View
3
Download
0
Category
Preview:
Citation preview
Text
Linkable IdentifiersLeveraging Technology To Identify People
Purpose
Provide a broader understanding of how technology can be used to link people to their technology during an investigation as well as provide a broader understanding of digital footprints.
Linkable Identifiers in Computer Identifiers
Hardware MAC address(es) wired and wireless network cards and adapters
Hard drive serial number
Motherboard serial number
Serial numbers of removable devices stored in the registry
Bluetooth and paired devices
Video Card Serial Number
Battery serial number
Linkable Identifiers In Mobile Devices
IMEI or electronic serial number
ICCID (SIM Card)
USB serial number, Vendor ID, and Product ID
SEID or secure element ID (Apple Pay)
Wifi SSID (broadcast from device)
Wifi History
Battery serial number
NFC / RFID
Text
Case StudySurreptitious recording in the workplace
Why you need a “Digital Detective”
Line Power
Battery Power2hrs VOX
240hrs VOX
Creates a .WAV Has vendor ID Has product ID Black Market (no traceable serial number). Does not transmit so it can’t be found via TSCM
8GB USB Recording Device
The InvestigationFinger prints were destroyed due to handling
Data recovery of the USB device was conducted to uncover deleted audio recording(s)
Technical surveillance counter measures of office(s) were conducted
Identify which computer registries if any showed traces of the recording device(s)
Identify how the .WAV file(s) traversed the computer
Identify other USB devices that received files
Trace the cell phone that was plugged in six months prior
The phones USB Serial number was traced to manufacturer
Manufacturer provided service provider and other linkable identifiers
Service provider could not provide the phone number
A surveillance was conducted of the locations wifi. Investigator was alerted once the subject’s phone connected to the wifi, we knew he was in the building
Circumstantial evidence was the USB drive used to store the recordings only appeared on two machines. The second being a laptop which was taken home every night. Recordings were copied at 1:33 A.M.
Laptop and owner of the phone were the same
The accused was the person who the company trusted with their internal investigation as well as the party that implicated the IT person.
Social Media Linkable IdentifiersCriminals
Data Mining
The NSA
Leveraging Social MediaUser creates a social media account (Name & DOB)
Hardware information and location is obtained when the account is created. Cookie is inserted in to web browser
User is asked to link the account to a secondary email
User is asked to verify their account via text message, linking their phone to their online account
Text message confirms the GEO location, IP, and links the identifier(s)
User installs and agrees to App. App collects hardware information and gains access to the stored photos, contacts, camera and microphone
Information is used to profile and track user as well as link user to other users
Linkable Identifiers In Images
Selfies, Instagram post, and Facebook tagged images
EXIF Metadata From iPhone ImageApertureValue: 2.275007124536905BrightnessValue: 5.143226919758413ColorSpace: sRGBComponentsConfiguration: YCbCrDateTimeDigitized: 2015:01:25 10:35:27DateTimeOriginal: 2015:01:25 10:35:27ExifVersion: 2.2.1ExposureBiasValue: 0ExposureMode: AutoExposureProgram: NormalExposureTime: 0.01666666666666667FNumber: 2.2Flash: Off, Did not fireFlashPixVersion: 1.0FocalLenIn35mmFilm: 29FocalLength: 4.15ISOSpeedRatings: 32LensMake: AppleLensModel: iPhone 6 back camera 4.15mm f/2.2LensSpecification: 4.15,4.15,2.2,2.2MeteringMode: SpotPixelXDimension: 3264PixelYDimension: 2448SceneCaptureType: StandardSceneType: Directly PhotographedSensingMethod: One-chip color areaShutterSpeedValue: 5.908767772511848SubjectArea: X Center: 1169,Y Center: 1512,Width: 610,Height: 612
SubsecTimeDigitized: 038SubsecTimeOriginal: 038WhiteBalance: Auto(file) DateTime: 2015:01:25 10:35:27Make: AppleModel: iPhone 6Orientation: LeftResolutionUnit: InchesSoftware: 8.1.2XResolution: 72YResolution: 72Altitude: 1.935452560058238mAltitudeRef: Above sea levelDateStamp: 2015:01:25DestBearing: 240.9391304347826DestBearingRef: TImgDirection: 240.9391°= SouthwestImgDirectionRef: True NorthLatitude: 27.32692LatitudeRef: NLongitude: 82.54039666666667LongitudeRef: WSpeed: 0SpeedRef: km/hTimeStamp: 15:35:26PixelWidth: 3264PixelHeight: 2448FileName: IMG_6278.JPGFileSize: 1.92277 MB
EXIF Viewer Ap
Text
Embedded Linkable IdentifiersMicrochipping
Recommended