What Firefox can tell about you? - Firefox Forensics

24
RISC MEET 1

description

RISC Meet - 14th September RMIT Information Security Collective RMIT University

Transcript of What Firefox can tell about you? - Firefox Forensics

Page 1: What Firefox can tell about you? - Firefox Forensics

R I S C M E E T 1

Page 2: What Firefox can tell about you? - Firefox Forensics

HOW BROWSER WORKS?

R I S C M E E T 2 Img Src: http://img.labnol.org/di/how-internet-works1.jpg

Page 3: What Firefox can tell about you? - Firefox Forensics

HOW BROWSER WORKS? CNTD.

R I S C M E E T 3 Img Src: http://taligarsiel.com/Projects/layers.png

Page 4: What Firefox can tell about you? - Firefox Forensics

RENDERING ENGINE – WEBKIT, CHROME,

SAFARI

R I S C M E E T 4 Img Src: http://taligarsiel.com/Projects/webkitflow.png

Page 5: What Firefox can tell about you? - Firefox Forensics

DEFAULT LOCATIONS

Win 7:

C:\Users\[user]\AppData\Roaming\Mozilla\Firefox\Profiles\XXXXXXXX.default\

C:\Users\[user]\AppData]Local\Mozilla\Firefox\Profiles\XXXXXXXX.default\Cache\

Linux:

~/.mozilla/firefox/XXXXXXXX.default/

MAC OS X:

~/Library/Application Support/Firefox/Profiles/XXXXXXXX.default/

~/Library/Application Support/Mozilla/Extensions

~/Library/Caches/Firefox/Profiles/XXXXXXXX.default/Cache/

R I S C M E E T 5

Page 6: What Firefox can tell about you? - Firefox Forensics

SQLITE TABLES

Addons

Chromeappstore

Content-prefs

Cookies

Downloads

Extensions

Formhistory

Permissions

Places

Search

Signons

Webappstore

R I S C M E E T 6

Page 7: What Firefox can tell about you? - Firefox Forensics

ADDONS

Any browser addons

- extra toolbars (sometimes users don’t even know they have them

installed)

What you will find:

Name, Version, Description, and other data like which profile gets to use it

in a multi-profile environment

R I S C M E E T 7

Page 8: What Firefox can tell about you? - Firefox Forensics

CHROMEAPPSTORE

The Search Engine container in Firefox which is set to Google by default,

though users can set any other search engine

R I S C M E E T 8

Page 9: What Firefox can tell about you? - Firefox Forensics

CONTENT-PREFS

Browser Preferences and Content settings like text zoom, page style,

character encoding on a site-specific bases

Useful for showing intent and frequency of visits along with the browser

history

R I S C M E E T 9

Page 10: What Firefox can tell about you? - Firefox Forensics

COOKIES

Every cookie that is set by the system

These may or may not be wiped clean when a user deletes all cookies or

any other program to clear tracks

A cookie being set does NOT mean the user visited the site

R I S C M E E T 10

Page 11: What Firefox can tell about you? - Firefox Forensics

DOWNLOADS

List of every file downloaded

- Cleared when user clears the download queue in Firefox

You can tell a lot about a person by what they download

R I S C M E E T 11

Page 12: What Firefox can tell about you? - Firefox Forensics

EXTENSIONS

All Extensions

This file will normally pop-up as corrupted or unavailable when Firefox is

running.

R I S C M E E T 12

Page 13: What Firefox can tell about you? - Firefox Forensics

FORMHISTORY

Every form filled out by the user

R I S C M E E T 13

Page 14: What Firefox can tell about you? - Firefox Forensics

PERMISSIONS

Permissions various sites have like allowing pop-ups

R I S C M E E T 14

Page 15: What Firefox can tell about you? - Firefox Forensics

PLACES

Places visited, bookmarks and attributes to sites commonly visited by the

user

Cross referencing this file with cookies, formhistory and permissions

provides a robust view of the user and how they use Firefox

Cross referencing is also useful to prove that the visit was intentional

versus a drive by cookie session

R I S C M E E T 15

Page 16: What Firefox can tell about you? - Firefox Forensics

SEARCH

All available search engines

R I S C M E E T 16

Page 17: What Firefox can tell about you? - Firefox Forensics

SIGNONS

Stored Passwords

R I S C M E E T 17

Page 18: What Firefox can tell about you? - Firefox Forensics

WEBAPPSTORE

All XAuth Tokens

R I S C M E E T 18

Page 19: What Firefox can tell about you? - Firefox Forensics

R I S C M E E T 19

Page 20: What Firefox can tell about you? - Firefox Forensics

R I S C M E E T 20

Page 21: What Firefox can tell about you? - Firefox Forensics

CACHE

Files you will find in the Cache Folder:

_CACHE_MAP

_CACHE_001, _CACHE_002, _CACHE_003

Cache Map is the main file needed to reconstruct the cache files

R I S C M E E T 21

Page 22: What Firefox can tell about you? - Firefox Forensics

MOZILLACACHEVIEW BY NIRSOFT

R I S C M E E T 22

Page 23: What Firefox can tell about you? - Firefox Forensics

R I S C M E E T 23

Page 24: What Firefox can tell about you? - Firefox Forensics

R I S C M E E T 24