dissertation

Recommendations

Info

contact lists registers that it provides contacts, and any application wishingto read contact lists will send intents addressed to whichever content provideris currently registered, regardless of its actual name and implementation.All inter-process communication in Android uses Binder, and Binder providesthe name of the calling application to the callee. This means that anyapplication receiving an intent asking for information can check which applicationis asking.3.5 Package managementApplications are delivered to Android devices in a format called APK 7 [16].In addition to the program code, the APK file contains metadata such asa digital signature, requests for permission to access restricted data, andthe minimum version of the Android API required for the application torun [8]. The package manager, called “pm”, is responsible for taking thisfile, processing the metadata and, if no problems occur, install the program.It is also responsible for uninstalling programs, which includes deleting thecontents of their private directories.3.6 RootingAndroid uses the Linux kernel, which includes the standard UNIX discretionaryaccess control system. In this system, the superuser, called root, hascomplete access and can bypass all privilege checks. Normally, Android doesnot allow a physical user access to the root account. However, using securityvulnerabilities in the standard Android system, it is possible to make the systemrun code as root for the user. This code can then set up more convenientmethods for the user to gain root access later. This process is called rootingthe phone. Some phones aimed at developers, such as the Google/SamsungNexus S [71], have a built-in switch for allowing root access, removing theneed for exploiting security vulnerabilities.7 Application Package15
Once root access has been obtained, the user is in complete control overthe phone. In particular, they can replace the operating system with a customversion of Android. This is accomplished by replacing the recoveryimage [59], an alternate firmware present in all Android devices which thestandard Android bootloader can boot instead of the main Android system.The standard recovery image allows very few operations, such as resetting thedevice to factory defaults and installing approved operating system updates.Alternate recovery images, such as ClockworkMod [17], allow additional operationssuch as taking complete system backups and replacing the entireoperating system from a ZIP file on the SD card. Installing a modified versionof Android is accomplished by storing the new version in a ZIP file onthe SD card, booting the recovery image, choosing to install a new operatingsystem, and selecting the ZIP file.A few Android devices allow the user to replace the recovery image withoutfirst rooting the phone, using a method called fastboot [58]. When infastboot mode, instead of booting from the built-in memory, the phone waitsfor commands from a PC attached via USB. The accepted commands includeone for writing a new recovery image to the phone. However, only afew old phone models and models targeted towards developers enable fastbootby default [65]. For the majority of Android phones, using the fastbootmethod would require first rooting the phone and using the elevated privilegeto install a new bootloader which allows fastboot.3.7 Community distrubutions of AndroidIn order to make Android a successful platform for diverse devices, Googlemade it open source [74]. In particular, they chose to license the sourcecode for the system under the Apache License 2.0 [44] as far as possible[73]. This license is approved as an open source license by the Open SourceInitiative [89] and as a free software license by the Free Software Foundation[88]. The Android Open Source Project [11] distributes this source code andprovides compliance test suites for ensuring that any modifications still meetthe Android specifications.16
