What Google knows about you and your devices (and how to get it) Vladimir Katalov ElcomSo0 Ltd. www.elcomso.com What Google knows about you Research mo;va;ons • Curiosity • Privacy • The right to know • Government surveillance • Forensics • Backup and recovery Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 2 What Google knows about you What this presentaon is NOT about • Hacking • Accessing someone else’ account • Compromising Google • Criminal acRviRes • Profit Most informa,on used for this research is public Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 3 What Google knows about you Desktop vs Mobile forensics Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 4 What Google knows about you Smartphone sales Source: Gartner, August 2015 Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 5 What Google knows about you Enterprise tablet market Source: Q2’2015 Mobility Index Report Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 6 What Google knows about you Mobile vs Cloud forensics Google mail • 900 million users (May’2015) • Monthly unique users: 90 million (2014) • Percentage of Americans using Gmail: 24% (2013) • Gmail app downloads from Google Play: 1 billion (2014) • Percentage of Gmail users working on mobile device: 75% (2015) Google Chrome • Google Chrome users: 1 billion (2015) • Percentage of web browser usage: 35% (2013) Android Apple iCloud • Introduced in Oct 2011 with iOS 5 • Number of Android devices: 1 billion (2013) • OpRonal upgrade to iCloud Drive since iOS 8 • Android share: over 80% • 5 GB free storage, up to 1 TB paid storage • Average daily Android acRvaons: 1.5 million • EXtremely convenient: over 500 million users • About 25,000 unique devices Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 7 What Google knows about you What Apple Knows About You? hbps://www.apple.com/privacy/government-informaon-requests/ • Device registraon • iCloud • Customer service records • Subscriber informaon • iTunes • Mail logs • Apple retail store transacRons • Email contents • Apple online store purchases • Photo streams • Find My iPhone • Documents • Other device informaon • Contacts • MAC address • Calendars • UDID • Bookmarks • App-specific data • All files stored on iCloud Drive • Device backups Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 8 What Google knows about you What’s Inside an iCloud Backup? • Contacts and Contact Favorites • Messages (including iMessages) • Call history • Applicaon data • Device sengs • Camera roll (photos and videos) • Purchases (music, movies, TV, apps, books) • Mail accounts • Network sengs (saved Wi-Fi hotspots, VPN sengs etc) • Paired Bluetooth devices + iCloud Drive • Offline web applicaon cache/database • More applicaon data • Safari bookmarks, cookies, history, offline data • Passbook data • Geolocaon history and places • User’s dicRonaries • Passwords (encrypted with device key) • Documents • ... and much more • 1Password database • WhatsApp own backup Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 9 What Google knows about you Over-the-Air Acquisi;on: iCloud and iCloud Drive We have: • Apple ID and password, or • PC or Mac synced with iCloud (binary authenRcaon token) Acquisi;on steps: • Use Apple ID and password to download the backup • EXtract binary authenRcaon tokens, use to download backup or data Notes: • Two-factor authenRcaon may be an issue - Using binary authenRcaon token bypasses 2FA • Keychain is encrypted with hardware key - Can be decrypted if securityd key is eXtracted from the device • Full data set acquisiRon speed is slow - Can quickly download & analyze selected informaon, full data set later • Account owner may receive a noRficaon email in 10 minutes aer download is started (iCloud backup only) Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 10 What Google knows about you Most Known iCloud Hacks • Dmitry Medvedev (Russian Prime Minister) Twiber account hacked (August 2014) hbp://www.theguardian.com/world/2014/aug/14/dmitry- medvedev-russian-pm-twiber-account-hacked • Celebrity photo hack (August 2015) hp://en.wikipedia.org/wiki/2014_celebrity_photo_hack • Leaked Emails Reveal What Vladimir PuRn Tells World Leaders at Private Meals (May 2015) hbp://globalvoicesonline.org/2015/05/08/russia-leaked-emails- reveal-what-vladimir-puRn-tells-world-leaders-at-private-meals/ Sorry guys, see our disclaimer J Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 11 What Google knows about you Soluon: Two-Step Verificaon? § If enabled, 2FA is enforced for iCloud backups - but not files sideloaded to iCloud Drive - …and not for iCloud-compable app data § Overcoming 2FA is easy - if the second authenRcaon factor is available § Bypassing 2FA is possible - if binary authenRcaon token is eXtracted from user’s PC/ Mac Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 12 What Google knows about you iCloud Authen;ca;on Tokens • AuthenRcaon tokens are used for convenience • Saved on a Mac or PC used to access iCloud • Allow users to avoid entering for Apple ID and password every Rme • Technically, an authenRcaon token is stored in a file on the user’s computer (see figure) What Authen;ca;on Tokens • Locang the file and eXtracRng the token allows bypassing login/password Are Not authenRcaon and 2FA • AuthenRcaon tokens do not contain a password to the user’s Apple account • They don’t contain a hash of the password either • They cannot be used to brute-force the original plain-teXt password Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 13 What Google knows about you Android device fragmenta;on Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 14 What Google knows about you Android brand fragmenta;on Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 15 What Google knows about you Android opera;ng system fragmenta;on Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 16 What Google knows about you Android to the Rescue? Not So Sure • user’s data • all connected devices • devices/browsers that requested access • applicaons that requested access • Google Ads sengs (age, interests etc.) • contacts • calendars • notes • mails • albums (photos/puctures/videos) • Hangouts conversaons • Chrome • History Top 10 Smartphone Apps (source: comScore report, June 2015) • synced passwords and autofill data • bookmarks • Facebook • Google Maps • search history • YouTube • Pandora Radio • YouTube [search] history • Facebook Messenger • Gmail • a lot of stasRcal informaon • Google Search • Instagram • Google Play • Yahoo Stocks Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 17 What Google knows about you Google Sign-On Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 18 What Google knows about you Google Security Sengs Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 19 What Google knows about you Recent security events and used devices, apps connected, saved passwords Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 20 What Google knows about you Google Takeout • Leaves traces • No all the data is eXported • Limited fleXibility • Not convenient format Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 21 What Google knows about you Google Dashboard – account ac;vity Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 22 What Google knows about you Google Dashboard – profile, connected devices & apps Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 23 What Google knows about you Google Dashboard – mail Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 24 What Google knows about you Google Chrome Sync Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 25 What Google knows about you Google Chrome: search & browsing history hbps://history.google.com/history/ • Total searches • Searches by day • Top search clicks • Map search history • Voice search history • Info on devices • Locaon history What is saved: • Searches in all Google services • Browser or mobile applicaon • AcRons for search results (opened or not) • AcRons on Ads (clicks/purchases) • IP address • Browser informaon Google Takeout does NOT work with history Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 26 What Google knows about you Android device backups • Google Calendar sengs • Wi-Fi networks & password • Home screen wallpapers • Gmail sengs • Apps installed through Google Play • Display sengs • Language & Input sengs • Date & Time • 3rd party app sengs & data Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 27 What Google knows about you Google Photos (aka PicasaWeb, aka Google+ Photos) • Albums/events • Commants • Geo tags • Subscripons • View counters • People Academia Sinica, Nankang, Taipei AUG 28-29, 2015 www.elcomso.com Page 28 What Google knows about you Android device backups - downloading IBackupTransport (com.android.internal.backup in GoogleBackupTransport.apk) No source code provided; works with hPps://android.googleapis.com/backup Authen;ca;on: hps://android.clients.google.com/auth Download backup: h\ps://android.clients.google.com/backup • Get refresh token (input: email, password) • Get authenRcaon token (input: refresh token) • Input: android_id, package to restore (download), Auth • Output (array of strings):