Forensics: Blackberry Curve 8310 and Incorrect EXIF Time Stamp

While working on a forensic investigation that involved a Blackberry 8310 I ran into an issue that just didn't settle right with me. I wanted to ensure that, beyond a reasonable doubt, the EXIF time stamp embedded within a photo taken by the Blackberry device was written accurately by the device. Before signing off on the validity of the EXIF time stamp, something just didn't seem right. After digging around and doing countless tests, I was surprised that I was able to consistently recreate a failure whereby the incorrect time stamp was written to the original date/time EXIF field. Here are additional details:

DEVICE: Blackberry Curve 8310 smartphone (EDGE)

VERSIONS: v4.5.0.55 (Platform 2.7.0.68) & v4.5.0.110 (Platform 2.7.0.90)

PROVIDER: AT&T

DATE/TIME SOURCES: Blackberry & Network

ADDITIONAL ENABLED SETTINGS WORTH NOTING:

• PASSWORD (options | security options | general settings | password)
• BACKLIGHT TIMEOUT value of 30 seconds (options | screen/keyboard | backlight timeout)
  
• SECURITY TIMEOUT value of 1 minute (options | security options | general settings | security timeout)

OBSERVED BEHAVIOR:

The EXIF original date/time embedded within a photo taken by the Blackberry 8310 had the incorrect time stamp. Consistently and repeatedly I was able to have the Blackberry device write the incorrect time stamp to the EXIF field. The EXIF original date/time was inconsistent with the actual date/time that the photo was taken in addition to the “Last Modified” time displayed by the Blackberry device.

SCENARIO REPRODUCING THE PROBLEM:

1. I take a photo with the Blackberry at 0600 on 1/22/2009. The image name is IMG00001. Using the Blackberry and looking at the properties of photo IMG00001 I see the correct “Last Modified” date and time of “Jan 22, 2009 6:00AM”. Emailing the photo to my email address I then view the EXIF data of the photo on a separate forensics system and see the correct original date/time of “2009:01:22 06:00:00”.
2. An hour passes. I delete IMG00001 from the Blackberry and then take a photo at 0700 on 1/22/2009. The image name is IMG00002. Using the Blackberry and looking at the properties of photo IMG00002 I see the correct “Last Modified” date and time of “Jan 22, 2009 7:00AM”. Again, I email myself the photo and view the EXIF data of the photo on a separate forensics system. However, this time I see the incorrect original date/time. The EXIF field shows “2009:01:22 07:02:00”.
3. [update: 1/23/2009] - I can also reproduce this EXIF incorrect time stamp issue without deleting photos. This issue presents itself only with the first photo taken after the phone has automatically locked, requiring a password to unlock before the said photo with the incorrect EXIF time stamp can be taken by the device. Subsequent photos taken before the security timeout locks the device have the correct EXIF time stamps.

IMPLICATIONS:

An assumption is made that the Blackberry device is writing the correct date/time within the EXIF data when a photo is taken with the device. EXIF data within photos could potentially be used as evidence to support what an individuals recorded statement (e.g., whereabouts at a given time). From my tests there’s reasonable doubt that the EXIF time stamp of a photo taken by a Blackberry 8310 device (and perhaps others) may be incorrect. Therefore, EXIF time stamps from photos used as evidence becomes highly questionable and ultimately, and likely, could be rendered irrelevant.

ADDITIONAL NOTES & QUESTIONS:

• Blackberry and RIM have been contacted to investigate and confirm the issue.
• I was able to reproduce this issue on a single Blackberry Curve 8310 which was initially running v4.5.0.55 (Platform 2.7.0.68). I was also able to reproduce the failure after upgrading the same Blackberry Curve 8310 to v4.5.0.110 (Platform 2.7.0.90).
• I viewed the EXIF data on a Mac using both “EXIF Viewer” and “Preview”. I viewed the EXIF data on a Windows XP system using “InfranView” with the EXIF plugin installed.
• Can others reproduce the same issue on 8310’s running similar and/or different firmwares?
• Can others reproduce the same issue on non-8310 Blackberry devices?
• [update: 1/23/2009] - Could this be a residual artifact of the security lockout feature? (will need to test after disabling the security timeout)
  

Steve

###

Tools To Get Things Done

“Give us the tools and we will finish the job.” ~  Winston Churchill

Managing tasks and keeping notes readily accessible and easily searchable has been an ongoing challenge for me. In 1997 I took a Franklin Time Management class and clearly understood the necessity to effectively manage my tasks and time. However, carrying an awkward organizer with me wherever I went wasn't convenient, and I often found it annoying to pull my organizer out when I needed review my schedule and often difficult to quickly locate notes that I had taken previously.

