
Magnet AXIOMãžã®GrayKeyã€ã¡ãŒãžãã¡ã€ã«ã®èªã¿èŸŒã¿
ããæ°å¹ŽåãããiOSããã€ã¹ã®ãã©ã¬ã³ãžãã¯æ€æ»ã®ã»ãšãã©ã¯ãiTunesã®ããã¯ã¢ããã§ããããŒã¿ãååŸã§ããããŠãŒã¶ãŒã®ãã¹ã³ãŒããæã£ãŠããªãå Žåã«éãããŠããŸããã確ãã«ãããªãã¯å¥åŠãªãžã§ã€ã«ãã¬ã€ã¯ãããããã€ã¹ãå ¥æããããããããŸãããã1äžãã«ã®åžè²©ã®ãã©ã¬ã³ãžãã¯ããŒã«ãæã£ãŠããŠããMagnet ACQUIREã®ãããªç¡æã®ååŸããŒã«ãæã£ãŠããŠãããããã§ãæ®éã¯é¢ä¿ãªããiTunesã®ããã¯ã¢ããããã¡ã€ã«ã®è«çã³ã¬ã¯ã·ã§ã³ãšããåããã®ãå ¥æã§ããã ãã§ããããŠãŒã¶ãŒã®ãã¹ã³ãŒããæã£ãŠããªããã°ãäœãåŸãããªãã£ãã®ã§ãäœããªãããã¯ããã¯ã¢ãããããæ¹ããã·ã§ããã
èŠå¯ããŠãŒã¶ãŒã®ãã¹ã³ãŒããã¯ã©ãã¯ã§ããããã«ããããŒã«ãGrayKeyã®ã¡ãŒã«ãŒã§ããGrayshiftã®ãµã€ãã«ã¢ã¯ã»ã¹ããããŒã¿ä¿è·ã®é å»¶ããã€ãã¹ããŠiOSããã€ã¹ã®ãã¡ã€ã«ã·ã¹ãã å šäœãžã®ã¢ã¯ã»ã¹ãåŸãããšãã§ããŸããããã«ããããããŸã§ãã¹ã³ãŒããæã£ãŠããªãããã«ã¢ã¯ã»ã¹ã§ããªãã£ãããã€ã¹ãžæ€æ»å®ãã¢ã¯ã»ã¹ã§ããããã«ãªã£ãã ãã§ãªããè«ççãªã³ã¬ã¯ã·ã§ã³ãä»ããŠå©çšã§ããããŒã¿ãéãããŠããããã«ãäœå¹Žãå©çšã§ããªãã£ãiOSããŒã¿ãžã®ã¢ã¯ã»ã¹ãå¯èœã«ãªããŸãããå Žåã«ãã£ãŠã¯ãGrayKeyã¯ãä»ãŸã§èª¿æ»ããæ©äŒã®ãªãã£ãããŒã¿ãæããã«ããŸãã!
å€ãã®äººãç¥ã£ãŠããããã«ãGrayKeyã¯ååŸããŒã«ã«éããŸãããããã¯æ€æ»å®ãiOSããã€ã¹ã«å ¥ãæš©éãååŸã§ããèŠã€ãã£ãæ å ±ã®æœåºãè¡ãããä»»æã®åæãæ¯æŽãããã®ã§ã¯ãªãããšãæå³ããŸããGrayKeyæœåºã§ååŸããããŒã¿ã¯ãæ§ã ãªZIPã³ã³ããïŒBFUãAFUãFull Filesãmemãkeychain.plistïŒã«åºåãããŸããMagnet AXIOMã¯ããããã®ãã¡ã€ã«ã®åæã«äœ¿çšããããšãã§ããŸãã
調æ»å®ã«ãšã£ãŠãiOSããã€ã¹ã調ã¹ããšãã«å¿
èŠãšããçæ³çãªGrayKeyã€ã¡ãŒãžãã¡ã€ã«ã¯ãfiles.zipã§ããããã¯ãiOSã®ãã¡ã€ã«ã·ã¹ãã å
šäœãååšããæ€æ»å®ãæ€æ»ã®éçšã§äœ¿çšããããã®æå€§ã®æ
å ±éãæäŸããŸããä»ã®å©çšå¯èœãªã€ã¡ãŒãžãã¡ã€ã«ã®çš®é¡ã¯ãã±ãŒã¹ã®äœæ¥ã«åªãããã©ã¬ã³ãžãã¯é¢ã®äŸ¡å€ãæäŸããŸãããå©çšå¯èœãªå Žåã¯ãåžžã«æåã« files.zip ã€ã¡ãŒãžãæ€æ»ããŠãã ããã
