WEBVTT 00:00.000 --> 00:02.680 I'm putting it in the GitHub repo there. 00:03.120 --> 00:10.360 I've got the lab files, I've got the software you need, and I do want to explain this because I know people are already clicking and cloning and stuff like that. 00:10.440 --> 00:15.460 What you're going to need, there's three components to the labs that we're going to do. 00:15.760 --> 00:17.700 One, you're going to need some software. 00:17.900 --> 00:31.480 I did it this way because with the work from home and COVID-19 stuff, I've done at least 20 workshops in the last couple of months, and I've started realizing that people's home internet isn't always reliable and stuff like that. 00:31.480 --> 00:49.000 So the attempt with this, and I've had a couple people say they didn't like it, but I think it saves a lot of us who didn't get a chance to download a 20 gig VM before the workshop, is that rather than doing a virtual machine for you, what you have here is four pieces of software you need that run off of Windows. 00:49.360 --> 00:53.980 So obviously you can get a VM if you want and install those, but any Windows 10 machine should work. 00:53.980 --> 00:57.560 You need the database browser for SQLite, Notepad++. 00:57.640 --> 01:01.740 Obviously you could use Atom or anything else, but that's the one I recommend. 01:01.740 --> 01:07.360 You need a hex editor such as HXD hex editor, and then you do need Registry Explorer. 01:07.360 --> 01:11.520 The one I'm using in the lab is version 1.5.2 or 20. 01:12.300 --> 01:14.660 And then there's three labs we're going to work on. 01:14.660 --> 01:20.020 I don't know if we'll get through all of them or not, but I've got the workthroughs and actually the answers. 01:20.020 --> 01:25.400 So if we only get through one or two of those labs, you've got everything you need. 01:25.400 --> 01:36.060 The third component that's not on the screen here is that what I did is I had a virtual machine with everything throughout the scenario that we're going to talk about. 01:36.100 --> 01:45.920 And with that, I then used Cape to extract the key artifacts that we're going to look for throughout the workshop. 01:45.920 --> 01:52.720 And so rather than getting a whole virtual machine with a couple of interesting things I wanted you to look at, I just extracted those interesting things. 01:52.720 --> 01:58.080 So there's a zip file that's called... let's see if I can find it on my screen here. 01:58.640 --> 02:06.560 It is evidence and then it's a dash, desktop dash, and some random numbers dot zip. 02:06.560 --> 02:10.020 That will need a password of infected all lowercase. 02:10.020 --> 02:12.840 I recommend you not use Windows Explorer to extract it. 02:12.840 --> 02:16.780 It generally has issues realizing that it's encrypted or has a password. 02:17.820 --> 02:19.880 Don't worry, there is no malware. 02:19.880 --> 02:22.780 I just wanted to password protect it and I knew I'd forget what it was called. 02:22.780 --> 02:26.200 So all my workshops I just use infected as the password. 02:26.320 --> 02:35.400 What you're going to have in there is those key artifacts from a Windows 10 machine where an incident happened and we'll kind of walk through that scenario and what that looked like. 02:35.780 --> 02:38.180 Okay, so I'll move on here. 02:38.820 --> 02:43.040 My name is Michael Wiley, Director of Cybersecurity Services at Richie Mae Technology Solutions. 02:43.140 --> 02:46.240 I'm an avid certification collector. 02:46.840 --> 02:48.380 It's just one after another. 02:48.380 --> 02:49.400 I love to learn. 02:49.400 --> 02:56.380 I've been in the industry for a while and the more I learn, the more I realize I don't know and I need to expand my knowledge. 02:56.380 --> 03:00.980 So some people ask why I've got certifications in such different areas. 03:00.980 --> 03:03.540 For example, I've got some pen testing certs. 03:03.540 --> 03:12.000 Then I also have some architecture and design certifications, your CCNAs, and then I also have a Windows Forensics certification. 03:12.000 --> 03:15.160 But I think that all those complement my day-to-day job. 03:15.260 --> 03:22.460 And the more I learn about other fields, I realize how that can help me in the tasks I do, even if I'm not a forensic examinator per se. 03:22.460 --> 03:24.720 I'm not for law enforcement or anything like that. 03:25.380 --> 03:28.460 I've got my LinkedIn and Twitter information on the bottom corner there. 03:28.520 --> 03:29.640 Please connect. 03:29.640 --> 03:31.820 That's probably the best way to get ahold of me after this. 03:32.160 --> 03:37.060 I respond quicker, even quicker than email if you connect with me on LinkedIn. 03:37.300 --> 03:41.800 I also post a lot of things I find relevant or interesting about the industry. 03:42.100 --> 03:47.840 Prior to my joining Richie Mae Technology Solutions, I owned a boutique cyber security firm in Los Angeles. 03:48.120 --> 03:51.140 That's where I really grew a lot of my security skills. 03:51.300 --> 03:58.220 Even though I'm a director now, I'm very hands-on, and I think you'll see that a lot of my workshops and slides are quite technical in my opinion. 03:58.760 --> 04:03.060 I get bored with paperwork, even though I have to do a lot of policy and procedure work these days. 04:03.060 --> 04:05.280 I still like doing pen tests. 04:05.280 --> 04:06.760 I'm a recovering red teamer. 04:06.760 --> 04:09.640 I still like doing forensic examinations. 04:09.640 --> 04:12.940 It's how I wake up in the morning, if you will. 04:13.700 --> 04:14.880 That's it about me. 04:14.880 --> 04:18.180 Let's get on to a little bit about the company I work for. 04:18.760 --> 04:28.000 I did have my firm for a long time, and once I had a kid , I realized I wanted to not work as many hundred-hour weeks, and I wanted to spend a little more time with the family. 04:28.000 --> 04:32.200 So my firm merged with Richie Mae to form Richie Mae Technology Solutions. 04:32.320 --> 04:35.180 We do a lot of cloud workflow integrations. 04:35.520 --> 04:45.420 I work with, specifically since I'm near Hollywood, I work with a lot of the studios and the vendors that make the movies you used to watch at AMC, and now you watch at home or on streaming platforms. 04:45.500 --> 04:48.660 So I do a lot of content protection and workflow and stuff like that. 04:49.220 --> 04:57.120 I used to be one of 20, now I'm one of 40 worldwide that can do security assessments on behalf of the major studios that make films. 04:58.060 --> 05:05.180 So the learning objectives for this workshop, we're going to learn what file artifacts are available in cloud solutions, cloud file storage solutions. 05:05.180 --> 05:10.040 We're going to see what kind of cloud file storage user activities can be enumerated. 05:10.040 --> 05:17.460 We'll be introduced to application log capabilities, examine the difference between providers, and so on and so forth. 05:17.460 --> 05:18.920 Now, one thing I do want to... 05:18.920 --> 05:21.320 I want to give recognition where recognition is due. 05:21.760 --> 05:31.940 I worked in Instant the first time I started getting into some of these cloud file storage solutions and trying to dig a little bit deeper was I was working a case, I don't know, three years ago-ish. 05:31.940 --> 05:38.140 And it was a company where the COO was a relative to the CEO. 05:38.260 --> 05:42.620 And that person left the company and there was suspicion that they poached a lot of the clients. 05:43.240 --> 05:50.200 And they asked us to do a forensic examination on the hard drive and figure out if information was sent, stolen. 05:50.320 --> 05:53.740 There was just a lot of odd behaviors about how that person left the company. 05:53.740 --> 06:03.340 And so one of the things I found there was a cloud file storage solution, and we were able to identify what files were uploaded, synced, things like that. 06:03.340 --> 06:06.160 And this cloud file storage solution was not sanctioned by the company. 06:06.160 --> 06:12.220 So this was a personal account that was installed on the Windows machine and was used to exfiltrate data, essentially. 06:12.220 --> 06:19.640 And so I got into it in that forensic examination, and I got curious, did a little more research, and then I ended up taking a SANS course as well. 06:19.640 --> 06:23.880 And they had a section on that that filled in a lot of the gaps of my research that was missing. 06:23.880 --> 06:27.100 So, you know, there's a lot of people and their research involved. 06:27.100 --> 06:40.200 So I do want to put their names on the screen and recognize them, including SANS Institute and a lot of people that had research on sections of these tools, because there's a lot of information throughout here, and they've helped fill in a lot of the gaps for me. 06:41.060 --> 06:46.680 So cloud file storage overviews, you know, what exactly we're talking about when I say cloud file storage solutions? 06:46.680 --> 06:56.600 Well, we're talking about your boxes, Dropbox, OneDrive, Amazon Drive, Google Drive, ShareFile, iCloud, those kind of things when I talk about a cloud file storage solution. 06:56.820 --> 07:06.180 Now, the reason they're becoming so popular is that there's this perceived benefit that you get when you switch to one of these, reuse one of these over, let's say, a file sharing, an on-premise file share. 07:06.180 --> 07:20.360 You get protections against disasters, and these are perceived because obviously everyone's had their outage, but these providers can do a lot better job than system administrators, in my opinion, from every organization to keep their data available. 07:20.360 --> 07:26.700 So when there's a pandemic, and everyone's got to work from home, you know, overnight, essentially, you still have access to those files. 07:27.120 --> 07:31.760 Disperse teams, they can have access to these files, rather than having a VPN in. 07:31.760 --> 07:41.260 You've got decrease in maintenance, so system admins don't have to update the underlying operating system, they don't have to patch Adobe, they don't have to do all that maintenance on the file share. 07:41.280 --> 07:49.140 If anyone's ever worked with DFS, I mean, that's why cloud file storage solutions are becoming more popular, in my opinion. 07:49.140 --> 07:51.580 They've got that high availability, they're scalable. 07:51.580 --> 08:01.320 So rather than adding hard drives to RAID, or adding more servers to a cluster, you just literally say, Google, here's an extra 10 bucks a month, now give me an extra terabyte. 08:01.320 --> 08:04.460 So it's very easy to scale that. 08:04.720 --> 08:06.560 You've got ease of management. 08:06.560 --> 08:13.840 So you've just got GUIs and web interfaces, you can provision new users through web portals, as well as single sign on, etc. 08:13.840 --> 08:16.520 It's very easy for user management. 08:16.820 --> 08:20.240 And then we may see two different solutions that I'll kind of talk about a little bit later. 08:20.240 --> 08:26.120 And one is that you may have a business authorized or business sanctioned cloud file storing solution. 08:26.180 --> 08:33.060 So maybe it's an enterprise Office 365 account, and they give you OneDrive, or you have a business version of Dropbox. 08:33.060 --> 08:42.300 But then we also run into scenarios where I often see these different providers out there on Windows machines, or even Mac machines, where they were not sanctioned by the company. 08:42.300 --> 08:46.580 And maybe someone thought they were doing the company a favor because they had to move files from one machine to another. 08:46.580 --> 08:55.520 I vividly remember coming in trying to help architect a more secure solution for a plastic surgery firm in Beverly Hills. 08:55.900 --> 09:02.580 And the company ended up, they only had a couple people, but they were doing plastic surgery on famous people. 09:02.580 --> 09:05.740 And they wanted to have isolated air gap networks. 09:05.740 --> 09:06.760 And I thought, great. 09:06.900 --> 09:08.180 And they said, so this is kind of what we did. 09:08.180 --> 09:11.560 We want a better solution because we've got one computer here for internet access. 09:11.840 --> 09:14.840 And then we have another computer over here and that has medical files. 09:14.840 --> 09:17.560 And everyone's got two computers and they're swiveling back and forth. 09:17.560 --> 09:18.560 We call it swivel net. 09:18.920 --> 09:21.740 So you do one job or another, so there's got to be a better way. 09:21.740 --> 09:25.060 And I was like, well, this actually sounds fairly secure, but let me look into it. 09:25.060 --> 09:39.800 And as I dug into it, I realized, yes, they were two different computers, but they had personal Dropbox accounts on both computers and they were syncing the files back and forth because they needed to, obviously they downloaded stuff from, let's say an EMR and they needed to move it into the, 09:39.800 --> 09:42.500 I don't want to say production network, but the medical network. 09:42.500 --> 09:45.000 And there was that bridge that was gap there. 09:45.000 --> 09:46.760 And so that was not a commercial version. 09:46.760 --> 09:55.400 That was a Gmail or Yahoo or an AOL account that the employees set up because they thought they were making their job more efficient, but there was no control over that. 09:55.400 --> 09:58.140 So this came from Spiceworks. 09:58.140 --> 09:58.700 I apologize. 09:58.700 --> 09:59.520 I don't have the source there. 