EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Advanced Mobile Hacking & Forensics

Course outline

CAST6123 days

Course Description

Digital Mobile Forensics is fast becoming a lucrative and constantly evolving field, this is no surprise as the mobile phone industry has been witnessing some unimaginable growth, some experts say it may even replace the

Computer for those only wishing to send and receive emails. As this area of digital forensics grow in scope and size due to the prevalence and proliferation of mobile devices and as the use of these devices grows, more evidence and information important to investigations will be found on them. To ignore examining these devices would be negligent and result in incomplete investigations. This growth has now presented new and growing career opportunities for interested practitioners in corporate, enforcement, and military settings. Mobile forensics is certainly here to stay as every mobile device is different and different results will occur based on that device requiring unique expertise.

This course was put together focusing on what today’s Mobile Forensics practitioner requires, some of the advanced areas this course will be covering are the intricacies of manual Acquisition (physical vs. logical) & advanced analysis using reverse engineering , understanding how the popular Mobile OSs are hardened to defend against common attacks and exploits.

How will this course benefit you?

Staying updated and abreast of the latest technologies that are being developed and used by the best in the field

Protect your organization by retrieving stolen data and incriminating evidence from communications devices used by rogue employees

Influence results of civil, private litigation and criminal cases by providing crucial evidence such as the suspects involved, their locations at the time of question and the role they played by extracting this information from mobile devices

Refine current mobile forensic processes by addressing its unique problems of preserving crucial data and producing valid results

Protecting your organization by conducting proper & regular IT Audit investigations on mobile devices to ensure no misuse of company information

Course Outline :: Advanced Mobile Hacking & Forensics ::

Who should attend

Information security professional

Risk Assessment Professionals

Digital Forensics Investigators

Information Security Professionals

Mobile Developers

Penetration Testers - CEH Professionals

Law Enforcement Officers and Government Agencies

Attorneys, Paralegals and First Responders

Accountants and Financial Personnel

Anyone who deals with implementation, testing, security hardening of mobile devices

Pre-requisites

Students should have an understanding of Fundamental principles and process for digital forensics

Knowledge includes evidence acquisitions, examination analysis and final reporting

A minimum of 6 months Digital Forensics experience is recommended

Recommended Certifications

Before attending this course, it’s recommended that students have:

CHFI certification or equivalent knowledge.

A+ certification or equivalent knowledge.

Network+ certification or equivalent knowledge.

Students completing this course will gain in-depth knowledge in the following areas:

Appreciating how a Digital or Mobile Forensic Investigator processes cell phones, PDAs, and any other mobile devices that is able to store data and communicate

Covering elements of Mobile Device Hacking such as the latest genre of attacks from simple password cracking to sophisticated injection of rootkits / remote spy monitoring

Investigating the processes involved in Mobile Forensic Acquisitions, Analysis and Reporting of Mobile

Device evidence with detailed coverage on some the more popular devices such as Apple iDevices (iPhone, iPad, iTouch / iPods), BlackBerrys, Windows 7 & Android Based Devices

Defending common attacks through Mobile Device Security Hardening, understanding what works best for corporate users

Analyzing techniques to forensically preserve, acquire and examine data stored on mobile devices and their associated data

Developing a thorough understanding of how mobile devices are hacked

Familiarizing custom extraction techniques used on various mobile devices and their platforms to retrieve save several types of personal information such as contacts, photos, calendars and notes

Examining the extracted data and utilizing these results for internal investigations or in civil/criminal litigation

Course Outline :: Advanced Mobile Hacking & Forensics ::

Applying the forensic industry’s best practices, techniques and tools required for obtaining and utilizing digital evidence on mobile devices

Handling common challenges faced in the field of Digital Mobile forensics

Course Outline

  • 1. Mobile Hacking and Digital Forensic Challenges

This module will cover a broad refresher of the fundamental principles and methodologies used for legal forensics investigations

History of Digital Forensics

Global Legal System - Challenges

Technical Aspects of Mobile Forensics (What are the challenges)

Trace, Seize and investigate – Cyber Crime Case Scenarios

Criminal / Civil Incidents

Cyber Fraud

Insider / Unknown Threats

Recommended reading

Lab 1: Scenario Case Investigation

Lab 2: Evidence Analysis

After completing this module, students will be familiar with:

Creating a new case using FTK and import case evidence

Standard Evidence storage acquisition of a hard disk

Using FTK and Caine Live CD for case evidence analysis and evidence priority

Exploring the difference of Physical vs. Logical Evidence Acquisition

  • 2. Mobile Hardware Design for iPhone, BlackBerry, Android and other devices

This module will focus on the hardware design specifications of the popular mobile devices