ã䜿ãã®GrayKeyã¯ãpasswords.txtãšããã€ã¹æœåºã®HTMLã¬ããŒããäœæããŸããpasswords.txtã®ãªã¹ãã¯æ€æ»å®ãç®ãéãã®ã«æé©ã§ãããããŒã·ã³ã°ã®ããã«passwords.txtãã¡ã€ã«ã§ã¯ãªãkeychain.plistãAXIOMã«èªã¿èŸŒãŸããããã«ããŠãã ããã åžžã«å¿µé ã«çœ®ããŠããããš: ãŠãŒã¶ãŒã®ãã¹ã³ãŒããæã£ãŠããå Žåã§ããæœåºã«ã¯GrayKeyãå©çšããŠã調æ»ã§äœæ¥ã«äœ¿ããããŒã¿ãã§ããã ãå€ãä¿æããããã«ããŠãã ããã
次ã®ã³ã³ããã¯mem.zipã§ããããã¯iOSããã€ã¹ã®ããã»ã¹ã¡ã¢ãªãã³ãã§ããGrayshiftã®æè¡ä»¥åã¯ãæ€æ»å®ã¯ã«ãŒãã³åæã®ããã«iOSããã€ã¹ã®ããã»ã¹ã¡ã¢ãªãååŸããŠããŸããã§ãããAndroidã§ã®ã¡ã¢ãªååŸã¯å¯èœã§ãããã¹ããã®åèµ·åãå¿ èŠãªããã調æ»å€ã¯æå°éã«æããããŠããŸãããã®å ŽåãiOSã®ããã»ã¹ã¡ã¢ãªã«ã¯è²Žéãªæ å ±ãå«ãŸããŠãããAXIOMã«ã確å®ã«èªã¿èŸŒãããšãæšå¥šãããŸãã
æçµçã«ãæåŸã®ãã¡ã€ã«ã¯keychain.plistã§ããiOSã®ããŒãã§ãŒã³ã«ã¯ããŠãŒã¶ãŒãä¿åããã䜿çšããããã倿°ã®ã¢ããªçšã®ãŠãŒã¶ãŒã¢ã«ãŠã³ãããã¹ã¯ãŒããããŒãå«ãŸããŠããã®ã§ãã»ãšãã©ã®æ€æ»å®ã¯iOSã®ããŒãã§ãŒã³ãè¯ãçè§£ããŠããŸãããããã¯ã¯ã©ãŠããœãŒã¹ãå¥ã®æ¹æ³ã§èªèšŒããããšãåžæããæ€æ»å®ã«ãšã£ãŠãéèŠãªãã®ãšãªãå¯èœæ§ããããŸããGrayKeyãäœæããããŒãã§ãŒã³ã¯ãiTunesã®ããã¯ã¢ããã§ååŸãããããžã§ã€ã«ãã¬ã€ã¯ãããããã€ã¹äžã§ãã€ãã£ãã«çºèŠãããããããã®ãšã¯è¥å¹²ç°ãªããŸãããã¡ã€ã«ã·ã¹ãã ã§èŠã€ãã£ãããŒãã§ãŒã³ã¯ãæ£ç¢ºã«ã¯SQLiteããŒã¿ããŒã¹ã§ããããã以åã®ååŸæ¹æ³ã§ã¯éçããã£ããããåžžã«å©çšã§ããããã§ã¯ãããŸããã§ãããiTunesã®ããã¯ã¢ããã®ããŒãã§ãŒã³ãplistã§ããããã©ãŒããããç°ãªãã®ã§ãAXIOMã§ã¯GrayKey keychain.plistãžã®ç¹å®ã®å¯Ÿå¿ã远å ããŸããã
iOS調æ»ã®ååŸãã§ãŒãºã§ã¯ãGrayKeyãå©çšããããšã§æ€æ»å®ãåŸãããŸããŸãªãšã¯ã¹ããŒããç¹éããŸããããããã§ã¯ãMagnet AXIOMã䜿çšããŠãã®ããŒã¿ãåæããŠã¿ãŸãããã
GrayKeyã®ãšããã³ã¹ãAXIOMãžèªã¿èŸŒã
æè¿ååŸããiOSããã€ã¹ãAXIOMã«èªã¿èŸŒãæ¹æ³ã¯ããã€ããããŸãã調æ»ã®ããŒãºã«ãã£ãŠã¯ãã¯ãŒã¯ãããŒçšã®ä»ã®ãã®ããé©ããæ¹æ³ããããããããŸããã
å§ããã«ã¯ãååŸããfiles.zipãã¡ã€ã«ãèªã¿èŸŒãã®ã§ã¯ãªããæ¬¡ã®æ¹æ³ã§keychain.plistãèªã¿èŸŒãããšããŸãã¯æšå¥šããŸãã