09:59.520 --> 10:01.280 I'll try and post that later on. 10:01.320 --> 10:03.040 But it's a Spiceworks study. 10:03.040 --> 10:04.140 You can Google it. 10:04.140 --> 10:08.100 Cloud file storage solutions, Spiceworks, market research, and you'll find this. 10:08.100 --> 10:13.960 But I tried to extrapolate some of the interesting things that I saw here, obviously from a couple of perspectives. 10:13.960 --> 10:22.060 One, so you know what's more prevalent, but two, depending on which side of the fence you are on, if you're offensive security, you can see what you're most likely to see, right? 10:22.060 --> 10:28.180 And obviously Microsoft OneDrive, they've baked that into Windows 10 and they make it very easy for you to use OneDrive. 10:28.240 --> 10:34.200 And so we're seeing that organizations more and more are using OneDrive solutions, right? 10:34.200 --> 10:35.540 Followed by Google Drive. 10:35.540 --> 10:37.980 I believe that's because of G Suite and that's kind of bundled in there. 10:37.980 --> 10:43.080 And then Dropbox is the largest independent source that you may see out there in the enterprise. 10:43.280 --> 10:47.780 And then followed by Box has a very small market share, except for large enterprises. 10:47.840 --> 10:51.600 We see a lot of that within different studios and post-production houses. 10:51.600 --> 10:55.260 They've done some work with the MPA and I think that's why we see that. 10:55.660 --> 11:00.600 And then Citrix ShareFile, not very popular, but I see a lot in the financial sector. 11:00.600 --> 11:03.260 So Richie May really focuses on two verticals. 11:03.260 --> 11:05.880 We're in the media entertainment space and we're in the financial space. 11:05.880 --> 11:10.260 We've got clients in all different industries, but those are really our niches. 11:10.320 --> 11:12.900 And so I see a lot of Citrix ShareFile. 11:12.900 --> 11:16.340 I thought it was going to be more than whatever it says there, about five to 10%. 11:16.340 --> 11:21.500 But since I see it so much, I have the research and I included it in this workshop. 11:21.520 --> 11:23.920 So here's the two different scenarios you might run across. 11:23.920 --> 11:28.460 You may see that on the left side there of my screen, I've got that corporate environment. 11:28.460 --> 11:31.560 Maybe they've got CASB solution involved. 11:31.560 --> 11:32.540 There's a firewall. 11:32.540 --> 11:35.640 It's a sanctioned cloud file storage solution there. 11:35.640 --> 11:51.380 On the right hand side there, we've got some that they may even still have that sanctioned cloud file storage solution like OneDrive, but then the end user may use their personal G drive or Dropbox account because they wanted to get the certain data on and off of that computer system. 11:51.380 --> 11:54.400 And USB drives are just not as popular these days. 11:54.400 --> 11:57.520 So you may see that that bypasses CASB solutions. 11:57.520 --> 12:02.480 A lot of the CASB solutions I've looked at are limited as far as they're not in line. 12:02.480 --> 12:19.940 And so there's certain instances where you may install or use these cloud file storage solutions, whether it's you install the agent or you go through the web browser and that expensive CASB solution that you've got as your one of your layers of security may not even see that data leave or come in and out of the network. 12:20.560 --> 12:24.060 Okay, so what kind of gems are we talking about here that we might be able to see? 12:24.200 --> 12:27.320 If we're again, I'm trying to phrase this as two different sides. 12:27.320 --> 12:31.340 You've got this workshop I think can go well for incident responders and forensic people. 12:31.340 --> 12:33.840 They can see what artifacts are left behind. 12:33.840 --> 12:49.880 But I also think that as offensive security, there's also something you can gain here and seeing that looking at this post exploitation, seeing what kind of data might be stored and what things you can extrapolate from these agents or artifacts left behind, 12:49.880 --> 12:54.060 you may be able to get a lot of interesting things during a pen test or red team engagement. 12:54.360 --> 12:57.720 So many organizations are now using these tools as a file server replacement. 12:57.720 --> 13:05.740 So you might find customer data, financials, employee data, whatever you'd see on a file share, you may see there. 13:05.740 --> 13:08.120 I mean, all kinds of confidential stuff. 13:08.680 --> 13:17.720 The apps, if they install the application, whether it's business sanctioned, or a personal install of the desired application, you might see cached files. 13:17.720 --> 13:28.700 So whether that file exists still in the file system, maybe they downloaded something and deleted it, that cached copy because it was opened up may still be there may be remnants there that you can now pull out. 13:28.700 --> 13:35.080 So someone downloaded customer data, they realized they shouldn't have it, they go ahead and delete it, that cache copy still there. 13:35.080 --> 13:38.900 And if you're on a pen test, you can just go grab that cache copy and recreate all the data. 13:38.940 --> 13:54.860 You might see local files, even for cloud files, most of the cloud file storage solutions we're going to look at, even though you don't see the you're not going to touch the cloud files, you know, maybe they've disconnected or they are not syncing anymore, 13:54.860 --> 14:01.400 we still can look at the databases and we can see all the files they have access to in the cloud, even if it's not on the local file system. 14:01.400 --> 14:04.980 So we might not be able to get those files, but now we know they're sitting there. 14:05.300 --> 14:13.560 We can get usage of different files, we can say, wow, they're really, you know, there's a lot of work going into this one file, this customer file, this might be something I want to look at. 14:13.560 --> 14:16.440 You may also get to be able to see traces of deleted files. 14:16.440 --> 14:25.900 So even if they do delete it and maybe we'll see it in the cache, maybe we won't, but even if they didn't open it up on the local file system, we may be able to get remnants of that file. 14:27.420 --> 14:33.020 So I would kind of went over this already, it's either going to be company issued or you might have a free account. 14:33.780 --> 14:46.860 Depending on which side you're on, again, defense or offense, if you're on the defense and you're trying to find some of this stuff from incident response perspective or forensics, you might look at this and say, well, if it's a free account, we don't get access to the logs. 14:46.860 --> 14:52.260 But if it's a business account, we might actually get access to some more advanced logging. 14:52.260 --> 14:56.280 But again, it's depending on where you sit, your background and how you're going to use this. 14:57.620 --> 15:01.680 With the business or enterprise accounts, you know, for Google, you've got G Suite. 15:01.680 --> 15:03.680 For Microsoft, you have Office 365. 15:03.680 --> 15:06.460 For Box, it's called Box for Business or Box Enterprise. 15:06.460 --> 15:09.080 And then Dropbox, they call it Dropbox Pro. 15:09.380 --> 15:13.960 On the free side, you can actually get some decent size storage there. 15:13.960 --> 15:16.660 For Google Drive, you can get free 15 gigs. 15:16.660 --> 15:21.280 Can you imagine the amount of stuff that people can exfiltrate from your environment with 15 gigs? 15:21.280 --> 15:24.680 With OneDrive Basic, you only get five gigs. 15:24.680 --> 15:26.860 Dropbox is the smallest, two gigs. 15:26.860 --> 15:30.060 And then Box Starter, it's 100 gigs. 15:30.060 --> 15:33.880 The reason I don't have Citrix share file on here is that it's only trial. 15:33.880 --> 15:35.040 There is no free version. 15:35.040 --> 15:36.760 It's an enterprise grade tool. 15:37.620 --> 15:41.200 It's behind a paywall or trial wall that you have to go and get that. 15:41.220 --> 15:50.900 So you can use it obviously for a while, but it's not something I'm generally going to see as an unauthorized or free version, just because it's on the enterprise side. 15:51.500 --> 15:54.700 Okay, so let's now dive into Microsoft OneDrive. 15:56.300 --> 15:57.760 So a little bit about it. 15:57.760 --> 16:00.600 It's baked into Windows 8 and plus. 16:00.600 --> 16:02.940 Windows 10, it's built into it. 16:02.940 --> 16:04.280 It's almost like a virus, right? 16:04.280 --> 16:05.220 It's there. 16:05.220 --> 16:12.920 However, it's sitting there, but a lot of the artifacts and directories, registry keys are not there until you actually authenticate. 16:12.920 --> 16:20.840 So once you authenticate, it then becomes enabled and directories such as the AppData, local Microsoft OneDrive directory is then created. 16:20.840 --> 16:26.800 So obviously, if that folder is not there, you can assume that they have not been using OneDrive on that system. 16:28.540 --> 16:33.520 There's a lot of differences between the personal and the paid version of OneDrive. 16:33.520 --> 16:41.320 So for example, the personal OneDrive log files, you're going to see them within AppData, local Microsoft OneDrive logs. 16:41.320 --> 16:44.860 And then if it's a personal account, you'll see personal directory. 16:44.860 --> 16:52.460 If it is a business Office 365 account, you're going to see business one is the first account that's synced. 16:52.540 --> 16:56.820 And if you sync more accounts, you'll see business two, business three, business four, and so on. 16:57.240 --> 17:04.720 Now, from my research, there's no logging on the web side of it for personal accounts. 17:04.720 --> 17:09.940 However, with business, you have Office 365 unified audit logs that provide a lot more information. 17:09.940 --> 17:12.400 And by default, those are set at 90 days. 17:12.440 --> 17:20.320 From an incident that my team is working on currently with a massive breach, I can tell you that 90 days is probably not long enough. 17:20.740 --> 17:24.100 So there is some stuff there, but it does get rolled over pretty quickly. 17:25.960 --> 17:26.260 Okay. 17:26.400 --> 17:33.780 And if you look at the logging capabilities, obviously on the right-hand side, you've got the business version there with the unified audit logs. 17:33.780 --> 17:45.540 But the personal version, you're probably, if you want to start looking at behavior or what's happened on that endpoint, you're going to have to look at more of the logs that are stored locally on the file system. 17:46.340 --> 17:56.200 Okay, so this grid here is really meant just to show the different locations and what those locations are, whether it's a file or a directory. 17:56.900 --> 18:03.220 For example, OneDrive, if you see a OneDrive directory, it's a personal, that's where all their personal files are stored. 18:03.220 --> 18:07.680 If you see OneDrive dash the company name, that's going to tell you two things. 18:07.680 --> 18:10.220 One, the company name, and they're using Office 365. 18:10.220 --> 18:14.960 So you know immediately there's more logging capability, probably up to 90 days somewhere on the cloud. 18:16.580 --> 18:23.040 Then there's other things like the root, or we've already talked about the root log directories and how it's either personal or business one. 18:23.280 --> 18:29.900 There's an interesting file called SyncDiagnostics.log, and that provides you with metadata for both local and cloud files. 18:29.900 --> 18:39.460 So even if they've decided not to sync, or they have yet to sync a file from the cloud, you get access to the name of that file in the SyncDiagnostics log, potentially, and we'll talk about that in a second. 18:40.180 --> 18:48.340 There's a .dat file, and so the way it's going to work is if whether it's a personal or business account, it's going to be their CID. 18:48.340 --> 18:52.700 So the customer ID number .dat, and so that's going to differ for every system you look at. 18:52.700 --> 19:01.340 So one thing there, you get their CID number, or CID string, and once you go into that, you're going to see a list of all the local and cloud files. 19:01.780 --> 19:18.660 If you look at the CID.ini file, you're going to see the file store locations, the last sync time, usage details of how they're using OneDrive, and if you look at the CID-profile-service-response.txt file, that's going to give you only for a personal account. 19:18.660 --> 19:29.460 For business accounts, it does not exist for my testing, but for personal accounts, it'll get you the name, email address, CID, email, I guess I have email twice there, phone number, title, department, that kind of stuff. 19:29.460 --> 19:37.440 I think it's interesting though, because what personal user, or if you sign up for OneDrive, it doesn't ask for that information, like your phone number or your business title. 19:37.780 --> 19:39.300 However, that's listed there. 19:39.300 --> 19:50.680 So I didn't even see a location when I went to OneDrive.com to go to my profile and actually add a title and department and stuff, which is most of the time why you're going to see those fields as null if you look at that text file. 19:51.080 --> 19:54.500 Then there's also an obfuscation string map text file. 19:55.160 --> 19:57.980 That one's a little bit interesting, and I'll kind of show you how that works a little bit later. 20:01.440 --> 20:06.720 I types of those sync diagnostic log files, and I haven't done extensive testing on this. 20:06.720 --> 20:09.560 However, I do have a theory based off my limited testing. 