Page 2: AbstractIn forensic analysis of mob
Page 8 and 9: Chapter 1IntroductionAccording to t
Page 10 and 11: forensics tools Cellebrite and XRY
Page 12 and 13: 2.1.1 Data hidingFor PC anti-forens
Page 14 and 15: Detecting a USB connection suffers
Page 16 and 17: protected program can access it, as
Page 18 and 19: modifications at different times, t
Page 20 and 21: esponsible for handling security an
Page 24 and 25: Several projects have built upon th
Page 26 and 27: to return false data to the tools.
Page 28 and 29: 6. Connection to a forensic analysi
Page 30 and 31: To install it, then, requires the c
Page 32 and 33: Step 4 According to the documentati
Page 34 and 35: Chapter 5Implementation, testing an
Page 36 and 37: The two modules are raw contacts an
Page 38 and 39: 200-500 small writes in the time fr
Page 40 and 41: make the data impossible to spot in
Page 42 and 43: had time to isolate the phone befor
Page 44 and 45: abort the extraction and show the e
Page 46 and 47: (a) Extraction summary(b) Extractio
Page 48 and 49: Figure 5.11: Cellebrite extraction
Page 50 and 51: Figure 5.14: Contacts fed to Celleb
Page 52 and 53: (a) Cellebrite extraction report(b)
Page 54 and 55: (a) SIM contacts visible(b) SIM con
Page 56 and 57: Chapter 6ConclusionsThis dissertati
Page 58 and 59: Android is an open system, with spe
Page 60 and 61: • Hide SIM contacts from the fore
Page 62 and 63: that it is possible to use Java ref
Page 64 and 65: 7.3 EncryptionStarting with version
Page 66 and 67: operating system components, but th
Page 68 and 69: Appendix BTool behaviourThe followi
Page 70 and 71: S e l e c t i o n : i d = 1 ANDmime
Page 72 and 73:
Appendix CSource codeC.1 USBMonitor
Page 74 and 75:
∗/private S t r i n g e o l ;priv
Page 76 and 77:
}}Bundle e x t r a s = i n t e n t
Page 78 and 79:
index 3 bee54d . . 0 0 be75e 100644
Page 80 and 81:
73import android . p r o v i d e r
Page 82 and 83:
+ }+ r e t u r n n u l l ;+ }+@Over
Page 84 and 85:
@@ −4349 ,6 +4384 ,7 @@ p u b l i
Page 86 and 87:
c a s e POSTALS: {+ Log . i (TAG,
Page 88 and 89:
qb . setProjectionMap ( sGroupsSumm
Page 90 and 91:
c a s e RAW CONTACT ENTITIES: {+ Lo
Page 92 and 93:
index f 2 b 6 f c e . . 1 eb2972 10
Page 94 and 95:
87++ // A t t r i b u t e s c o n s
Page 96 and 97:
89+ i n t s t r O f f = s t O f f +
Page 98 and 99:
C.4 Delayed responsesThis is the co
Page 100 and 101:
+ p r i v a t e boolean c a l l e r
Page 102 and 103:
95index 00 be75e . . cb000e9 100644
Page 104 and 105:
p r i v a t e boolean i n i t i a l
Page 106 and 107:
99+ // no d e l e t e d c o n t a c
Page 108 and 109:
101+ Log . i (TAG, ” Unknown quer
Page 110 and 111:
103+ // I n t e n t i o n a l l y r
Page 112 and 113:
105+ ” n u l l as ” + Structure
Page 114 and 115:
107+ ” ” + PhoneticNameStyle .U
Page 116 and 117:
C.6 False data from alternate datab
Page 118 and 119:
− p r i v a t e s t a t i c f i n
Page 120 and 121:
+import com . android . p r o v i d
Page 122 and 123:
Log . i (TAG, ” S e l e c t i o n
Page 124 and 125:
C.7 Delayed restorationThis is the
Page 126 and 127:
119+ Log . i (TAG, ” Faking ” +
Page 128 and 129:
121− // b e f o r e and a f t e r
Page 130 and 131:
C.8 Hiding SIM contactsThis is the
Page 132 and 133:
++ // This i s the CyanogenMod 7 .
Page 134 and 135:
ArrayList r e s u l t s ;− i f (
Page 136 and 137:
index c218592 . . a4dbaae 100644−
Page 138 and 139:
131+ /∗+ ∗ ( non−Javadoc )+
Page 140 and 141:
package com . android . p r o v i d
Page 142 and 143:
135++ /∗+ ∗ ( non−Javadoc )+
Page 144 and 145:
137+ Log . i (TAG, ” Running quer
Page 146 and 147:
Appendix EDeclaration of originalit
Page 148 and 149:
[8] Android development guides—Th
Page 150 and 151:
[34] Tarpit (networking). http://en
Page 152 and 153:
[53] ACPO e-crime working group. Go
Page 154 and 155:
[73] Android Open Source Project. L
Page 156:
[94] Randal Vaughn and Gadi Evron.
show all

dissertation

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?