A SNEAK PEEK POKMON GO FORENSICS Cindy Murphy

A SNEAK PEEK: POKÉMON GO FORENSICS Cindy Murphy President, Gillware Digital Forensics cmurphy@gillware. com from the most trusted name in information security

Cindy Murphy • • • President, Gillware Digital Forensics Law Enforcement Officer for 30 years Madison Police Department since 1991, Detective for 17+ years Involved in Computer Crimes & Computer Forensics 18+ years Certified Computer Forensic Examiner Testified as an Expert in State and Federal Courts D. F. cases in both the WI and US Supreme Court Certified Instructor / Co-Author SANS FOR 585 – Advanced Mobile Device Forensics MSc– University College, Dublin – Forensic Computing and Cybercrime Investigation Upcoming FOR 585 Advanced Smartphone Forensics Courses: • August 22 – 27 Virginia Beach • September 19 – 24 Madison, WI • October 3 – 8 Prague, CZ from the most trusted name in information security

Pokémon Go! • US Launch Date: July 7, 2016 • Augmented MMORPG Reality Game • Developed by Niantic Labs (Google) based upon the backbone of its last AR game, Ingress. from the most trusted name in information security

Popularity! • Daily average usage exceeded Facebook, Twitter, Snap. Chat, Tinder, and Instagram for July 2016. • First month, the game passed over $200 million in worldwide revenue. ¢ Exceeding every existing record set by Clash of Clans and Candy Crush by a wide margin. (Sensor Tower) • In game purchases generated $160 million by August 1, 2016 (Wikipedia) from the most trusted name in information security

Add-Ons • Pokémon Go Plus: ¢ ¢ ¢ Bluetooth device Wearable that allows for collection of Pokémon with less distraction Vibrates when in range, press button to collect, check collections later from the most trusted name in information security

Incidents & Issues • Google Account Permissions ¢ ¢ Early i. OS installs required permissions for full account access (3 rd party usage not enabled) Niantic could access email addresses and phone numbers • Security/Espionage Concerns • Armed Robberies • Found Body • Accidents from the most trusted name in information security 6

Forensics Possibilities • Location Information • Date and Time Information • User Account Info • Device Info • Pictures from encounters? ? • Other Potential Data from the most trusted name in information security 7

Potential Sources of Data • The app itself ¢ ¢ . apk file (Android). ipa file (i. OS) • Data left behind on the phone ¢ ¢ Android i. OS • Packet Capture from app actively running on the device from the most trusted name in information security 8

Data Source: The App Itself • Information about what the app does gives clues what to look for • Static and Dynamic Analysis of. apk and. ipa files • • . ipa and. apk files are archive files that can be unzipped to examine the contents Unpacking and Decompiling techniques common to malware analysis • Sandboxes from the most trusted name in information security 9

App Analysis Unzipped. apk file and classes. dex file shown in Java Decompiler from the most trusted name in information security 10

Sandboxes • Automated checks of app files ¢ • • Provide tons of information fast! Virus Total Apk Inspector Mobisec Others… from the most trusted name in information security 11

Pokémon Go Android Artifacts • User Account Information ¢ com. nianticlabs. pokemongo. PREFS. xml • Date/Time/Location Information ¢ ¢ ¢ “crittercism logs” Plain text encounter info, date/time Cell location – • Hilbert Curve from the most trusted name in information security 12

“Crittercism” Log File Examples • • • Application errors Application loads Session starts Session finishes Wild Pokémon encounters Pokémon captures Encounter updates Successful encounters of wild Pokémon Additions of wild Pokémon Attempted encounters Caught Pokémon Cell removals from the most trusted name in information security 13

Hilbert Curve? • • • A Hilbert curve is a continuous space-filing curve. They are fractal and selfsimilar. Hilbert Curves were first described in 1891. • 30 levels of hierachical decomposition • http: //blog. christianperone. com/20 15/08/googles-s 2 -geometry-on-the -sphere-cells-and-hilbert-curve/ Thanks to Warren Raquel (@warquel), Senior Security Engineer at the National Center for Supercomputing Applications!! • from the most trusted name in information security 14

Hilbert Curve Cells • Every cm² on the earth’s surface can be represented using a 64 -bit integer. • Convert cell ID integer to hex • Google S 2 Library • 9801614157982728192 ->8806542540000000 9801614149392793600 ->8806542340000000 9801614203079884800 ->8806542 fc 0000000 9801614258914459648 ->8806543 cc 0000000 9801614157982728192 ->8806542540000000 9801614151540277248 ->88065423 c 0000000 from the most trusted name in information security 15

Conversion of Hilbert Cell ID to Lat/Long >>> import s 2 >>> str(s 2. S 2 Cell. Id_From. Token(“ 88065 42340000000”). To. Lat. Lng()) ‘[43. 1182500, -89. 3309966]x 00’ >>> s 2. S 2 Cell. Id_From. Token(“ 88065423 40000000”). level() 15 from the most trusted name in information security 16

Pokémon Go - i. OS App • User Account Information ¢ com. nianticlabs. pokemongo. plist from the most trusted name in information security 17

i. OS Date/Time Info • Various files show updated date/time info with game use: ¢ ¢ “Bundles” – (both Android and i. OS) “Upsight”. plist files from the most trusted name in information security 18

Mobile Forensic Tool Support • Oxygen Forensics (7/28/16) • Cellebrite Physical Analyzer 5. 2 (8/10/16) • pokededocer. py Python Script (Linux) – Maggie O’Leary, Gillware Digital Forensics from the most trusted name in information security 19

Pokedecoder. py from the most trusted name in information security 20

Oxygen Forensics from the most trusted name in information security 21

Cellebrite Physical Analyzer 5. 2 from the most trusted name in information security 22

Cindy Murphy President, Gillware Digital Forensics cmurphy@gillware. com from the most trusted name in information security