20:10.760 --> 20:17.260 So during my testing, I had Office 365 OneDrive, and I had... so it's a business version, right? 20:17.260 --> 20:23.820 And I didn't want to go buy 10 different versions to test this, but I got what I'm going to call the summary version of the sync diagnostics file. 20:23.820 --> 20:25.460 And I'll show you the two versions. 20:26.060 --> 20:35.880 Now, when I set up a free personal account, and I had two virtual machines in my lab environment, the first virtual machine got what I'm calling the detailed sync diagnostics file. 20:35.880 --> 20:37.300 It was much more verbose. 20:37.360 --> 20:47.560 Then I synced a second virtual machine to basically see how that would work, and I opened up the sync diagnostic file on the second VM, and I got what I'm calling the summary version. 20:47.800 --> 21:02.820 So my theory is that it's possibly the first machine you sync with OneDrive, it gets the detailed version, and everyone after that, like the secondary machines within the sync cluster, if you will, those get the detailed version. 21:03.260 --> 21:05.360 It's more of statistical data. 21:06.000 --> 21:08.160 So let's look at the two different versions. 21:08.320 --> 21:15.580 So with the detailed sync diagnostics log file, I can see things here like files and folders that are added. 21:15.580 --> 21:23.520 And the weird part, though, is you'll see mount point followed by what looks like a GWID, or a CID followed by some kind of unique character. 21:23.740 --> 21:33.980 And then it'll have a backslash, and then it'll have three words like far, jump, sue, sea, bat, egg, car, reg, tax, rat, tad, up. 21:33.980 --> 21:36.280 So there are three words grouped together. 21:36.680 --> 21:39.100 And when I first looked at that, I thought, what the heck is this? 21:39.100 --> 21:45.080 Obviously, there's some kind of pattern going on, you know, three different words in the capitalization, but where is this coming from? 21:45.080 --> 21:49.960 I don't have any files called far, jump, saw, or sue, or sea, bat, egg. 21:49.960 --> 21:52.560 That's not a folder that I added. 21:53.460 --> 21:56.920 I'll show you how that works in a second, but we'll come back to that. 21:56.920 --> 22:13.240 On the right hand side there, I've got the summary diagnostics file, which is the other version where you get more of stuff like this, where you get sync progress, you get the last sync time in Unix epoch, you get the number of files uploaded, downloaded, 22:13.240 --> 22:17.000 files, folders created, you get basically more of summary type data. 22:17.480 --> 22:31.180 Now, going back to that detailed version, what I eventually figured out is that those names, those three word names like sea, bat, egg, or far, jump, sue, those things map back to the obfuscation string map. 22:31.180 --> 22:43.620 So I don't really have a knowledge of why Microsoft did this, but I do find it interesting that if you go to the sync diagnostics, you're not going to see the actual file names, you're seeing those obfuscated strings. 22:43.700 --> 22:47.860 It's not terribly difficult to de-obfuscate them, it's just time consuming. 22:47.860 --> 22:57.540 And I'm sure someone's written a parser for this, but you have to open up that string obfuscation map text file, and there you can then map back those files. 22:57.540 --> 23:01.920 And we can see on the left side, I have sea, bat, egg, which is equivalent to my desktop. 23:01.920 --> 23:06.240 So basically, the sync diagnostics folder is saying that my desktop was synced. 23:06.240 --> 23:08.240 That folder was added to the sync. 23:09.860 --> 23:19.180 Okay, and here's just, again, another example, a little bit bigger, where you could see that those different names, like joke, yak, log, equates to my C directory. 23:19.340 --> 23:26.160 Or coy, you, quill, that's going to be myly, which is probably my user's directory. 23:27.620 --> 23:31.360 Okay, the CID.dat file, it's a little hard to read. 23:31.580 --> 23:34.880 If you open it up in the editor, you will kind of see the file names. 23:34.880 --> 23:37.800 However, searching, I wasn't able to do this. 23:37.800 --> 23:45.300 And I do think it's because, obviously, those dots that are between each character, and I'm pretty sure there's a way to search more human readable. 23:45.300 --> 23:51.440 But when I search for travel, or itinerary, or PDF, it was not found because of those dots. 23:51.680 --> 24:01.060 So you can parse through that manually, but a better version is probably, or a better way to do that is probably using something like strings, or B strings. 24:01.060 --> 24:06.560 So here I use strings against that CID.dat file on the personal version. 24:06.560 --> 24:12.740 And I was able to extract things there that are human readable, like documents, personal, vault, pictures, camera roll. 24:12.840 --> 24:21.780 Those other things up there, as far as like E94, 23, blah, blah, blah, explanation point, explanation point 104, I don't know what those are. 24:21.780 --> 24:24.680 And they come back to haunt us in the business version as well. 24:24.820 --> 24:29.300 I'm not sure if those are like the CID, and then some inode ID. 24:29.300 --> 24:31.720 I'm still doing some research into that piece. 24:32.460 --> 24:37.120 Now on the business version, though, if we look at the CID.dat file, it's not as easy. 24:37.460 --> 24:42.160 We don't see as clear things, even if we pull it out in strings. 24:42.160 --> 24:47.320 However, when I started looking through this, I saw what looked again like quids, or maybe hashes there. 24:47.680 --> 24:51.220 And so I'm thinking more along the lines of their MD5 hashes. 24:51.220 --> 24:57.260 But when I tried to search that in the string obfuscation text file, it doesn't pull things up properly. 24:57.260 --> 25:02.600 We can see that that hash or that string is mapped somewhere, but it doesn't really tell us what it is. 25:02.600 --> 25:06.280 It says something like 23-paged CT equals one. 25:06.280 --> 25:08.560 I don't really know what that maps back to. 25:08.560 --> 25:15.480 So on the business versions, we didn't really get a full list of files and folders that were added. 25:16.720 --> 25:29.460 With the CID.ini, we could see things there like the location or the URL for their OneDrive or their Google Drive, sorry, not Google Drive, their OneDrive or their share file, I'm sorry, share sync. 25:29.880 --> 25:37.020 And then with the last refresh time, it's in Unix Epoch, we can see the last time they actually synced if they've got the up-to-date versions. 25:37.180 --> 25:43.500 You could see even there, I've got all the different libraries that are shared with me, and we could see even the amount of bytes transferred. 25:44.440 --> 25:56.480 Now that CID.dash profile service response, that one will give us, as I mentioned, only for the personal version of Office 365, I'm sorry, personal version of OneDrive, you've got things like the display names. 25:56.480 --> 25:58.660 We could see Michael Wiley or Mike Wiley there. 25:58.660 --> 26:01.180 We could see the ID or the CID of my user. 26:01.180 --> 26:04.160 We can see the email address that I have registered there. 26:04.160 --> 26:06.600 So it was a Gmail account. 26:06.600 --> 26:11.360 We could see a business phone number, which again, I don't know why is there, and every time I've looked is null. 26:11.560 --> 26:15.940 Same thing with job title, mobile phone, office location, that kind of stuff. 26:17.260 --> 26:19.440 I did try and compare the registry keys. 26:19.440 --> 26:30.100 So in my lab environment, I went ahead and installed or activated OneDrive for business, and I recorded all the different registry keys that I saw. 26:30.340 --> 26:35.620 Then I did that for the personal version, which is that middle column there, to see which registry keys were added. 26:35.620 --> 26:37.500 You can see there's a lot less. 26:37.840 --> 26:45.720 And then I tried to do essentially a merge of those and see which were common, so that way we can identify which registry keys were not common. 26:45.720 --> 26:51.560 And so the only two keys in the personal version that are different are isUpgradeAvailable and VaultShortcutPath. 26:51.560 --> 26:57.140 Otherwise, everything in the personal registry keys, they're also going to be for the business keys. 26:58.100 --> 27:06.880 Hey, one interesting registry key that we can find is that if we do a reg query or we use in the lab environment, I'm going to give you a dump of the registry. 27:06.880 --> 27:22.200 So you can't obviously do a live query like I'm doing here on the screen, but with the business version of OneDrive or Office 365, what happens is if you go into HKeyCurrentUser, Software, Sync Engines, Providers, OneDrive. 27:22.200 --> 27:28.660 When we go into there, you're going to see potentially multiple different keys there. 27:28.660 --> 27:34.260 And what looks like a bunch of random characters like B736EE blah, blah, blah, plus one. 27:34.260 --> 27:39.460 And then you see C4F29 blah, and so on and so forth. 27:39.460 --> 27:48.240 So those are actually what I think is the CID for users that have shared folders with the user you're looking at. 27:48.240 --> 27:55.560 So you can go in here again, depending on your perspective, if it's offensive or defensive, but you can now see that they have access to other users files. 27:55.960 --> 28:02.420 Or if you're doing incident response or forensics, you can see that they might have data that's mapped there that doesn't belong to them. 28:02.880 --> 28:18.060 Now, if you do another reg query below that on one of those CIDs, so the B7 blah, blah, blah, if you go ahead and do a reg query on that string, what's going to happen is you're going to see more keys under there, and you're going to see the actual name, 28:18.060 --> 28:20.720 what they're calling the mount point of what's shared to them. 28:20.720 --> 28:27.960 So now I can see there's a projects documents directory that they don't own, but someone shared with them and they added to their OneDrive. 28:27.960 --> 28:30.840 And then obviously, you can also see the URL namespace. 28:30.840 --> 28:32.900 So you can actually see the URL to get that. 28:32.900 --> 28:37.720 So if you are on their machine, you could possibly pop in that URL into their browser. 28:37.720 --> 28:40.380 And if it's cached, you might be able to actually get that as well. 28:41.100 --> 28:49.200 One thing to note with these tests, though, if someone shares something with the user, it doesn't automatically mean you're going to see it when you do the reg query. 28:49.200 --> 28:54.700 They do have to press add to your OneDrive in order for that to now show up in the registry. 28:54.840 --> 29:06.660 So once they press add on the web browser version of OneDrive, if they click add this shared folder, for in this case, I did test on a personal account, when you do the reg query, you're going to be able to see that there. 29:06.660 --> 29:15.660 And so the difference between the business version here and the personal version of OneDrive is that with the personal version, there is no CID of the user that shared it. 29:15.660 --> 29:19.020 Instead, you're just going to see the name of the shared folder. 29:19.420 --> 29:25.500 If you dive into that a little deeper with another reg query, we can actually see the CID of the user that shared it with them. 29:25.500 --> 29:38.120 Possibly if you've compromised multiple machines with an organization, you can look at that the CID, or if you're on the defensive side, you can take a look at that and say, well, I know Bob or Betty or Joe or whoever shared this with that person. 29:40.100 --> 29:52.940 One other thing just to know about a lot of these tools, I'm just going to focus here on OneDrive for a second, is that with Microsoft OneDrive space saver, it basically allows you to not sync everything. 29:52.940 --> 29:56.860 And I remember back in the day, Dropbox was the first cloud file storage solution that I used. 29:57.200 --> 30:01.520 And when I would sync that, I had multiple directories and subdirectories. 30:01.520 --> 30:08.100 The challenge I had was that I couldn't get enough space off of my machine. 30:08.100 --> 30:14.200 I had terabytes of data, and I would try and say, don't sync this folder, but I really wanted a subfolder within that. 30:14.200 --> 30:22.740 So it was challenging to tell Dropbox which folders to sync, which folders not to sync, get what I wanted, and also not fill up my hard drive. 30:23.380 --> 30:27.960 So Microsoft OneDrive, their solution to that is called space saver. 30:27.960 --> 30:30.560 And what that'll do is that it doesn't download everything. 30:30.560 --> 30:39.980 It'll essentially get you a cached copy of the file name, and you'll see there that it's got a little cloud that's empty, and it basically means that it's cloud only. 30:40.000 --> 30:46.960 However, you can double click on that file, and it will then be cached locally, which will have a green check mark. 30:47.060 --> 30:48.960 Now, that'll eventually go away. 30:48.960 --> 31:02.100 I don't have documentation on how long it stays cached locally, but if you want it to stay always locally so you could access it when you're on an airplane or train or you don't have internet access, you could right click and say always keep on this device. 