AXIOMãåæã«äœ¿çšããããšã®å€§ããªã¡ãªããã®1ã€ã¯ãåŠçãéå§ããåã«è€æ°ã®ãšããã³ã¹ãåæã«è¿œå ããŠã調æ»å®ã®æéãç¯çŽã§ããããšã§ããã€ãŸããkeychain.plistãæã£ãŠããiOSããã€ã¹ãæ±ãå ŽåãAXIOM Examineã®ã±ãŒã¹ããã·ã¥ããŒãã«ç§»åããŠãAdd Evidenceããã¯ãªãã¯ããåã«ãããŒãã§ãŒã³ã ããåŠçããŠããã®å¯äžã®ãšããã³ã¹ã®ããŒã¿ã粟æ»ããããšãæ€æ»å®ã«ãšã£ãŠã¡ãªããããããšããããšã§ãããªããå°ãã«ãªãã®ã§ããïŒãã質åã§ãïŒæ€æ»å®ããã§ã«keychain.plistã確èªããŠããå Žåã¯ãçãããããã€ã¹ã«èŠã€ããå¯èœæ§ã®ããã¢ããªã«ã€ããŠåªããã¢ã€ãã¢ãæã€ã§ããããã§ããã°ãfiles.zipãAXIOMã«èªã¿èŸŒãã§åŠçããéã«ãSnapChatãWickrMeãiOS Notesãªã©ã®æå·åãããã¢ããªã®æœåšçãªãã¹ã¯ãŒããšããŒå€ãå ¥åããããšã§ãAXIOMã¯åŠçäžã«ãããã®ããŒã¿ããŒã¹ã埩å·åãããšããã³ã¹ãååŠçããå¿ èŠãªããæ€æ»å®ã調æ»éçšã§åæã§ããããã«ããŸãã以äžã®ããã«ãããŒãã§ãŒã³ãã AXIOM ã«æ å ±ãã³ããŒããéã«æ€æ»å®ãåç §ã§ããããã«ãåŠçäžã«åŸ©å·åã§ããã¢ããªã®ã¢ãŒãã£ãã¡ã¯ãéžæã«ããŽãªãŒå ã«æ å ±ã远å ããŸããã
次ã«ãGrayKeyã®è¿œå ãšããã³ã¹ãã¡ã€ã«ãAXIOMã«èªã¿èŸŒãæ¹æ³ãèŠãŠã¿ãŸãããã
GrayKey ç»åã AXIOM ã«èªã¿èŸŒãã«ã¯ãä»ã®ã»ãšãã©ã® iOS ç»åãšåããã¹ã§ãMobile -> iOS -> Load Evidence -> Image ãšé²ã¿ãæåã« files.zip ãéžæããŸããæ¬¡ã«ãåãããã«mem.zipãèªã¿èŸŒã¿ãŸãã
泚æç¹ãšããŠã¯ãfiles.zipã§èªã¿èŸŒãéã«ã¯ãå¿ ããã€ã¡ãŒãžãã¡ã€ã«ã察ããã¡ã€ã«ããšããã©ã«ããŒããéžæããããã«ããããšãããã«ãããAXIOMã¯ã€ã¡ãŒãžãã¡ã€ã«ããæå€§éã®æ å ±ãããŒã¹/ã«ãŒãã§ããããã«ãªããŸãã
ãªã³ã©ã€ã³GrayKeyãåããæ©é¢ã®å ŽåãååŸãããã®ãAXIOMã«èªã¿èŸŒãããšã«é¢ããŠã¯ã远å ã®ãªãã·ã§ã³ããããŸããMagnetãšGrayshiftãšã®ç¬å çãªããŒãããŒã·ããã«é¢é£ããŠãæ€æ»å®ããããã¯ãŒã¯æ¥ç¶ãä»ããŠAXIOMãGrayKeyã«çŽæ¥æ¥ç¶ããããšãã§ãããã€ã¬ã¯ãæ¥ç¶ãçšæããŠããŸãããã®ãã€ã¬ã¯ãæ¥ç¶ãªãã·ã§ã³ã«ã¯ãåæãœãããŠã§ã¢ã§ã±ãŒã¹ãéå§ããåã«ããã©ãŠã¶çµç±ã§GrayKeyããã€ã¡ãŒãžãã¡ã€ã«ãããŠã³ããŒãããæ§æ¥åã®æé ã«æ¯ã¹ãŠãããã€ãã®ã¡ãªããããããŸãããã€ã¬ã¯ãæ¥ç¶ãªãã·ã§ã³ã䜿çšããæåã®ã¡ãªããã¯ãã¹ããŒãã§ãããã®æé ã䜿çšããããšã§ãå šäœçã«èª¿æ»ãéå§ããã®ã«å¿ èŠãªã¹ããããæžããããšãã§ããååŸããiOSããã€ã¹ã®éã«é¢ããŠèšãã°ããã®æéã®ç¯çŽã¯å€§ããªãã®ã«ãªããŸãã第äºã«ãæ€æ»ã®ããã«ååŸããåŠçãããã®ã§ãAXIOMã¯GrayKeyã€ã¡ãŒãžãã¡ã€ã«ãã©ãã«ä¿åãããã«ã€ããŠããã³ããããŠæ¥ãŸãããã®ããã»ã¹ã®äžç°ãšããŠãç§ãã¡ã¯ååŸããŠãããã¡ã€ã«ãèªåçã«ããã·ã¥åããŸãã®ã§ãããªãã®ããã·ã¥å€ãäžèŽããŠããããšãGrayKey GUIããè¿ éã«ç¢ºèªããããšãã§ããŸããGrayKeyã€ã¡ãŒãžãã¡ã€ã«ãåæããŒã«ã«èªã¿èŸŒãã éã«ã察象ããé¢ããŠãããããã«èŠããããç»åãèªã¿èŸŒããªãã£ãããããšãã調æ»å®ã®å£°ãäœåºŠãè³ã«ããŠããŸããããã¯ããã©ãŠã¶ãŒãããŠã³ããŒãã®ãµã€ãºãå¶éããããã€ã¡ãŒãžãã¡ã€ã«ã®ããŠã³ããŒãäžã«ãã±ãããããããããããšãåå ã®äžã€ã§ãã
ãã€ã¬ã¯ãæ¥ç¶æ¹åŒã§ãšããã³ã¹ãèªã¿èŸŒãã«ã¯ããŠãŒã¶ãŒã¯ã¢ãã€ã«âiOSâGrayKeyãžã®æ¥ç¶ããšã¡ãã¥ãŒãç§»åããŸããæ¥ç¶ããããšãæ€æ»å®ã¯GrayKeyã«ä¿åãããŠããå©çšå¯èœãªããŒã¿ããã©ãŠã¶ãŒã§è¡šç€ºããAXIOMã§ååŸããŠåŠçãããæ§ã ãªãšããã³ã¹ãã¡ã€ã«ãéžæããããšãã§ããŸãã
èªã¿èŸŒãŸãããšãæå®ã®èª¿æ»ã®ããã«AXIOMã«ã€ã³ã¯ã«ãŒããããªãã·ã§ã³ãã¢ãŒãã£ãã¡ã¯ããéžæããããšãã§ããŸãããã以å€ã§ã¯ã¢ãŒãã£ãã¡ã¯ãã«ã€ã³ã¯ã«ãŒããããªã远å ããŒã¿ãååŸããã®ã«åœ¹ç«ã€æ©èœã®1ã€ããDynamic App Finder(DAF)ã§ãã
Find more artifactsïŒè¿œå ã®ã¢ãŒãã£ãã¡ã¯ããæ€çŽ¢ïŒãã®äžã§DAFãæå¹ã«ãããšããã£ããããžãªãã±ãŒã·ã§ã³ããŸãã¯é£çµ¡å æ å ±ãå«ãå¯èœæ§ã®ããSQLiteããŒã¿ããŒã¹ãã€ã¡ãŒãžãã¡ã€ã«ããèªåçã«æ€çŽ¢ããŸããããã¯ãæ¢åã®ã¢ãŒãã£ãã¡ã¯ãã®äžã«æ¢ã«ååšããå¯èœæ§ã®ãªãã¢ããªã±ãŒã·ã§ã³ãããŒã¿ãèŠã€ããã®ã«åœ¹ç«ã¡ãŸããDAFã®ç°¡åãªããžãã¹ã¯ãã¡ãã§èŠãããšãã§ããŸããGrayKeyã€ã¡ãŒãžãã¡ã€ã«ã®å Žåãããã¯ãã¡ã€ã«ã·ã¹ãã ãšã¡ã¢ãªã»ã€ã¡ãŒãžãã¡ã€ã«å ã®è¿œå ããŒã¿ãèå¥ããŸããã«ã¹ã¿ã ã®ã¢ãŒãã£ãã¡ã¯ãã®äœæãArtifact Exchangeã®è©³çްã«ã€ããŠã¯ããã¡ããã芧ãã ããã
ãã¹ãŠãèªã¿èŸŒãŸãããªãã·ã§ã³ãéžæããããšãä»ã®ãã®ãšåæ§ã«ã±ãŒã¹ãåŠçããAXIOM Examineã§çµæãèŠãããšãã§ããŸãã
GrayKeyãšAXIOMã䜵çšããŠiOSã®èª¿æ»ããæå€§éã®çµæãçã¿åºãæ¹æ³ã«ã€ããŠãããã«è©³ãããç¥ãã«ãªãããã§ããïŒMAGaK (Magnet AXIOM ããã³ GrayKey) é«åºŠãª iOS æ€æ»(AX301) åŠç¿ã³ãŒã¹!