Fortunately...through need, advances in technology and the synergy of creative minds, many electronic productivity tools have surfaced in the market over the years to help with staying organized and getting things done.

Task Management

Over the past several years I've used tools such as Jott and Remember The Milk (RTM) to help me with managing my tasks. Over a period of time I found myself growing more and more frustrated with the two productivity tools. Jott started charging money for a service that did a mediocre job with converting speech-to-text. I tethered RTM with Jott for adding tasks through speech...in other words, I was using two productivity tools to do what one should have been able to do independently.

I can't expect to meet the challenges of today with yesterday's tools and expect to be in business tomorrow. Fortunately, I found a very powerful yet easy to use productivity tool that has been working extremely well for me. Several months ago I started using ReQall as a replacement for both Jott and RTM. What exactly is ReQall? According to the marketing blurb on the ReQall website:

"ReQall is the best memory tool you may ever have, connecting all the ways you communicate in one easy-to-use reminder system. Use it on the web (no software to install!) or download it into your iPhone or BlackBerry smartphone. ... By integrating voice input, speech-to-text transcription, automatic organization and multi-platform reminders, ReQall goes beyond typical to-do and reminder applications."

I've been using ReQall to manage my tasks and shopping lists. From my experience ReQall does a much better job with speech-to-text conversions than with Jott. ReQall's web interface to manage tasks is simpler to use. I'm able to add tasks via the following; web (text), iphone app (text and voice), firefox plugin (text), phone (voice), and instant messaging (text). Plus, I appreciate now having a single solution (ReQall) to do what I had been doing with two (Jott and RTM).

ReQall also allows me to add meetings and schedule tasks for specific dates and times. For example, on my iPhone I can launch the ReQall app and say the following note:

"Meet with Mike on Friday at 3pm"

The above voice note gets converted to text by ReQall. Adding my ReQall meeting feed to my Google Calendar I then see a meeting on Friday at 3pm with Mike! I also synch my iCal with Google Calendar so that my schedule stays current and easily accessible no matter where I'm accessing it.

If I want to add an item to my shopping list, all I have to do is say "buy" and whatever it is I need to pick up at the market. Whoala, the item gets converted to text and shows up in my shopping list. My shopping list can be accessed and individual items checked off from my iPhone while at the store.

Though ReQall is currently a very useful productivity tool, there's room for improvement that will increase ReQall's value. Features I would like to see include:

• A ReQall desktop widget for Mac (RTM already has a desktop widget for Mac OS X)
• Ability to view all To-Do's and shopping list items via the Firefox extension
• Ability to check items off as completed via Firefox extension
• Ability to check items off as completed via the IM interface
  
• iPhone app: Have shared shopping list entries show up in my shopping list AS WELL as my recipient's shopping list
• iPhone app: Auto refresh when starting app, making changes to items, and at specified time intervals (e.g., every 15 mins)
• iPhone app: Ability to change user/pass from the ReQall app instead of having to go through the standard iPhone settings app

I look forward to seeing what ReQall will rollout throughout 2009!

“Computers are magnificent tools for the realization of our dreams, but no machine can replace the human spark of spirit, compassion, love, and understanding.” ~ Louis Gerstner

Note Taking, Journaling and Retrieval

Over the past six months I've been using Journler to record and search through my notes. Journler was great so long as I had my laptop next to me when I needed to retrieve notes. Ultimately, what I needed was a solution that would allow me to securely access my notes from my iPhone as well as from the web. I also wanted a productivity tool that would let me take photos with my iPhone, or other camera, of whiteboards at the conclusion of a work meeting and would place the photo into my notes and preferably convert the words on the whiteboard from the photo into searchable text (OCR).

Last month a co-worker of mine asked about Evernote. Simply put, Evernote is incredibly useful! According to the Evernote website:

"Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at any time, from anywhere."

I've now migrated all of my Journler entries into Evernote. It goes without saying, I don't store anything sensitive in Evernote unless PGP'd. I can access my notes from the web browser on my laptop, the Evernote application, and from my iPhone. Imagine I was in a meeting this morning and I took a picture of the whiteboard where the word "Monkey" was written. Evernote will convert the writing into text and make it searchable. Therefore, I can search my Evernotes for the word "Monkey" and the picture of the whiteboard will be a returned result. That's awesome!

Screenshot: Evernote iPhone App

Additional features I would like to see in Evernote include:

• Strong crypto that can be applied to specific notes requiring a separate password to encrypt/decrypt for enhanced security and privacy - see next bullet point regarding two-factor authentication;
• Two-factor authentication with support for one-time-passwords (see PayPal Security Key)

Overall, I see productivity tools finally getting to a point where there's a noticeable benefit in my productivity in using them. ReQall and Evernote are two such productivity tools.