31:04.080 --> 31:07.660 So now what we're going to do is we're going to dive into the OneDrive lab. 31:07.660 --> 31:13.340 I do have a scenario for you that I don't think I properly put into the slides here. 31:13.400 --> 31:27.280 So what I'm going to have you do is go to the GitHub repo, make sure you've got, again, those four tools that you're going to use, the database browser, Notepad++, so on, so forth, and I want those two tools installed. 31:27.280 --> 31:35.980 And then I want you to go ahead and extract the evidence-desktop-q50 blah blah blah dot zip file, which has all the artifacts for the lab. 31:36.980 --> 31:47.460 And then I want you to start just looking at those files and seeing that it looks like basically a C drive, but it's only a couple megs in size. 31:48.020 --> 31:57.440 What I'm going to do while you get that going, and if there's any questions, obviously post them there on YouTube in the comments, and those will be relayed to me so I can answer those questions. 31:57.500 --> 32:02.960 I'm going to go ahead and get the scenario built up. 32:02.960 --> 32:07.320 I'm going to put that on the screen so you have the scenario in front of you so you could see what we're doing. 32:07.740 --> 32:16.940 Obviously, there could be many different scenarios, but I tried to make this fake scenario up, do it in the lab, and then I collected those artifacts for you to kind of dig into. 32:16.940 --> 32:24.560 So what you're going to want to do is open up, and I'm going to do here on my screen, there's three Word docs that are lab files. 32:25.640 --> 32:34.240 And the first one we're going to do here is OneDrive, so it should be examining cloud file storage incidents dash lab dash OneDrive. 32:34.420 --> 32:36.980 So I'm going to make this bigger on my screen for you. 32:38.560 --> 32:49.920 Expand that, zoom in, and this tells you here to navigate to the CID dash profile services, and there's a question you're going to answer. 32:49.920 --> 32:53.760 So you basically have to answer, what's Bob's Microsoft OneDrive CID? 32:53.760 --> 32:58.500 There's another question here, examine this file, get the user principal name. 32:58.500 --> 33:01.860 So these are questions that you're going to go ahead and answer and walk you through. 33:01.860 --> 33:13.020 Now, I will tell you, if you're stuck, or you've never done this before, and you need some help, what I have is all the way at the bottom, if you keep scrolling down, there should be a detailed walkthrough. 33:13.060 --> 33:17.020 So it'll give you the question again, exactly as you saw it before. 33:17.040 --> 33:21.620 And it'll give you then, or the steps, the question, and then it'll also give you the answer. 33:21.620 --> 33:25.660 And a lot of times here at the answer, what I also do is I give a screenshot. 33:25.660 --> 33:36.600 So if you want to walk through this, and you've got less experience, and you're saying, it's all too new to me, well, then just kind of walk through this, and you should be able to see the same exact things on your system. 33:36.660 --> 33:39.680 So I'm going to go silent for a little while on mute here. 33:39.680 --> 33:42.240 So you have a little bit of time to walk through these labs. 33:42.600 --> 33:51.920 When you're done, if you could start commenting and let us know on YouTube, that way I can get an idea of when the first 10 or 15 people are done, and we can kind of move on from there. 33:52.360 --> 33:56.060 So as I mentioned, go ahead and open this lab file, get started on that. 33:56.060 --> 34:00.900 I'm going to put on my screen in just a second here, the scenario, and I'll start talking about that scenario. 34:00.900 --> 34:02.960 Apologize, I didn't have that teed up for you. 34:07.580 --> 34:13.920 Hey, Michael, a quick question in the chat around cloud file storage security. 34:14.480 --> 34:22.520 Do you have any recommendation for, you know, scanning files for any malicious links or malicious files themselves? 34:22.920 --> 34:25.760 Any tools, something along those lines? 34:26.440 --> 34:35.120 Yeah, so a lot of the tools or the different solutions nowadays, they have AV built in. 34:35.120 --> 34:38.780 I don't know a lot of details about what they are. 34:38.780 --> 34:42.300 I can tell you that they are getting really good. 34:42.800 --> 34:48.500 I haven't done a full test where I've gotten, let's say like 1500 malware samples, uploaded them all to see what happens. 34:48.500 --> 35:00.580 But I can tell you from experience, both Google Drive as well as OneDrive has eaten up my malware samples that I have placed there for different lab environments. 35:00.620 --> 35:15.140 Even when I have encrypted and password protected zip files with malware built into them, both Google Drive and OneDrive have opened them up and used the password infected to look inside of them. 35:15.140 --> 35:17.120 I was kind of blown away the first time I saw it. 35:17.240 --> 35:19.060 And they're constantly improving it. 35:19.060 --> 35:20.840 They don't provide a lot of detail to that. 35:20.840 --> 35:24.740 So I used to keep a lot of my malware in like Google Drive. 35:24.860 --> 35:32.060 And even more so, I now sometimes have PCAP files, so network traffic that I have collected. 35:32.280 --> 35:34.420 And well, an incident happened. 35:34.420 --> 35:37.220 So let's say a user downloads a copy of WannaCry. 35:37.240 --> 35:39.480 I captured that network traffic. 35:39.660 --> 35:41.840 Within that PCAP, there's a lot of stuff. 35:41.840 --> 35:44.980 There's ping, there's all kinds of stuff in there. 35:45.100 --> 35:47.540 But there is an object, right? 35:47.540 --> 35:49.020 So they downloaded that file. 35:49.020 --> 35:56.160 And if it's over a clear text protocol, all those bits and bytes and everything are sitting in there. 35:56.380 --> 35:59.760 Nowadays, OneDrive will actually flag that. 35:59.760 --> 36:06.860 My PowerPoint slides for my incident response workshop for Wireshark, I can no longer share my PowerPoints. 36:06.860 --> 36:09.700 And it won't even let me download it to my computer. 36:09.700 --> 36:20.780 I actually have to go to OneDrive, confirm that I realized that they have found a virus within a PCAP file, and then confirm that I guarantee I'm serious, I do want to download that, and it'll let me download it. 36:20.780 --> 36:23.780 But they will not let it sync, and they will not let me share it. 36:23.780 --> 36:37.440 So a lot of the tools, I can't speak on all of them and what their engines are like, but I can tell you they're getting pretty good at finding stuff, even opening zip files with, I'm guessing they're using common passwords, like infected, you know, password. 36:37.480 --> 36:40.940 And they're trying to open up your zip files and scan those as well. 36:41.180 --> 36:46.660 If you do want a little bit more security on top of that, and you want to know what's going on, CASB solutions will do that. 36:46.860 --> 36:49.040 I don't use CASB a lot. 36:49.040 --> 36:52.260 However, I have used things like managed methods, we're a partner with them. 36:52.260 --> 36:59.360 And I went through some of their documentation, and I saw that they have a back end relationship with one of the AV vendors. 36:59.500 --> 37:02.440 And by adding CASB on top, it's scanning that. 37:02.860 --> 37:07.920 I would say if you're looking for other things too, Microsoft is building more and more built in. 37:07.920 --> 37:12.860 So they've got their kind of CASB solution built into Office 365. 37:13.220 --> 37:17.580 But if you want a third party, that's where it's going to help you scan for stuff. 37:17.580 --> 37:23.380 So again, I'm going to go back to the tool I know, not saying they're the best, but I just know managed methods. 37:23.380 --> 37:35.100 I build out a lot of regex queries for things like social security numbers, for things that look like or password, username, stuff like that. 37:35.100 --> 37:40.600 So it's doing antivirus scanning on top of what already Office 365 is doing. 37:40.600 --> 37:50.460 And then it's also letting me do custom queries for things like PCI, HIPAA, and just stuff that shouldn't be stored in OneDrive, like usernames and passwords and stuff like that. 37:53.370 --> 38:03.810 Yeah, I, you know, within my limited experience, I have similar experiences, the cloud vendors are getting really good at defending their own environment. 38:03.810 --> 38:04.550 It makes sense, right? 38:04.550 --> 38:11.350 I mean, they don't want to be hosting and especially if they have that shared cloud responsibility model, they've got a lot of that on their side. 38:11.350 --> 38:18.790 And they don't want you having things that are doing evil, or someone says, Oh, I got it from a Google Drive link or something like that. 38:18.790 --> 38:26.650 So they have got, I'm sure some pressure to make sure that they're keeping their customer safe and not spreading malware either. 38:27.110 --> 38:31.430 But, you know, when they did open my zip file, I was shocked because it had a password. 38:31.710 --> 38:37.570 When they started scanning my PCAPs and identifying malware in those, I was even more shocked, but good for them. 38:38.430 --> 38:42.930 This was the case, I don't know why this isn't in my slides, I must have missed this. 38:42.930 --> 38:51.010 But basically, this is the scenario that they built out for this workshop when it was the first time I did it was a four or five hour workshop. 38:51.250 --> 38:59.270 So you're working the case of the Mike Wiley LLC case, this is going to be more of a defensive incident response forensics type of case. 38:59.270 --> 39:01.990 But again, these concepts can be used for both sides. 39:02.570 --> 39:05.810 So you've got Bob McLee, who is a senior manager of operations. 39:06.270 --> 39:12.010 The Mike Wiley LLC firm is a boutique real estate investment firm in Los Angeles. 39:12.190 --> 39:18.810 Bob is a senior manager who abruptly left the firm on 4-17-2020 in the morning. 39:19.190 --> 39:24.790 Days prior to Bob leaving, he stepped down from all committee positions, so all board positions he was on. 39:24.930 --> 39:33.990 On Friday afternoon, Bob updated his LinkedIn profile to co-owner of a competing real estate investment firm called REMAX also. 39:34.630 --> 39:39.030 Within hours of Bob's departure, key clients gave contract cancellation notices. 39:39.030 --> 39:45.250 The Mike Wiley LLC management believes that Bob may have violated his non-compete and non-solicit clause. 39:45.290 --> 39:55.570 The Mike Wiley LLC hires a forensic incident response consulting firm to get evidence of any violations of non-solicit, so you're part of that consulting firm. 39:55.570 --> 40:05.210 The company did not have an approved cloud file storage solution, and some users would share files using personal accounts for business reasons. 40:05.590 --> 40:14.050 According to HR, Bob's personal email address is bob.maclee.re at gmail.com. 40:14.050 --> 40:21.850 So you've got that basic information about the incident, and as you work through that, you could start seeing what kind of files. 40:21.850 --> 40:26.590 Is there anything putting on your defender's hat, your incident response or forensics hat? 40:26.590 --> 40:32.210 Was there anything that that user looked at, touched, synced, that kind of thing? 40:32.210 --> 40:39.850 And so I'm guiding you through in the lab, going across that, trying to see what are some of those things that you can uncover using some of this. 40:39.850 --> 40:46.950 And so what I did, just for a little background, is I had the web browser opened up with all four platforms. 40:46.950 --> 40:53.090 I had OneDrive, Google Drive, Box, Dropbox, actually in Citrix, I had five platforms. 40:53.390 --> 40:56.530 Then I also had two virtual machines. 40:56.530 --> 41:03.950 I had a primary one, which is the information that you have, which I extracted out as the incident responder. 41:03.950 --> 41:07.370 I then also had a second VM that you don't have access to. 41:07.410 --> 41:08.810 So there's three different possibilities. 41:08.810 --> 41:15.890 There could be stuff on the web, there could be stuff on the VM you have, or a third-party VM, which is probably their personal home machine. 41:15.990 --> 41:21.110 So there's possibly three different cases where files could be added, removed, deleted, that kind of stuff. 41:21.110 --> 41:29.450 And so as we walk through, you could answer all the questions within OneDrive, but what I try to do is have you answer certain questions with OneDrive. 41:29.470 --> 41:34.190 Then later on, we're going to go to Dropbox, and you're going to answer some questions through that. 41:34.190 --> 41:36.970 And then we're going to go to Google Drive, and you'll answer more questions. 41:36.970 --> 41:45.570 So you could answer all of these questions and get all this information from one solution, but every time I added a file, I added it to all five different solutions. 41:45.990 --> 41:47.590 Citrix, Box, Dropbox. 41:47.590 --> 41:57.010 And so I wanted those same actions to happen across the board, but I wanted you to answer them, again, using the different tools and know where to find them with the different solutions. 41:57.010 --> 42:00.990 So hopefully that makes a little more sense of what we're doing and why we're doing it. 42:02.030 --> 42:09.250 And again, if you missed it, we are looking at the OneDrive lab file where we've got the walkthroughs. 42:10.510 --> 42:13.510 Any comments or questions on YouTube? 42:13.510 --> 42:14.390 Anyone stuck? 