Forensics Methodology

Why we need in-depth knowledge of the designs iDevice teardown schematics (Ipad, Iphone and Ipad)

Android teardown schematics (HTC and Samsung)

Blackberry Bold teardown

Standard designs of other mobile devices

Mobile Hardware Tool Kits

Lab: Under the hood of an iPhone

After completing this module, students will be familiar with:

Course Outline :: Advanced Mobile Hacking & Forensics ::

Diving deep into the hardware aspects of mobile devices

Appreciating the different methods, techniques and tools involved

  • 3. Mobile Software design and the common boot process for Smart Devices

This module explains how mobiles boot, and use architectural design components. It also describes how data is stored and accessed for the IOS system

Fundamental Open Source Software

Why specialize? And Latest News

Mobile OSX Architecture

Core Definitions

UI Framework IOS

OSX Boot Overview iPhone DFU – Recovery Modes

Android Boot Process

IOS Kernel Design

Jail-breaking / Rooting, REALLY? why, what and how

Lab: Jail-breaking and Rooting

After completing this module, students will be familiar with:

Understanding Apple and Android Architecture

Appreciating UI Frameworks and IOS Kernel Design

Jail-breaking and rooting IOS and Android

  • 4. Mobile Device Storage and Evidence Acquisition Techniques

This module explains how user data is stored and how to deal with deleted user evidence. It also describes the array of techniques that offer the greatest success for evidence acquisition

Analysis Open Source Tool and SDK Software kits for Apple and Android

Evidence Acquisition

Smart Phone Characteristics

Slack Space – Hidden Data

MBR – EFI Basic Storage Designs

Partitions and device specifics

Passcode Protection – Encrypted Backups

Lab 1: Binary Reality

Lab 2: Accessing Evidence

Course Outline :: Advanced Mobile Hacking & Forensics ::

After completing this module, students will be familiar with:

Using manual open-source evidence acquisition methods

Bypassing passcode protection

The importance of HEX editors

Primary unix commands and techniques used

  • 5. Advanced Mobile Attack Analysis

This module explains the genre and advanced Mobile Attacks

How Mobile Devices get Hacked

Debuggers and Decompiles

Reverse Engineering

IPA and APK Packages iPhone App Store Specifics

Lab 1: Hacking Tools and Analysis

Lab 2: Building our Environment

After completing this module, students will be familiar with:

Analyzing Real Threats

Using open source tools and techniques

  • 6. Mobile Device Hacking Techniques and Tools

This module explains how to analyze evidence and produce detailed evidence reports. It also describes how technical savvy people can obscure evidence to negate or destroy the evidence

Hacking can kill you

Threat Predictions 2011 / 2012

Mobile Hacking Techniques

IOS Platform Weaknesses

Android Platform Weaknesses

Blackberry Platform Weaknesses

Lab 1: Popular Software for Analysis

After completing this module, students will be familiar with:

Understanding Hacking Techniques and Tools.

Launching Spear Phishing Attacks.

Planting Hidden Payloads

Course Outline :: Advanced Mobile Hacking & Forensics ::

  • 7. Penetration Testing and Exploitation Vectors

This module explains the Penetration Testing training Life Cycle. It also describes the tools and techniques we can use for exploitation Vectors

Information Gathering

Manual Exploitation

Exploit Frameworks

Cracking Passwords

Lab 1: Pen Test 101

Lab 2: Pen Test Model - BlueTooth Hacking

Note: This module is designed to be 100% hands-on covering the penetration testing methodology by utilizing BackTrack v5r1

  • 8. Mobile Forensic Hardware and Software Field Kits

This module explains Forensics Hardware Options. It also describes how we can build our portable Forensics field kits

DIY Toolkit Options and costs

Commercial Comparisons

Pros and cons of open source

Field Kit Review and best practices

Lab 1: Tag and Bag

Lab 2: Building our Forensic Station and Toolkit

After completing this module, students will be familiar with:

Using open source tools and techniques

Using commercial packages

Critical aspects related to Chain of Custody, documentation and protection of evidence techniques

  • 9. Forensic Software, Evidence Analysis and Reporting

This module explains how to wrap-up the case by compiling the report and focuses on presenting the technical results in Laymen terms

Disclaimer/ Legal

Introduction to software packages

Forensics Reports

Best Evidence Rule

Evidence Report Documentation

Course Outline :: Advanced Mobile Hacking & Forensics ::

Lab 1: Creating the Report

After completing this module, students will be familiar with:

Categorizing Evidence

Evidence Tampering

The various software used

Programme scope, delivery arrangements and suitability are confirmed during enquiry.