“When you write down your ideas you automatically focus your full attention on them. Few if any of us can write one thought and think another at the same time. Thus a pencil and paper make excellent concentration tools.” ~ Michael Leboeuf

Steve

###

Microsoft out-of-band security bulletin for October 2008

Microsoft recently issued an out-of-band security advisory for a vulnerability in the server service that could allow remote code execution (MS08-067). Due to the criticality of the vulnerability, Microsoft has released a fix out-of-band (i.e., not on the regular Patch Tuesday).

It is strongly recommended that patches be tested and applied to all vulnerable systems you administrate as soon as possible. According to one source, targeted attacks using this vulnerability to compromise fully-patched Windows XP and Windows Server 2003 systems have been seen.

Advisories

MS08-67

SecurityFocus

Additional Information

Technet Blog

Steve
###

Blackhat Briefings: The Talks I Plan on Attending

The Blackhat Trainings just wrapped up and now everybody here is getting ready for the Blackhat Briefings.

After today's training I picked up my official annual Blackhat swag bag. While picking up my bag there were slews of people wandering around the Caesar's Palace Convention Center for the briefings. The number of people seems to have doubled since the trainings, which is typical.

Last week I had looked online at the list of presentations and had written down what I wanted to attend. This afternoon I reviewed my list against what was shown within the printed brochure. Assuming there's room, my plan is to attend the following presentations at the Blackhat Briefings for the next two days:

Day 1 - August 6

• 0900-0950 - Keynote: Complexity in Computer Security - Ian Angell
  
• 1000-1100 - Nmap: Scanning the Internet - Fyodor Vaskovich
• 1115-1230 - DNS Goodness - Dan Kaminsky
• 1345-1500 - Client-Side Security - Petko D. Petkov
• 1515-1630 - Xploiting Google Gadgets: Gmalware and Beyond - Tom Stracener
• 1645-1800 - MetaPost Exploitation - Val Smith

Day 2 - August 7

• 0900-0950 - Keynote: Natural Security - Rod Beckstrom
  
• 1000-1100 - Satan is on My Friends List - Shawn Moyer & Nathan Hamiel
  
• 1115-1230 - Visual Forensic Analysis and Reverse Engineering - Greg Conti & Erik Dean
• 1345-1500 - Hacking and Injecting Federal Trojans - Lukas Grunwald
• 1515-1630 - The Internet is Broken - Nathan McFeters, Rob Carter & John Heasman
• 1645-1800 - Pushing the Camel Through the Eye of a Needle - Haroon Meer & Marco Slaviero

For those of you in Twitterland - tweet me if you're going to any of the same presentations and want to say "hi" [twitter]

Steve Zenone
###

Productivity: Useful Meetings

Aaron, of the Dumb Little Man blog, just posted a helpful reminder that includes eight tips we all [should] intuitively know in order to keep meetings focussed and useful. I think we've all experienced "those" types of work meetings; whereby hours pass and very little progress, if any, has been made. The result is wasted time, wasted money, and often frustration and confusion.

Aaron writes:

The phenomenon of chronic, pointless meetings is also known as the Dilbert Meeting in some circles. Dilbert Meetings happen every day, wasting people's time and patience.

Meetings can be quite productive, but most organizers simply don’t take the steps to guarantee that a meeting will be useful.

Aaron then lists and expands upon the following eight points:

• Have a clear agenda
• Make sure that only attendees are people who need to be present
• Establish objectives for the meeting
• Have the attendees prepare in advance (if necessary)
• Keep it short
• Record key points and decisions
• Create action items and assign them
• Report progress and follow-up

I believe it's important for all of us who propose meetings to incorporate the above points into how we organize and run our meetings. The result will be better for the business, and better for the development and morale of those attending.

Steve Zenone
###

Security: Thoughts on Latest DNS Vulnerability

While on a quick trail run before work this morning, I was thinking about yesterday's announcement of a serious vulnerability in the DNS protocol. For those that don't know, yesterday Dan Kaminsky announced that there's a fundamental flaw in the DNS protocol. Shortly thereafter the United States Computer Emergency Readiness Team (US-CERT) issued a security advisory titled, "Multiple DNS implementations vulnerable to cache poisoning".

Since we're talking about a fundamental flaw within the DNS protocol itself, many implementations of DNS are considered to be vulnerable. DNS, in a nutshell, is what translates human readable and memorizable names, such as www.blackhat.com, to IP addresses that can get routed through the Net, such as 66.240.206.90.

BlackHat has made available a recording of the press conference at which Karminsky made the public announcement. Karminsky has also made available an online tool to check whether or not the primary DNS server you're using is vulnerable. A recent post on NANOG has a link to a perl script that allows one to run Karminsky's DNS checker against any nameserver.

