“Encryption threatens to lead all of us to a very dark place.” Disk Encryption “Encryption threatens to lead all of us to a very dark place.” ~ James Comey

Overview Encrypted Drives Bitlocker Small note on Apple FileVault Homework

Encrypted Drives Different types of file encryption Disk Encryption Full Partial File-system Level Encryption Files Directories Stackable file system encryption

Encrypted Drives Issues How is the volume decrypted (password, token, both)? Where are the keys stored? Which encryption algorithm? When should the data be decrypted? Boot time, mount time, user login time, etc.? Should there be a backdoor? In what circumstances? User forgets their password and authenticates some other way?

Encrypted Drives Why? Full-disk encryption is really a last ditch effort to protect your data If your computer is on (you don’t have to be logged in) it means nothing If it’s off why are you carrying around a brick all day? You should still use it

Encrypted Drives Identifying Encryption software often still has metadata, magic numbers and headers stored on the drive? Thinking about full disk encryption, and knowing what you know now about the boot process, where do you think this data might reside? Encrypted Partition? What programs are installed on the system? Various tools will perform the identification process for you. A lot of the time is encryption technology specific(dislocker for Bitlocker https://github.com/Aorimn/dislocker/, etc.)

BitLocker BDE - is Full Volume Encryption solution by Microsoft first included with the Enterprise and Ultimate editions of Windows Vista. It is also present in Windows 7 and later version along with a system for encrypting removable storage media devices, like USB, which is called BitLocker To Go. A newer non/backwards compatible Bitlocker was released with Windows 10. Newer versions allow “multi-factor” authentication This may be a user-entered pin and the TPM or user-password and token With a recovery-key you can bypass any multi-factor authentication Can be used to port block DMA If used in conjunction with TPM can have defenses against hardware based attacks Side-note Bitlocker is disabled during Windows updates… (Might be an interesting research area)

BitLocker AES-CBC, AES-XTS (https://sockpuppet.org/blog/2014/04/30/you-dont- want-xts/ ), 128 or 256 bits Creates its own partition to contain unlocking code to decrypt your disk. If using BitLocker-to-GO you will have a hybrid encrypted volume Supports network unlock functionality User has to be logged in to a network before they can decrypt the volume or they have to enter a pin. A lot of administrative and enterprise benefits Integrates well with Windows ;)

BitLocker If the computer is on, you generally have nothing to worry about (you still might hit a few snags) We will talk about recovering these keys during our memory forensics slides The keys may be in memory or they could be stored in Active Directory services If the computer is off it may be a bit more difficult If you are working a criminal case it appears from my reading you will generally be able to get the recovery key directly from the user (by court order), if they are cooperating. We will talk about tools to detect and mount and encrypted BitLocker volume (https://github.com/Aorimn/dislocker/ )

BitLocker dislocker dislocker-bek: for dissecting a .bek(recovery key) file and printing information about it dislocker-metadata: for printing information about a BitLocker- encrypted volume dislocker-find: not a binary but a Ruby script which tries to find BitLocker encrypted partition among the plugged-in disks (only work if the library is compiled with the Ruby bindings) dislocker-file: for decrypting a BitLocker encrypted partition into a flat file formatted as an NTFS partition you can mount

BitLocker dislocker dislocker-fuse: the one you're using when calling `dislocker', which dynamically decrypts a BitLocker encrypted partition using FUSE Dislocker - Given a decryption mean, the program is used to read or write BitLocker encrypted volumes. Technically, the program will create a virtual NTFS partition that you can mount as any other NTFS partition. dislocker -V encrypted.bitlocker -f /path/to/usb/file.BEK -- /mnt/ntfs -V - volume Encrypted.bitlocker - dd of bitlocker volume --user-password - pass user password to use for decryption

BitLocker Other tools bdeinfo bdemount Final note If you are using a Windows 7 machine as your forensics analyst platform but you are analyzing a Windows 10 Bitlocker volume you will not be able to decrypt the volume using conventional forensics tools (EnCase, FTK, and others). You will need to switch to a Windows 10 machine

Apple FileVault2 XTS-AES-128 encryption with a 256-bit key File Vault Options If you're using OS X Yosemite or later, you can choose to use your iCloud account to unlock your disk and reset your password.* If you're using OS X Mavericks, you can choose to store a FileVault recovery key with Apple by providing the questions and answers to three security questions. Choose answers that you're sure to remember.* If you don't want to use iCloud FileVault recovery, you can create a local recovery key. Keep the letters and numbers of the key somewhere safe—other than on your encrypted startup disk.

Apple FileVault2 XTS-AES-128 encryption with a 256-bit key Key Recovery RAM capturing tool must be executed on a running computer with FileVault 2 container unlocked and a user logged in Go for the weakest link depending on how the key may have been stored Can you get into their phone? Weak passwords Or..

Apple FileVault2 Key Recovery Just grab the wipe key from the recovery partition EncryptedRoot.plist.wipekey use that to derive the key to unlock the filevault volume But wait that’s encrypted Yeah encrypted with a key that is stored in the recovery drive partition headers But wait that only work in OS X Lion (circa 2011) Sure now it is more difficult but it depends on the option the user chose when setting up the encryption Most likely will have to grab it from dumped RAM Or grab the password hashes and use http://openciphers.sourceforge.net/oc/vfcrack.php to crack the FileVault volume

Apple FileVault2 Mounting https://github.com/libyal/libfvde/wiki/Mounting libfvde paper - https://eprint.iacr.org/2012/374.pdf

Questions?

Homework Problem 1 Problem 2

Relevant Links FileVault2 Mounting - http://az4n6.blogspot.com/2016/07/mounting- and-reimaging-encrypted.html?m=1 FileVault2 how does it work? Some interesting RE stuff as well https://www.cl.cam.ac.uk/~osc22/docs/cl_fv2_presentation_2012.pdf https://docs.microsoft.com/en-us/windows/security/information- protection/bitlocker/bitlocker-frequently-asked-questions https://docs.microsoft.com/en-us/windows/security/information- protection/bitlocker/bitlocker-device-encryption-overview-windows-10 https://github.com/Aorimn/dislocker/

Interesting Forensics Papers Forensics tool automation and parallel imaging and carving http://www.ingentaconnect.com/contentone/ist/ei/2017/00002017/00 000007/art00005 Subverting hardware firmware bootkits https://www.sciencedirect.com/science/article/pii/S1742287617303316