42:14.390 --> 42:15.690 Anyone done? 42:17.590 --> 42:30.070 I do have a question, which is not related to the lab, but your opinion on adoption of CASB in relation to layered protection for cloud assets? 42:31.670 --> 42:33.170 Good question. 42:34.750 --> 42:36.610 I think it's got its purpose. 42:36.610 --> 42:40.050 I think there's different use cases. 42:40.050 --> 42:45.210 So let me go into one where I think it's definitely useful, and then I'll go into another one where it's not. 42:45.210 --> 42:54.610 So we work with, as I mentioned, a lot of studios and post-production houses that receive the raw footage of the movies that are in the theater. 42:54.610 --> 43:13.850 And the challenge that we have is with a lot of studios, they've got what's... they're very concerned about the data getting leaked, especially after you look at Larson Studio was compromised by a hacker or hacking group, and the contents of Orange is the New Black was held for ransom. 43:14.330 --> 43:17.190 I think it was like $97,000 or $60,000. 43:17.190 --> 43:18.710 I can't remember the exact amount. 43:18.990 --> 43:25.390 And then basically signed a contract and give us this money in Bitcoin, and we won't release it to Pirate Bay. 43:25.390 --> 43:27.010 They ended up releasing it anyways. 43:27.650 --> 43:36.410 So the studios have gotten very strict on that, and they've got a 96-page document called the MPA Content Security Best Practices, and it's got everything. 43:36.410 --> 43:39.810 I mean, you should have a security guard walking around 24-7. 43:39.890 --> 43:43.030 How do you handle their keys? 43:43.030 --> 43:45.330 You have to have an inventory of every master key. 43:45.390 --> 43:52.850 When you're editing any content, it should be in a locked room with unique keys to get in, like a combo lock. 43:52.950 --> 43:59.350 And that logging on that lock has to be for 12 months, and you have to have a CCTV camera at your employees. 43:59.370 --> 44:02.130 And when your employees enter and exit the room, you have to search them. 44:02.130 --> 44:04.270 They can't have personal items in the room. 44:04.270 --> 44:06.070 If they do, it has to be a clear bag. 44:06.070 --> 44:09.570 It just goes on and on that most people can't really do that. 44:10.170 --> 44:21.490 So one thing, though, is that the point of that is that the studios are very strict about, you have to take our content, such care of our content, and how you work on our content while it's in your environment, Mr. 44:21.490 --> 44:23.810 Post-Production House or VFX House. 44:24.550 --> 44:33.410 Now, a lot of times, though, and I won't name which studios, but a lot of studios will still send the raw content of Batman or whatever it is. 44:33.410 --> 44:41.370 I just used Batman as an example, but they'll send the link for that to download the raw footage of this blockbuster movie. 44:41.490 --> 44:46.330 And they'll send that via email with the URL and username and password to download that. 44:46.330 --> 44:52.950 Sometimes they'll also send it over FTP, not the password, but they'll send the actual content over FTP. 44:53.190 --> 45:09.350 So I kind of feel like that's saying to the studio, to the vendor sometimes, it's like, hey, we're going to give you a gun, but you need to be so careful with it, you need to take a safety class, you need to buy a lock, you need to have a safe, you need to be in a room that's got bulletproof walls and all this stuff. 45:09.430 --> 45:13.730 But here you go, and they give you an unloaded gun without the safety on. 45:13.870 --> 45:29.950 And so in those situations, we've recommended, even though it's not part of the MPA best practices for our vendors, to basically, for their protection, is if you get handed a loaded gun, a CASB solution may be able to identify those links that come in, 45:29.950 --> 45:32.650 and then track everything about it. 45:32.650 --> 45:36.450 And it'll basically see if the... it'll almost alert. 45:36.450 --> 45:46.430 So when those links come in and possibly username and password from the studio, in an insecure matter, it is then tracked and logged and any type of action around that email is then alerted. 45:46.430 --> 45:55.350 Because we can't control the studio is going to hand a loaded gun to our clients, but we can control then how we're monitoring, logging, and preventing that from going out. 45:55.350 --> 45:58.090 So the CASB solution lets us keep track of that. 45:58.090 --> 46:03.030 And if it's ever forwarded to a personal account or anyone outside the company, we get alerted to that. 46:03.030 --> 46:07.070 Some CASB solutions will actually allow you to break links. 46:07.070 --> 46:12.290 So if someone puts a file up in Dropbox, or they try and share it , it'll break that link. 46:12.330 --> 46:22.610 So in those cases of detecting and sometimes preventing, but mostly detecting data leaving or being shared or forward and stuff like that, we absolutely recommended that to the client. 46:22.890 --> 46:31.430 Now, other cases, we have a CPA firm that's one of our clients, and they didn't really have a need for that. 46:31.430 --> 46:36.470 We got CASB involved originally, but we found out really, they just didn't want anyone to share anything outside the company. 46:36.470 --> 46:37.790 There was no use case for that. 46:37.790 --> 46:39.470 So we just disabled sharing. 46:39.470 --> 46:41.930 And in that case, we didn't really need CASB. 46:41.930 --> 46:45.810 So you kind of have to look at what functions you're worried about. 46:45.810 --> 46:47.130 Do you want the antivirus scanning? 46:47.130 --> 46:49.890 Do you want the regex queries? 46:49.890 --> 46:53.130 Do you want to be able to be alerted on certain events? 46:53.130 --> 46:56.250 I think a lot of it, you can actually do now with OneDrive. 46:56.250 --> 47:00.190 If you integrate that with a tool like Sumo Logic, you could do a lot of alerting on that. 47:00.190 --> 47:03.630 But again, every use case is different and depending on what you're storing there. 47:03.630 --> 47:08.030 So it's a long winded answer, but there's a lot of depends, but there's some really useful features. 47:08.030 --> 47:11.670 In other cases, a lot of businesses, I say, no, it's not right for you. 47:13.970 --> 47:14.830 Got it. 47:14.830 --> 47:22.570 And then another question, is there any form of encryption adopted by OneDrive that minimizes the risk of disclosure? 47:22.570 --> 47:26.910 I'm making reference to access the local files in plain file. 47:27.090 --> 47:27.890 Got it. 47:27.890 --> 47:30.170 So not that I'm aware of. 47:30.170 --> 47:32.590 No, I think they're obviously in transit. 47:32.770 --> 47:37.890 OneDrive, Google Drive, all that stuff is traversing over SSL TLS. 47:37.890 --> 47:40.990 And so it's essentially encrypted in transit. 47:40.990 --> 47:44.990 And then I'm assuming it's encrypted also when it's sitting there in the cloud. 47:45.430 --> 47:48.130 But on the local file system, no. 47:48.130 --> 47:51.110 I mean, once it's sitting there, it's sitting there. 47:52.690 --> 48:01.190 Couple caveats though, is that a lot of those caching or those shell files, where it's only the file name, but it's not actually downloaded. 48:01.610 --> 48:03.270 I've had issues with that. 48:03.270 --> 48:14.770 And I could see where that could almost benefit you from security standpoint, is that if you try and copy all the files in OneDrive onto a thumb drive or something else, it has to download each one and then move it over. 48:14.770 --> 48:19.950 And if it doesn't have connectivity or you're signed out or anything like that, it will error out. 48:19.950 --> 48:21.630 It won't actually copy those files over. 48:21.630 --> 48:24.670 It's really just a shell or a shortcut that points to that file. 48:24.670 --> 48:29.610 So not really encryption, but that's, I mean, that's one security measure. 48:29.610 --> 48:33.170 I guess it wasn't meant as a security measure, but it helps you out. 48:34.070 --> 48:42.490 And then every solution we're going to look at today, all of them, all this local stuff, like the caches, the logs, everything is in clear text. 48:42.490 --> 48:46.310 So you have access to all the databases from all these tools. 48:46.390 --> 48:57.870 OneDrive doesn't use databases, it uses the registry, but Google Drive, Box, Dropbox, Citrix ShareFile, they all use SQLite databases, and all of them are in clear text. 48:57.870 --> 49:01.570 So you don't even need a password, you just open them up and you get access to all this stuff. 49:02.210 --> 49:09.190 With the caveat of Dropbox, and Dropbox is the only one that actually encrypts their databases and some other stuff at rest. 49:09.190 --> 49:17.970 So the files are not, but at least the database and the metadata, you won't be able to get into that unless you do some further exploits. 49:20.190 --> 49:24.810 Okay, so let me do a quick walkthrough on this, and then we'll move on to the next piece. 49:24.810 --> 49:32.310 So the first one, it says to go ahead and navigate over to the cid-profileserviceresponse.txt file and open it with Notepad++. 49:32.990 --> 49:42.150 So some of this, I might have an issue with my walkthrough because my VM that I normally use for this, I haven't touched it in a while, and I forgot the password. 49:42.150 --> 49:46.450 So I had to like last night, all of a sudden move all these artifacts over and try and get it reset up. 49:46.450 --> 49:48.170 So if it's a little bumpy, I apologize. 49:48.870 --> 50:01.130 So you've got, if you extract that zip file that I've got with the evidence, basically, you're going to see a folder structure of C, essentially, if you were on the file system, you'd click on the C drive. 50:01.350 --> 50:06.490 And then you're not going to see everything, but you're going to see the things that I extracted with CAPE within 10 seconds. 50:06.490 --> 50:17.550 So an incident happened, you know, Bob McLee called us in, or not Bob McLee, but the Mike Wiley LLC about Bob McLee, and said, we think there's an issue, please, you know, figure out what happened. 50:17.550 --> 50:28.770 So what I did is I grabbed CAPE, a tool, and I basically then, I've got a custom CAPE target that extracts all stuff related to cloud storage solutions. 50:28.790 --> 50:31.950 I said, collect it from this hard drive, the C drive. 50:31.950 --> 50:35.790 And within 10 seconds, it created the zip file for me, or for us. 50:35.790 --> 50:41.250 And it gives us all relevant information to these Google, or not Google Drive, but these cloud file storage solutions. 50:41.350 --> 50:47.470 So we're going to go over to users, Bob, for Bob McLee, we're going to go to app data, local, Microsoft. 50:47.490 --> 50:50.310 And so you can see, this is most of the data we're going to look at today. 50:50.310 --> 50:58.730 But we're going from Microsoft, there was no business account. 50:58.730 --> 51:01.790 So this was not a paid subscription, this is a personal account. 51:01.790 --> 51:11.170 So immediately, we notate that for our incident, we go into personal, and then we should see that CID dash profile service response. 51:11.170 --> 51:14.430 So what's Bob's Microsoft OneDrive CID? 51:14.430 --> 51:15.990 Well, it's right here. 51:16.670 --> 51:20.930 Okay, so we've copied that we now know that CID in case we see it elsewhere. 51:21.190 --> 51:26.890 The next question asks us, examine this file and look for the principal name. 51:26.890 --> 51:28.750 So we want to double click on this. 51:29.530 --> 51:32.130 And we just make this larger for you. 51:33.350 --> 51:38.030 Word wrap, edit, and format. 51:41.610 --> 51:48.150 Okay, and so we could see here, obviously, that they're using OneDrive principal name, Bob McLee, so we have the right computer. 51:49.050 --> 51:52.870 We could see their CID again, right here, we see their email address. 51:52.870 --> 51:57.450 So it was bob.mcleegmail, this matches what HR told us is their personal email address. 51:57.450 --> 52:01.250 And then we don't see a phone number, job title, as in most cases, we won't. 52:01.730 --> 52:08.690 Okay, the next question is, what is the device ID of the system you're investigating, right? 52:08.690 --> 52:17.210 So we want to see, we didn't do the acquisition, all we did was given the zip file, and we want to know, well, which system is this in case we have to go to court. 52:17.970 --> 52:23.610 Okay, so I want to go ahead and go over to OneDrive logs, and then personal. 52:23.650 --> 52:28.670 So I'm going to close this, and go back to OneDrive, logs, personal. 52:29.330 --> 52:34.370 And then within here, I'm going to go ahead and look for the sync diagnostics file. 52:34.430 --> 52:35.690 So I got this one. 52:35.790 --> 52:37.650 Let me see if I have notepad++. 52:37.650 --> 52:38.170 Perfect. 52:39.910 --> 52:41.430 This is going to be a little easier. 52:46.320 --> 52:50.880 Okay, and so within here, we can see the question was, what's the device ID? 53:01.090 --> 53:02.730 So my device ID. 53:02.950 --> 53:06.170 So we see we copy that, and that's got a unique device ID. 53:09.380 --> 53:11.140 Get on my zoom here. 53:15.030 --> 53:19.410 Okay, and then the next question is, how many files folders are synced? 53:19.410 --> 53:22.890 So we can just look through here for files. 53:22.890 --> 53:24.710 13 files were synced. 53:24.710 --> 53:28.090 Let's see if I can just make this view a little better for you. 53:28.890 --> 53:30.310 Zoom in. 53:33.670 --> 53:34.490 There we go. 53:34.490 --> 53:35.630 That's much better. 