will be stored on the mobile device itself
• Connected apps/websites can have even MORE data!
BriMor Labs - 2016
![Page 61: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/61.jpg)
Important Take Away• Time(s) are dependent on exact time on
device/platform being analyzed– Fell asleep at 12:04AM according to website– Fell asleep at 12:05AM according to app
• Trust the raw data, but be prepared for slight time skew
• No current method to “secure” most smart watches– It pains me to say this, but it is one thing that Apple
got right
BriMor Labs - 2016
![Page 62: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/62.jpg)
Important Take Away• If you are going to do something bad, don’t
wear a smartwatch/fitness tracker
• Additionally, if you are going to lie about something bad happening to you, don’t wear a smartwatch/fitness tracker
BriMor Labs - 2016
![Page 63: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/63.jpg)
![Page 64: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/64.jpg)
![Page 65: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/65.jpg)
Protecting your data
• Only turn on notifications you want to record– NOTE: iOS will not allow the user to modify some
notification settings
• Open Pebble app on mobile device– Navigate to “Notifications”
– Select “View All Apps”
– Change slider from blue (on) to gray (off) accordingly
BriMor Labs - 2016
![Page 66: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/66.jpg)
BriMor Labs - 2016
![Page 67: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/67.jpg)
Protecting your data
• Clear notifications on a regular basis
• On Pebble device,– Navigate to “Notifications”
– Select “Clear All”
• NOTE: You must have at least one notification on the Pebble device to clear the SQLite table on the mobile device
BriMor Labs - 2016
![Page 68: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/68.jpg)
Protecting your data
BriMor Labs - 2016
![Page 69: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/69.jpg)
Protecting your data
• Don’t sync health care data/records with any applications
– If you do, and you lose control of your own PII/PHI, you could theoretically be held liable for losing your own data
BriMor Labs - 2016
![Page 70: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/70.jpg)
Protecting your data
• Use strong password(s) for your accounts
• Don’t reuse passwords
– Especially for 2nd/3rd party apps
BriMor Labs - 2016
Examples of BAD passwords
![Page 71: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/71.jpg)
Future development(DEPENDENT ON FREE TIME)
• allyourpebblearebelongtous.pl– ETA late June 2016– Wait. That’s now!!
• allyourband2arebelongtous.pl– ETA TBD, In progress
• Why Perl? – Easier for me– Want Cellebrite to at least do a little work to make
money off of open source research
BriMor Labs - 2016
![Page 72: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/72.jpg)
allyourpebblearebelongtous.pl
• Give the script a pebble database & output folder and let it run
• Tries to figure out if it is iOS or android & parses data accordingly
BriMor Labs - 2016
NOW FEATURING IOS PARSING CAPABILITIES!!
![Page 73: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/73.jpg)
allyourpebblearebelongtous.pl
BriMor Labs - 2016
Screenshot of script running
![Page 74: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/74.jpg)
allyourpebblearebelongtous.pl
• Produces easy to read HTML output for:
– Android
• Applications
• Canned responses
• Notifications
• Phone numbers
– iOS
• Notifications
BriMor Labs - 2016
![Page 75: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/75.jpg)
Android- Output of parsed notifications
BriMor Labs - 2016
![Page 76: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/76.jpg)
iOS- Output of parsed notifications
BriMor Labs - 2016
![Page 77: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/77.jpg)
Future development(DEPENDENT ON FREE TIME)
• Collect more data and do more experimentation
– Capturing traffic to/from smart watches is my next goal
– Doing this after hip surgery will help considerably
• Expand to other smart watches (maybe?)
BriMor Labs - 2016
![Page 78: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/78.jpg)
Future development(DEPENDENT ON FREE TIME)
• Check out a post by b0nb0n on jailbreaking the Microsoft fitness band
– http://www.b0n0n.com/2016/04/20/ms-jailbreak/
• NOTE: This was done with the original Microsoft Band, my limited testing has been unsuccessful thus far on the Band 2
BriMor Labs - 2016
![Page 79: Brian Moran - SANS Institute•Only turn on notifications you want to record –NOTE: iOS will not allow the user to modify some notification settings •Open Pebble app on mobile](https://reader030.fdocuments.in/reader030/viewer/2022041016/5ec96d13ce6338560807f640/html5/thumbnails/79.jpg)
Questions?
Contact Us!
Email: [email protected]
Phone: 443.834.8280
Website: www.brimorlabs.com
Blog: www.brimorlabsblog.com
Twitter: @BriMorLabs (work)
@brianjmoran (personal)
BriMor Labs - 2016