I've heard a few individuals state that this latest vulnerability isn't critical in nature. We do know that Karminsky will be releasing full details of the vulnerability at next month's BlackHat in Las Vegas. It is also possible that exploit code could emerge prior since Karminsky did narrow down the area in which the DNS design flaw exists. Though Karminsky has stated, "This is not enough information to reverse engineer the flaw," I believe it's an extremely risky assumption for businesses to base delaying the patching of their vulnerable name servers upon.

Looking at a risk matrix, I see the this DNS vulnerability as a high risk:

Likelihood of exploitation: LOW/MEDIUM [ within 30 days]
Impact of exploitation: HIGH
-----------------
Risk Rating: HIGH

One individual I know had stated, "In terms of DNS, the world isn't any more dangerous today than it was yesterday." However, we're not just dealing with randomization of source ports which had been known publicly for several years (back in 2005). We're also dealing with the weak entropy in the DNS transfer id (DNS XID). I believe that the risk, or danger, has increased.

In some uncomfortable way, this latest issue with DNS reminds me of the levees in New Orleans that were known to have severe vulnerabilities. Eventually the threat (heavy rain) exploited (broke) the vulnerability (failing levees) resulting in negative impact (flooding, financial loss and loss of life). Ignoring the vulnerability with the levees didn't remove the risk or make things any "safer".

I'm interested to see what Karminsky produces at the upcoming BlackHat.

Steve Zenone
###

[UPDATE - 7/10/2008]: Yet another option to test your nameserver is to use the dig hack from Duane Wessels; from a unix shell type 'dig +short @nameserver-to-be-tested porttest.dns-oarc.net TXT'.

A vulnerable nameserver will display the following output:

z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"nameserver-you-tested is POOR: 22 queries in 0.6 seconds from 1 ports with std dev 0.00"

In turn, a better maintained nameserver will return the following:

z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"nameserver-you-tested is GOOD: 22 queries in 0.6 seconds from 1 ports with std dev 0.00"

Security: Instant Messaging and Enabling Business

I recently had a colleague ask me about the inherent risks in using Instant Messaging (IM) for business. Certainly, IM is an extremely effective way to communicate with team members and customers who may not be in close physical proximity. However, if used incorrectly, negative impact to the business can be massive.

There's consumer grade and business grade IM solutions. Services such as Yahoo IM are considered consumer grade. All text based IMs can either be routed through a core set of central servers and then on to the recipient, or through peer-to-peer connections. When you combine consumer grade IM services with traffic flowing in the clear (i.e., unencrypted) through central servers outside of the organization's control, you end up with a significantly elevated set of risks. Are these risks worth accepting?

Here are some of the more obvious risks that I see with using consumer grade IM for business:

• Vulnerable Clients -- advisories for vulnerabilities in chat clients are announced fairly often. Many of these vulnerabilities allow for the remote execution of code on the vulnerable client system
• Traffic can be viewed ("sniffed") -- by default, consumer grade IM clients send all of their traffic in the clear. There are plugins to provide encryption for some clients, however, all parties involved in the chat will need the crypto plugin enabled and configured correctly
  
• Data theft -- a nefarious employee could potentially move critical/restricted data to a location offsite
  
• Identity Theft -- The mechanism for consumer grade IM user authentication is weak. Grab the weak authentication traffic and an attacker now has valid login credentials. The stolen credentials can then be used to impersonate the victim and be used as a launch pad to further identify theft
• Provides IP info to attackers -- if an employee decides to go to an external chatroom with their IM client, their IP is now known to anyone else in the chatroom who may be interested...including a potential attacker. With the IP the attacker can focus their attack to a specific system
• Privacy...or lack thereof -- see all points above
• Social Engineering -- more likely to happen if an employee engages in conversations in non-business specific chatrooms

Another risk is in employees using IM for business on their home computers. Imagine, for just a moment, that an employee commits a crime against the business from their home and used IM to enable them to commit the crime. Your business won't have the authority or right to confiscate their home computer for investigation - your hands are tied behind your back. I'm sure you can start seeing where the dangers and risks start to go up.

Additionally, many chat clients will log all conversations to disk. What if confidential or restricted data is logged and stored on an individuals home computer? Other family members, or friends, may have access to that system, or perhaps the home computer is already compromised and under someone else's control (think botnet). Now the attacker can pull the chat logs and have unauthorized access to confidential or restricted data. The impact could be titanic to the business! Of course, confidential or restricted data should never be sent over IM in the first place.

In addition to having policies, procedures, and perhaps even guidelines on the proper use of IM for business, I believe the return on investment by providing an internal and redundant IM service to enable business is compelling and certainly worth considering strategically.

Steve Zenone
###