53:36.070 --> 53:44.030 Okay, so files, there's 13 folders, there's three, so we can see that they're not really a big user, but there might be some interesting files and folders we want to look at. 53:44.030 --> 53:47.150 But essentially, there's 13 files that we're looking for. 53:49.800 --> 54:01.920 Okay, and then we want to look for... next step is to navigate over to personal, and we want to open up the obfuscation string map. 54:01.920 --> 54:04.580 So I'm going to close this or just minimize that. 54:05.100 --> 54:06.300 Go back here. 54:07.440 --> 54:10.480 Obfuscation string map, we'll open that up as well. 54:10.480 --> 54:18.560 And so now we can see, even if we don't know everything, we can start getting on the right hand side here, I can see different files and folders. 54:18.560 --> 54:23.000 So I see that C drive, users, Bob, metadata, app data. 54:23.840 --> 54:27.020 Scroll down, we can look for anything that's interesting here. 54:27.140 --> 54:30.900 Okay, we've got Bob again, desktop, users. 54:33.320 --> 54:38.520 Okay, keep scrolling down, we could see email address, I see there's some type of possibly PowerPoint, some mail. 54:42.740 --> 54:45.160 Okay, client. 54:45.560 --> 54:48.000 So there might be a client's folder we're looking for. 54:48.000 --> 54:53.620 But you could just start parsing through this and start seeing different possible file names or things that are interesting. 54:53.620 --> 54:59.900 Imagine if you see like password, or, you know, here's some messages or messaging possibly. 55:00.620 --> 55:02.200 You know, you can just parse through that. 55:02.200 --> 55:07.880 At the very, at the very least, even if you don't go into other things, you can start looking for interesting file names and folders there. 55:08.840 --> 55:21.060 Okay, but then it says we are looking for, we found something that was 123, me, you, they, who, what, where, and so we want to match that up. 55:21.060 --> 55:24.900 So I can just search here and see my searching. 55:26.460 --> 55:32.040 It's hard using a Mac and then a Windows VM, the control keys are not matching up. 55:32.040 --> 55:32.920 There we go. 55:32.920 --> 55:35.340 Okay, so 123. 55:39.050 --> 55:39.530 And 55:43.490 --> 55:46.410 of course, it's not working. 55:46.410 --> 55:47.450 Let me see. 55:53.580 --> 55:55.380 Go to the top again. 55:59.130 --> 56:00.890 Oh, I see. 56:01.470 --> 56:03.170 I was giving you a sample. 56:03.170 --> 56:05.710 I was wondering why the heck is the 123 not there. 56:05.710 --> 56:12.030 But really, we were trying to figure out what the C drive slash user slash Bob was going to equate to. 56:12.030 --> 56:14.050 And so I give the example which didn't exist. 56:14.050 --> 56:21.850 But essentially, what I'm looking for here is, if I'm trying to find my logs, I'm gonna open up a new tab. 56:29.700 --> 56:33.120 Okay, so if I'm looking for the C drive, it would look something like this. 56:34.100 --> 56:35.640 And then users. 56:35.800 --> 56:39.120 So I look down here for users, it's gonna be this one. 56:42.320 --> 56:45.500 Okay, and then Bob, go back here. 56:46.340 --> 56:47.760 It's gonna be this. 56:49.980 --> 56:50.780 Copy. 56:51.940 --> 57:02.740 Basically, so if we're looking in log files, we're looking for something like this, if we want to see things that were placed in C users, Bob's directory, right, this is essentially the path we're gonna be looking for in the log files. 57:04.360 --> 57:12.440 Okay, then the next step here is that we are going to navigate over to the CID.dat file. 57:19.600 --> 57:20.880 Okay, personal. 57:21.720 --> 57:26.140 And then this is our CID.dat file, I recommend opening up with a hex editor. 57:27.620 --> 57:30.020 This one's probably expired. 57:30.020 --> 57:36.640 I'm just going to use a different tool than you have here because I haven't installed HXD on this one. 57:36.660 --> 57:40.500 But if we look through here on the right hand side, this should be the ASCII. 57:40.540 --> 57:45.400 If I scroll down, we can look for things like, did I tell you exactly what to look for? 57:45.600 --> 57:46.800 Personal vault. 57:48.040 --> 57:51.060 So we start looking for that, I'm just gonna scroll slower. 57:56.620 --> 58:00.440 Okay, there it is, I see personal vault right here. 58:01.400 --> 58:08.420 Okay, and then we're looking for, look at the question again, we're scrolling down looking for the next folder name that we see. 58:08.420 --> 58:17.930 So I'm going to keep scrolling slower, scroll, scroll, scroll, nothing there. 58:18.170 --> 58:21.770 You can see why I might want to use strings here, because this is just a little bit messy. 58:25.960 --> 58:29.720 Okay, and now I see something else here, another folder called operations. 58:31.040 --> 58:32.840 Right, so there's another folder called operations. 58:32.840 --> 58:33.900 And you can keep parsing this. 58:33.900 --> 58:39.640 But again, if you use strings, I didn't want to give too many tools, but strings is going to make it a lot easier to parse that out. 58:44.460 --> 58:51.540 Okay, the next thing I have here is we're going to open up the CID.ini file. 58:51.540 --> 58:57.400 So I'll go back over here, CID.ini, I'll open it in notepad++. 58:58.380 --> 59:04.240 And we're going to go ahead and look for the local file path where things are stored. 59:04.740 --> 59:08.920 So I'm looking for the library, if I scroll over to the right here, whoops. 59:10.840 --> 59:14.160 We can see this is where things are stored for Bob. 59:14.160 --> 59:20.080 So anything that's synced with OneDrive, it's going to be stored in this location there, C users Bob OneDrive, which is what we'd expect. 59:20.080 --> 59:21.140 That's the default. 59:22.500 --> 59:25.580 Okay, now we want to run Registry Explorer. 59:25.600 --> 59:30.600 And we are going to load the registry hive. 59:30.600 --> 59:35.220 So I am going to go, hopefully, I remember where I put it. 59:35.340 --> 59:37.340 I think I put it in my downloads. 59:42.490 --> 59:43.950 Another tab here. 59:46.770 --> 59:47.570 Downloads. 59:50.030 --> 59:50.870 I did. 59:50.870 --> 59:56.350 Okay, so my installer software, just like you do, and I want to open up Registry Explorer. 59:59.130 --> 01:00:01.950 And you might get an error when you open this up. 01:00:01.950 --> 01:00:03.250 We'll see if I get it. 01:00:21.490 --> 01:00:24.170 Nope, I must have changed the settings. 01:00:24.170 --> 01:00:32.730 But if you do get an error about Windows protecting your PC, you just click on more, and then you run anyways, to try and bypass that. 01:00:33.450 --> 01:00:36.370 Okay, so the next step is that we want to load a registry hive. 01:00:36.370 --> 01:00:39.790 So I'm going to click on file, load hive. 01:00:41.930 --> 01:00:45.190 Once that's loaded, I'm going to go to our evidence. 01:00:45.230 --> 01:00:48.770 So I have extracted my evidence, I believe, in my downloads folder. 01:00:48.850 --> 01:00:50.470 And then I have my evidence here. 01:00:51.330 --> 01:00:53.530 Click on that, click on the C drive. 01:00:53.530 --> 01:00:57.070 Within the C drive, under the users, we go to Bob. 01:00:57.110 --> 01:00:59.770 And within Bob, we should see NTUser.dat. 01:00:59.770 --> 01:01:04.350 When I click on NTUser.dat, it's going to open up the registry hive. 01:01:04.350 --> 01:01:09.790 But if you don't know how the registry works, it's generally going to be dirty. 01:01:09.790 --> 01:01:12.650 Things are going to be in these log files until you reboot. 01:01:12.650 --> 01:01:15.870 That's why a lot of times when you make registry changes, they say reboot afterwards. 01:01:16.110 --> 01:01:19.550 So these log files are the transaction logs that are not written yet. 01:01:19.550 --> 01:01:20.990 And we want those to be written. 01:01:20.990 --> 01:01:25.830 So when we open this, we're going to get an error probably that says, hey, it's a dirty hive. 01:01:25.990 --> 01:01:28.070 If we get that, we should. 01:01:28.070 --> 01:01:29.350 We're going to click yes. 01:01:29.770 --> 01:01:37.270 And then it's going to say that we have to pick essentially which transaction logs we want to replay. 01:01:37.350 --> 01:01:38.790 So I'm going to click OK. 01:01:39.310 --> 01:01:43.510 I'm going to select both the .log1 and .log2 file. 01:01:43.610 --> 01:01:47.750 I want both of these transaction logs to be replayed to the registry hive. 01:01:47.810 --> 01:01:48.950 So I click open. 01:01:50.530 --> 01:01:51.370 Click OK. 01:01:54.290 --> 01:01:54.590 OK. 01:01:54.590 --> 01:01:56.890 And it's going to say, where do you want this to be saved to? 01:01:57.990 --> 01:02:00.010 I'm just going to throw it back in my evidence folder. 01:02:00.010 --> 01:02:01.510 So I'm going to go back to downloads. 01:02:04.290 --> 01:02:06.370 C drive, users, Bob. 01:02:06.390 --> 01:02:07.550 And I'll just dump it right here. 01:02:07.550 --> 01:02:08.670 It doesn't really matter where. 01:02:09.410 --> 01:02:11.790 And it says, great, it's been updated. 01:02:12.570 --> 01:02:14.030 And the sequence numbers match. 01:02:14.030 --> 01:02:14.910 So that's a good thing. 01:02:14.910 --> 01:02:17.470 Do you want us to load the updated hive? 01:02:17.510 --> 01:02:18.190 Absolutely. 01:02:18.190 --> 01:02:18.970 Thank you. 01:02:19.050 --> 01:02:19.710 Yes. 01:02:19.710 --> 01:02:21.510 And it says, do you want to load the dirty hive? 01:02:21.510 --> 01:02:21.750 No. 01:02:21.750 --> 01:02:23.030 Why would I want the dirty one? 01:02:23.030 --> 01:02:24.430 So bye-bye. 01:02:25.190 --> 01:02:25.790 OK. 01:02:26.090 --> 01:02:27.750 And now we're able to parse this out. 01:02:27.750 --> 01:02:34.810 So now that we've loaded this up, what we want to do is I want you to go to software, Microsoft, OneDrive, accounts, and then personal. 01:02:34.890 --> 01:02:36.490 So I'm going to expand this. 01:02:37.330 --> 01:02:38.830 This is going to be a problem. 01:02:38.870 --> 01:02:47.150 Every time I have this in my VM, for some reason within the VM, it gets all messed up with the font here. 01:02:47.150 --> 01:02:48.830 Let me see if there's an easier way. 01:02:48.830 --> 01:02:49.970 Or I'll probably have to zoom in. 01:02:49.970 --> 01:02:51.050 So give me a second. 01:02:51.970 --> 01:02:54.310 And if I don't go blind before then. 01:02:56.450 --> 01:02:57.250 Microsoft. 01:03:05.250 --> 01:03:07.190 So hard to see this. 01:03:07.950 --> 01:03:08.910 OneDrive. 01:03:13.020 --> 01:03:14.600 And accounts. 01:03:17.250 --> 01:03:18.210 Personal. 01:03:22.610 --> 01:03:23.110 OK. 01:03:23.170 --> 01:03:24.810 Now let's see if I can... 01:03:29.210 --> 01:03:30.390 There we go. 01:03:31.930 --> 01:03:33.490 So I know it's small. 01:03:33.490 --> 01:03:36.070 For some reason, it gets all messed up in here. 01:03:36.070 --> 01:03:38.910 But let's see if I can go even a little bigger for you. 01:03:40.410 --> 01:03:41.010 OK. 01:03:41.010 --> 01:03:43.890 So I basically just browse to the registry location. 01:03:44.230 --> 01:03:46.810 And then... one second. 01:03:46.810 --> 01:03:50.490 Let me scroll down on the instructions so I make sure I give you the right steps. 01:03:51.270 --> 01:03:51.610 OK. 01:03:51.610 --> 01:03:57.710 And so some of the things that you want to answer here are... oh, no. 01:03:59.630 --> 01:04:00.250 Hang on. 01:04:00.250 --> 01:04:00.730 Sorry. 01:04:00.730 --> 01:04:02.030 Let's go back. 01:04:02.030 --> 01:04:03.190 Increase this. 01:04:05.350 --> 01:04:10.070 Well, I may not show a bunch of these demos with the registry if this is going to happen every time. 01:04:10.070 --> 01:04:13.310 But we can see the user email in here. 01:04:13.850 --> 01:04:19.050 So we see that it's bob.mclee.re.gmail.com. 01:04:19.110 --> 01:04:20.710 We can look at the CID. 01:04:20.710 --> 01:04:22.870 So we can see the CID of the user down here. 01:04:22.870 --> 01:04:28.790 We can see the default file store, which is C, Users, Bob, OneDrive. 01:04:28.790 --> 01:04:30.730 We can see the last sign-in time. 01:04:30.990 --> 01:04:32.110 Where is it? 01:04:32.590 --> 01:04:37.310 Last sign-in time, 15.87.12.89.85. 01:04:37.310 --> 01:04:42.890 We do need to convert this from Unix Epoch time to standard time. 01:04:42.890 --> 01:04:49.310 So you can do that by just copying and pasting this in Google or looking for a Unix Epoch converter. 01:04:49.310 --> 01:04:52.050 And you can just sort that out and it'll give you the exact time. 01:04:52.050 --> 01:04:57.390 But almost everything we're going to look at today, almost everything, is in Unix Epoch time. 01:04:57.750 --> 01:05:00.010 We can see the first time that the device was synced. 01:05:00.010 --> 01:05:08.050 So if we go to client first sign-in time down here, this tells me when they first started syncing with OneDrive. 01:05:08.050 --> 01:05:11.030 So we can get a lot of useful information just by analyzing that. 01:05:12.230 --> 01:05:13.950 Hopefully, there's no more registry things. 01:05:13.950 --> 01:05:16.730 Let me see if there's anything else because that's going to be a pain to do. 01:05:18.550 --> 01:05:21.770 Okay, and then we can also look at... there's one more that I'll just show you. 01:05:21.770 --> 01:05:29.070 The registry piece here is that, aside from personal, what other directories are shared or synced with this user that they don't own? 01:05:29.750 --> 01:05:33.130 I'm going to get to it first and then I'll zoom in here for you. 01:05:33.370 --> 01:05:39.830 Actually, let's see if I can tell the slide here. 01:05:39.830 --> 01:05:43.490 So we want to go to Software, Sync Engines, Providers. 