NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking – All in a...

8/13/2019 NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking All in a Days Work

1/14

TOP SECRET//COMINT/REL TO USA, FVEY

TOP SECRET//COMINT/REL TO USA, FVEY1

(U) Converged Analysis of

Smartphone Devices

Identification/Processing/Tasking

All in a days work

Paula Kuruc, NSA

May 2010


2/14


TOP SECRET//COMINT/REL TO USA, FVEY 2

Smartphone

Converged mobile devicesoffering advanced capabilities,

often with PC-like

functionality. No set industrystandard definition.

Boasts powerful processors,

memory, larger screens andopen operating systems.


3/14


TOP SECRET//COMINT/REL TO USA, FVEY 3

Economics of Transportation

!The gradual blurring oftelecommunications, computers, and the

Internet

! Multifaceted layering technologies! Examples of convergence in SIGINT:

" Blackberry, iPhone data, Smartphones" VOIP" Wireless Local Loop" GPRS General Packet Radio Service


4/14



SmartPhone Applications

!Visual Communicator Free application thatcombines Instant Messaging, Photo-Messaging

and Push2Talk capabilities on a mobile

platform. VC used on GPRS or 3G networks;

heavily used in AQI Mosul Network! Symbian Operating System supporting

encryption programs.

! WinZip, compression and encryption program.

4


5/14



Usage/Features

!Social Networking via Flixster

Social Networking site allowing users to share

movie ratings, discover new movies and meet

others with similar movie taste.

! Google Maps features! Photo capture and editing capabilities! Phone settings! Mobile Facebook Apps (iPhone/Android)

6


6/14



Location Based Services

Where is the target?

! GPRS Dataset breaking down barriers! Providers catering to users based on location! Android Phones pass GPS data in the clear! No longer DNI/DNR

7


7/14



Taking a Closer Look

Photo Capture Software -! iPhone Geotags for PhotosRaw tags coming through from a variety of

devices

! Flixster App uses GPRS! Flickr/Photobucket! Mobile Facebook Apps Uploads

8


8/14



Processing

All in the Metadata, not the pretty pictures! Unique applications require unique analysis! GPS Indicators (sent to the server and towers

for both phone and application)

! VoIP Indicators (multiple services)! Type of Phone and Apps

9


9/14



Identification via Xkeyscore

!Make use of fingerprints in Xkeyscore via theEXIF metadata plugin

! Fingerprints for images (jpeg, tiff, gifs etc.)! Examine the raw XML! Provides device and time/location for the imagefingerprint('image/exif/gpsCoordinates') =

file_ext('jpeg' or 'pjpeg' or 'jpg' or 'pjpg' or 'tiff' or 'gif' or 'png' or 'riff' or

'wav') and

'exif:GPSLatitude' or 'exif:GPSLongitude' or 'exif:GPSDestLatitude' or

'exif:GPSDestLongitude';

10


10/14



Golden Nugget!

Perfect Scenario Target uploadingphoto to a social media site taken

with a mobile device.

What can we get?

11

TOP SECRET//COMINT/REL TO USA FVEY


11/14



User Activity Leads

! Examine settings of phone as well as serviceproviders for geo-location; specific to a certain

region

! Networks connected! Websites visited! Buddy Lists! Documents Downloaded! Encryption used and supported! User Agents

12



12/14



Targeting

13

Targeting both Telephony and DNI systems

! Call Logs! SMS! SIM Card Leads! Email address! IMEI/IMSI! Unique Identifiers! Blackberry PINS



13/14



Why do we care?

14

Additional exploitationTarget Knowledge/LeadsLocationTarget TechnologyDenote Media used



14/14



Conclusion

! Challenge is how to tag data for analysts! We can geo phones from virtually anywhere! Buried GeoStamp from Phone or Apps! Xkeyscore/Marina! Tasking systems

15

NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking – All in a...

Documents

Transcript of NSA - Converged Analysis of Smartphone Devices: Identification/Processing/Tasking – All in a...