01:05:43.490 --> 01:05:44.850 Okay, 01:05:48.620 --> 01:05:57.560 Software, Sync Engines, Providers, OneDrive. 01:05:58.020 --> 01:06:03.320 And so just looking here under this OneDrive directory, we can see that Finance, Operations, and Personal. 01:06:03.320 --> 01:06:04.980 So I said what else besides personal? 01:06:04.980 --> 01:06:09.960 So there's a Finance and Operations directory that were shared with this user. 01:06:09.960 --> 01:06:11.140 So they don't own that. 01:06:11.140 --> 01:06:13.120 However, they have access to it. 01:06:13.120 --> 01:06:16.200 And therefore, we may be able to get access to those files as well. 01:06:20.540 --> 01:06:24.300 And I think that wraps up that lab. 01:06:24.300 --> 01:06:25.560 There's one more question. 01:06:25.680 --> 01:06:33.180 Clicking into the personal, another shared folder keys, registry hives, what data value do you see in the CIDs? 01:06:33.180 --> 01:06:35.100 So I will show you that one again. 01:06:36.820 --> 01:06:41.440 So if I do click on, let's say personal, because we know personal belongs to this user. 01:06:42.040 --> 01:06:53.160 If I go up here, try and get this down, we can see the CID of the user that owns personal here starts with 87 and ends in B0, Bravo 0. 01:06:53.240 --> 01:07:01.280 Now, if I go click on operations, let's go back up here and see that the CID is different. 01:07:01.560 --> 01:07:06.460 So that CID, basically, this is a folder that is owned by someone else. 01:07:07.120 --> 01:07:07.920 Cool. 01:07:07.960 --> 01:07:10.060 That wraps up the walkthrough for that lab. 01:07:10.060 --> 01:07:11.640 So let's move on now to Google Drive. 01:07:11.640 --> 01:07:13.620 Google Drive behaves a little bit differently. 01:07:13.620 --> 01:07:18.620 Microsoft obviously is baked in, so they have the ability to use a lot of the registry as if it was a database. 01:07:19.180 --> 01:07:22.660 I guess it kind of is a database, but they have access to that, right? 01:07:22.660 --> 01:07:25.600 Where some of these other solutions have to build this to make it portable. 01:07:26.540 --> 01:07:33.660 So with Google Drive, you've got... I keep calling it Google Drive, but the personal version is really called Backup and Sync. 01:07:34.100 --> 01:07:35.940 But I'm just going to keep calling it Google Drive. 01:07:35.940 --> 01:07:37.180 I'm old school like that. 01:07:37.220 --> 01:07:40.880 If you're talking about the business version, it's called Drive File Stream. 01:07:40.880 --> 01:07:42.880 It's part of the G Suite offerings. 01:07:43.600 --> 01:07:49.920 They're backed by SQLite databases rather than just text files and registry keys like we saw with OneDrive. 01:07:50.480 --> 01:07:54.760 So the Drive File Stream, it creates... it's a little bit different. 01:07:54.760 --> 01:08:00.280 It's similar to Citrix share file in that it creates a virtual FAT32 volume and mounts it. 01:08:00.280 --> 01:08:07.000 So you're going to actually have like a G Drive sitting there that looks like a mounted file or file system. 01:08:07.800 --> 01:08:09.920 Sync to Google formatted files will create a shell. 01:08:09.920 --> 01:08:15.580 So what's interesting is that even if they're syncing, you don't actually get the Google file locally. 01:08:15.580 --> 01:08:23.780 So if you create a Google Sheets or a Google document within Google Drive web browser, it syncs. 01:08:23.780 --> 01:08:26.220 It's supposed to be syncing locally to your file system. 01:08:26.220 --> 01:08:37.800 What happens is that it creates a shell file and that shell file will have, if you open it up in a text editor or a hex editor, you'll see the URL, the document ID, and the email address of that user. 01:08:37.800 --> 01:08:38.660 So it's kind of interesting. 01:08:38.660 --> 01:08:41.220 It's not the actual file, it just redirects you to that. 01:08:42.040 --> 01:08:52.860 Some interesting locations and databases and files that you may find when you are examining the system is that you've got the sync underscore config DB file. 01:08:53.280 --> 01:08:58.460 It'll give you the user's info like their preferences, initial application sync time, and stuff like that. 01:08:58.460 --> 01:09:06.720 The cloud underscore graph database will give you metadata for both local, cloud, and shared files and folders with that user. 01:09:07.300 --> 01:09:16.500 The sync underscore log dot log file will give you added, deleted, modified, renamed files for that user. 01:09:17.100 --> 01:09:23.220 The snapshot dot DB database will give you local file metadata, so things that are just locally. 01:09:23.360 --> 01:09:29.620 And if the user is using G Suite, the content underscore cache will give you local file caches. 01:09:29.620 --> 01:09:38.840 I think this also worked partially with Google Drive personal version, but there was slight differences there. 01:09:39.080 --> 01:09:42.140 Also, we'll see the metadata underscore SQLite DB. 01:09:42.320 --> 01:09:47.620 That will give offline files, cloud files, deleted files, and other metadata. 01:09:48.100 --> 01:10:02.960 So if we dive a little deeper and look at the sync config database, which is located inside of AppData local Google Drive, it's got a bunch of different tables, but the one of interest is the data table. 01:10:02.980 --> 01:10:11.120 And within the data table, we're going to see the highest application version, so we can see what version they're using, see if there's any known vulnerabilities or exploits. 01:10:11.300 --> 01:10:19.100 With the local sync route path, you get the path of the local file source or where those are sitting locally on their file system. 01:10:19.520 --> 01:10:22.180 We'll also get the user's Gmail account. 01:10:22.440 --> 01:10:24.460 So here's a screenshot of what that'll look like. 01:10:24.460 --> 01:10:31.460 We pivot over into the data table, and that's where we can see those different rows with interesting information. 01:10:31.460 --> 01:10:42.120 The Cloud Graph database, the main table that we're interested in is the Cloud Graph entry table. 01:10:42.120 --> 01:10:52.760 And that's going to give us stuff like every document in their Google Drive with the unique ID, the file name or folder of the object that's synced. 01:10:53.060 --> 01:10:59.860 The last time it was modified in Unix Epoch, I did not test on what triggers that modify time. 01:10:59.860 --> 01:11:08.560 So I do want to just warn you if you're an incident responder or forensics, you may want to do some testing to verify that is it a file open? 01:11:08.560 --> 01:11:10.460 Is it a edit? 01:11:10.460 --> 01:11:11.400 Is it a sync? 01:11:11.400 --> 01:11:13.020 What will trigger that modify time? 01:11:13.020 --> 01:11:14.800 I didn't go that far into detail. 01:11:15.060 --> 01:11:24.000 The ACL role will tell you whether or not the owner, so the person you're looking at on their system, if they own the file or if it's shared with them. 01:11:24.280 --> 01:11:33.620 We also, what's interesting is with Google Drive is that you'll see a doc type column, and the doc type column will give you what format the file is. 01:11:33.620 --> 01:11:36.020 And so it's a little bit limited, but it's interesting. 01:11:36.020 --> 01:11:42.180 If you see a zero, it means that the object you're looking at is a folder or a directory or equivalent to a directory. 01:11:42.880 --> 01:11:50.480 If you see a one, you'll see that it's a traditional file, like a Word doc, a PDF, something like that, a zip file. 01:11:50.660 --> 01:11:57.820 If you see two through 13, those are reserved for Google Files, but they go a little bit more detail since they own those files, obviously. 01:11:57.820 --> 01:12:00.500 If it's three, it's a Google formatted presentation. 01:12:00.500 --> 01:12:03.080 Sorry, a two is a Google formatted presentation. 01:12:03.320 --> 01:12:05.660 A four is a Google formatted spreadsheet. 01:12:06.320 --> 01:12:09.120 A six is a Google formatted document. 01:12:09.500 --> 01:12:13.320 Now, there's a removed column, and I couldn't get that to trigger. 01:12:13.320 --> 01:12:17.640 So when I deleted things, I moved to the trash, nothing really changed there. 01:12:17.980 --> 01:12:21.060 So I'm not sure what that's reserved for or why Google has that. 01:12:21.180 --> 01:12:24.180 We also get something that's really interesting is the file hash. 01:12:24.180 --> 01:12:33.040 So we get the file hash of the object, whether it's a Google spreadsheet, or it's a PDF, we're going to get the MD5 hash of that object. 01:12:33.900 --> 01:12:42.160 If we open it up in the database and DB browser for SQLite, we're going to be able to see things there, like I just talked about. 01:12:42.160 --> 01:12:46.600 Now, that doc ID is unique across Google Drive. 01:12:46.660 --> 01:12:51.880 And so you're going to be able to identify that if you didn't have the hash, you could find that in other databases as well. 01:12:51.880 --> 01:12:56.260 But we can even see there the different file names of all those files that are in the Google Drive. 01:12:58.600 --> 01:13:05.840 The sync underscore log dot log file, this one was a little bit hard to read, and we'll take a look at it. 01:13:05.840 --> 01:13:16.220 But it's, in my opinion, a little better if you use some type of parsing tool like bash, maybe use grep or awk, or you have a sim, you could even do a free tier of Sumo logic to parse this out. 01:13:16.600 --> 01:13:19.480 There are tons of different actions that are interesting. 01:13:19.480 --> 01:13:22.040 Everything is started with action dot. 01:13:22.040 --> 01:13:29.460 So you could do action dot wildcard, or if there's specific actions you were trying to narrow down to see, you know, is this user using Google Drive? 01:13:29.460 --> 01:13:31.100 Are they deleting files? 01:13:31.100 --> 01:13:31.720 What's going on? 01:13:31.720 --> 01:13:36.860 Whatever action you're interested in, you can parse for those, you can grep them, you can search for them, etc. 01:13:38.320 --> 01:13:41.840 And then not only that, but you can also see the direction that things happen. 01:13:41.840 --> 01:13:44.940 So was the action to delete, was that local? 01:13:44.940 --> 01:13:46.800 Or did they delete it within the cloud? 01:13:47.320 --> 01:13:48.860 Did they add a new file? 01:13:48.860 --> 01:13:50.840 Was that added on the local file system? 01:13:50.840 --> 01:13:54.160 Or did they add it by going to drive.google.com? 01:13:54.160 --> 01:14:00.980 So looking in that log file, you can actually look at the direction dot, it'll tell you if it was initiated within the cloud or locally. 01:14:01.160 --> 01:14:04.280 You also see shared equals and then true or false. 01:14:04.280 --> 01:14:07.060 And that tells you if it's if they're sharing enabled or not. 01:14:07.060 --> 01:14:13.920 And then another way that I found useful for parsing for file names is I grep for name equals you. 01:14:14.220 --> 01:14:17.620 And then you'll look, you'll be able to find all the different file names. 01:14:17.620 --> 01:14:23.680 And you could even then grep for certain things like pass or password, or username, whatever your use case is there. 01:14:23.980 --> 01:14:32.340 So just by for an example, I uploaded that file to Sumo Logic, and I did a log reduce so that you could see, it gives me a count. 01:14:32.340 --> 01:14:35.240 So I'm able to start to see, well, how many files were downloaded. 01:14:35.580 --> 01:14:44.420 And we could see there that 22 log files, or I guess entries in the log file match that telling me that there was a download action. 01:14:44.420 --> 01:14:47.940 So something happened from the cloud, and then it was synced locally. 01:14:49.480 --> 01:14:55.420 If we look at that snapshot.db database, that'll give us similar things we saw before. 01:14:55.420 --> 01:15:01.000 But the added value that we see here is that whether or not the file is shared with other users. 01:15:01.000 --> 01:15:04.320 And that's gonna be one of the new fields that we'll see here are the columns. 01:15:06.340 --> 01:15:16.600 Something that you may have to look at for both snapshot.db and cloud underscore graph.db is that in the cloud relations table, you'll be able to map out where things are located. 01:15:16.600 --> 01:15:21.140 So the database doesn't give you a clear understanding of where things are positioned. 01:15:21.140 --> 01:15:23.260 Do we have files and folders? 01:15:23.260 --> 01:15:26.440 Or do we have... what are those folders called? 01:15:26.440 --> 01:15:31.300 So you might have to look in both those databases in the cloud relations table. 01:15:31.300 --> 01:15:35.900 And within the cloud relations table, that gives you almost a key of where things are stored. 01:15:35.900 --> 01:15:40.080 And they're going to use those doc IDs and the parent doc IDs. 01:15:40.080 --> 01:15:48.960 And so you could see that on the right-hand side there, the one that starts with 1NGR blah, blah, blah, that's in the root. 01:15:48.960 --> 01:15:50.840 But then there's multiple files there. 01:15:50.840 --> 01:15:56.440 The row 2, 3, 4, 5, those are files that are sitting within that root folder. 01:15:57.820 --> 01:16:11.020 So this is essentially how you kind of map that back is if you're looking at, let's say, the cloud entry table, and you want to know, well, I see there's an object called finance, and I see a bunch of other files, but which files are sitting in the finance directory? 01:16:11.200 --> 01:16:17.000 Well, you would open up that cloud relations table, and then you could map those out and see, oh, okay, I get it. 01:16:17.000 --> 01:16:18.460 It's sitting in this directory. 01:16:20.260 --> 01:16:23.420 Okay, so this brings us up to a lab. 01:16:23.840 --> 01:16:30.460 I think what I'm going to go ahead and do is dive into some of the other ones since we've got about 40 minutes left. 01:16:30.460 --> 01:16:36.320 So I'm going to keep going with the slides, and then at the very end, I'll kind of hang around, and we can walk through some of those labs together. 01:16:36.940 --> 01:16:39.580 So as I mentioned, Dropbox is a bit different there. 01:16:39.840 --> 01:16:46.520 Dropbox uses encrypted SQLite databases, SQLite encrypted extension, SAE, since 2011. 01:16:46.520 --> 01:16:52.400 So very early on, they've been encrypting those SQLite databases, so we don't have as much visibility into them. 01:16:53.080 --> 01:16:58.820 Now, the bright side, though, is that the key for the encrypted database is stored in the registry. 01:16:58.820 --> 01:17:03.560 However, it's encrypted with Windows Data Protection API, or DPAPI, as I'll call it. 01:17:04.260 --> 01:17:11.860 You can either brute force the key, but good luck with that, or you can extract the DPAPI keys from memory. 01:17:12.000 --> 01:17:13.660 I was not able to do this. 01:17:13.660 --> 01:17:15.420 I tried this in the lab a couple of times. 01:17:15.420 --> 01:17:16.060 It didn't work. 01:17:16.060 --> 01:17:22.220 However, Francisco has a toolkit called DEC WinDBx Toolkit. 01:17:22.600 --> 01:17:28.600 I'll try and get you... hopefully, I've got the GitHub link on the next slide or two, but there's a toolkit. 01:17:28.600 --> 01:17:34.620 There's both Python, PowerShell, and executables that will pull that from memory. 01:17:34.760 --> 01:17:38.320 The version of Windows 10 I had in my lab environment, it would not work. 01:17:38.320 --> 01:17:43.320 So I don't know if that's because it was a lab environment, if it was the version of Windows. 01:17:43.320 --> 01:17:44.660 I didn't get it to work. 01:17:44.660 --> 01:17:51.260 However, there's plenty of talks out there that talk a little bit more about this. 01:17:51.260 --> 01:18:00.580 So you can go ahead and Google Dropbox DPAPI keys, and there's some great talks to talk about this and how they did their research. 01:18:00.960 --> 01:18:09.640 The one thing we will be able to see, though, even though the databases are encrypted, is that we'll see the .dropbox.cache, and that contains miscellaneous temporary cache files. 01:18:09.640 --> 01:18:17.040 So sometimes, even if there's files that are deleted by other users, we'll be able to see those deleted files within that cache location. 01:18:18.100 --> 01:18:35.060 Also, with a lot of these different Dropbox, is that when you delete files within the cloud, what happens is that if you're even on the web interface or on another system, when you delete that file, it syncs that delete. 01:18:35.060 --> 01:18:52.260 But unlike the cloud versions or the web interfaces where there's that temporary trash location that may be purged automatically between 30 or 120 days, when you delete that on the local file system, what generally happens is that file goes into the trash can. 01:18:52.520 --> 01:18:59.380 So often, if you go into the trash can on the local file, you'll end up finding things that were deleted from the cloud, and those do not get deleted automatically. 01:18:59.440 --> 01:19:05.960 It's going to take the user running CCleaner or right-clicking on their trash can or recycle bin and emptying those. 01:19:07.880 --> 01:19:14.660 So the other piece here, and this is the talk that I got some of this information from, was Nicholas and Florian. 01:19:14.660 --> 01:19:19.280 They did a talk called A Critical Analysis of Dropbox Software Security. 01:19:19.300 --> 01:19:29.360 It was at hack.lu in 2012, and they posted about it in their blog, and they talk about where these keys are located and how they extracted this out. 01:19:29.360 --> 01:19:32.180 But these are the file locations where those keys are stored. 01:19:33.560 --> 01:19:42.000 Okay, and I did post here, if you want to check out the dbx decryption toolkit, it did not work for me, but if you get it working, let me know. 01:19:42.000 --> 01:19:44.560 LinkedIn, Twitter, I'd love to hear how you got it working. 01:19:44.960 --> 01:19:52.840 So they have that toolkit located there, and you've got PS1 files, you've got Python files that essentially will extract that out. 01:19:54.640 --> 01:20:06.540 Okay, and then I just list out here a bunch of different directories and paths, but most of these we don't get a lot of information from because the .dbx and the .db databases, they are encrypted. 01:20:06.540 --> 01:20:14.060 So even the ones like home.db, where it looks like it might not be encrypted, I could not get any useful information out of those locations. 01:20:15.740 --> 01:20:17.260 Okay, with Box. 01:20:17.260 --> 01:20:19.820 So Box is very similar to Google Drive. 01:20:20.020 --> 01:20:27.880 We have a bunch of different files and locations, and then log files, as well as database files. 01:20:28.140 --> 01:20:42.000 The other cool thing, probably my favorite location within Box, is that there's the appdata local box cache directory, and that stores complete files that were opened both locally and are possibly even cached. 01:20:42.000 --> 01:20:49.540 So we will be able to see not the file name, but we'll actually be able to recover files, whether or not they've been deleted from Box. 01:20:51.140 --> 01:21:05.500 Okay, we also have some log files, which give us detailed activity of both the file activity, but then there's also a Box UI log file that tells us when the user logged in, what kind of network connection they had, if they lost internet connectivity. 01:21:05.500 --> 01:21:09.620 I mean, it's almost like stalking the user with the UI application. 01:21:09.620 --> 01:21:11.940 So there's a lot of detailed information there. 01:21:12.500 --> 01:21:24.620 We also have the boxstream.log, and that's going to give activity around metadata, paths, log locations, log files, free space on the file system, all kinds of juicy information there. 01:21:25.500 --> 01:21:31.900 And then we also have the syncrootfolder.txt, it just tells you where the default file store is located. 01:21:32.000 --> 01:21:40.320 And then there's a couple databases that will give you local files, cloud files, cached files, usernames, passwords, or not passwords, email addresses, and that kind of stuff. 01:21:41.160 --> 01:21:56.300 So if we looked at the boxstream.log, there's keywords that you might want to parse out with grep or awk, things like add file, add folder, on delete file, on delete folder, open, so you can get those different activities, and it'll tell you which files. 01:21:56.300 --> 01:22:04.100 So there on the screen, we can see a file was added, the date and time, the file was called the Mike Wiley 2020 strategic plan.rtf. 01:22:06.980 --> 01:22:14.620 Then also, we could see other things here about, you know, where things are cached, where the database is located, mount points, stuff like that. 01:22:15.660 --> 01:22:18.500 So as I mentioned, my favorite one is that cache directory. 01:22:18.500 --> 01:22:25.680 If you look at the cache directory, you'll see either what's a grid or a hash for the file, but it's not the actual file name. 01:22:25.700 --> 01:22:34.700 The cool thing, though, is that if you open up any of those files in a hex editor, you can look at the magic byte or magic bit in the beginning, and we can see it's an rtf file. 01:22:34.700 --> 01:22:43.640 So then we could just rename that file to example.rtf, and then we can open it up in a respective software application. 01:22:44.640 --> 01:22:47.980 The box UI, this is just a sample of what you might see. 01:22:47.980 --> 01:22:56.960 You could see when the user logged out, when they logged back in, hard drive space, network connectivity, all kinds of stuff built in there. 01:22:58.220 --> 01:23:12.140 And then within that box dash, and then the date, or version number, sorry, we're going to see those different files like test.txt, content created at, you know, different times, again, obviously, in Unix epoch time. 01:23:13.940 --> 01:23:28.640 Okay, and then we'll see the different box databases with interesting things, very similar to Dropbox, but this time we get SHA hashes, we can see when things were created, they were updated, again, take that with a grain of salt, I don't know which actions trigger those updated, 01:23:28.640 --> 01:23:34.080 if it's local, if it's cloud, if it's a combination, so you just don't want to rely on those dates unless you're sure. 01:23:35.240 --> 01:23:53.880 So here again, you can see those different, the local IDs, native item type, whether or not it's a file or folder, we can see the parent item ID, so we can map out what's sitting in what location, file names, inode ID, that inode ID is going to become important later for mapping things out to file names. 01:23:55.500 --> 01:24:13.760 Streams fs.db, there we get things like the file name of the item that's in that cache, so we could actually now, if we open streams fs.db, we can find out all those random file names that were sitting in that cache location, we can actually see the true file name to see if that's relevant or not. 01:24:16.220 --> 01:24:28.500 Okay, and then if we want to map that out, so if we want to see here, we've got the, that, that streams fs.db, and we go in the cache file table, we don't see the file name, but we do get to see that inode ID. 01:24:28.500 --> 01:24:32.480 So we're going to have to take that inode ID, open up the syncdb database. 01:24:32.560 --> 01:24:44.080 And from there, we can map the inode ID and we can see, oh, okay, so this A1, B4, blah, blah, blah, glitter hash, that is the business plan document that we want to recreate. 01:24:45.560 --> 01:24:56.040 And if we open that up again, in a hex editor, or even a text pad, or notepad, we can see that the, we've got the magic byte of PK, which tells us it's a .x. 01:24:56.040 --> 01:24:59.280 So we can now rename that file business plan. 01:24:59.500 --> 01:25:02.300 .x, and we can then open it up in Microsoft Word. 01:25:02.440 --> 01:25:12.420 So I went ahead and did that, I renamed the file, give it the proper file extension, opened it up this time in WordPad, and we can actually see that business plan for startup business. 01:25:12.740 --> 01:25:16.820 And that file had been deleted from, from Box. 01:25:16.820 --> 01:25:20.120 So it was no longer sitting in Box, but the cache was still sitting there. 01:25:22.220 --> 01:25:26.020 Okay, just map out some more of those things and what those locations are for. 01:25:26.800 --> 01:25:36.480 So again, I'm going to keep going, and then we'll come back to the lab afterwards, rather than one by one, because I do want to make sure in the next 25 minutes or so that we do hit the rest of the content here. 01:25:36.480 --> 01:25:38.680 And I've got about 20-ish slides left. 01:25:40.080 --> 01:25:44.200 So with Citrix ShareFile, very similar to Google Drive and Box. 01:25:44.560 --> 01:25:52.680 The interesting thing about this is that the application, to download it, you had to go through that paywall, or at least a trial registration for businesses only. 01:25:52.680 --> 01:25:57.220 However, I was able to use a Gmail account and they let me just get in, but there's no free version. 01:25:57.780 --> 01:26:05.520 Similar to Google File Stream, once you install ShareFile, it creates a virtual volume in FAT32. 01:26:05.820 --> 01:26:07.460 It mounts as the S drive. 01:26:07.900 --> 01:26:10.700 All their databases are unencrypted in SQLite format. 01:26:11.220 --> 01:26:17.980 So they have a list of all the remote files and folders in the remote DB. 01:26:18.700 --> 01:26:26.480 If you want to see all the files that, and I like how they break it out, if you want to look at all local files that are sitting there in the file system, it's localitem.db. 01:26:26.480 --> 01:26:30.140 So you've got two different databases, whether it's local, or they're sitting in the cloud. 01:26:30.140 --> 01:26:36.740 And again, these are things that maybe have never been synced with the end user system, but you can find out what they have access to. 01:26:37.340 --> 01:26:41.260 And then there's a Citrix files underscore, and then a date.log. 01:26:41.260 --> 01:26:45.780 And that gives a detailed activity of what things have synced, what files they have access to, and stuff like that. 01:26:45.780 --> 01:26:51.820 And then similar to Box, there's a part cache directory, where you can gain access to all those cached files. 01:26:54.240 --> 01:26:59.000 Okay, and don't want to go too much into, again, all the different columns and folders, but it's very similar. 01:26:59.000 --> 01:27:06.200 We get a lot of unique IDs, and we can map out where things are sitting, what parent directory they're in, and we even have a unique ID. 01:27:06.560 --> 01:27:14.020 Similar to Box and Google Drive, you have the hash as well, so you get that fingerprint of the file. 01:27:14.800 --> 01:27:21.520 All right, but they actually have in these remote and the local item database, they have a lot of columns in there, as far as permissions and stuff. 01:27:21.520 --> 01:27:26.480 I didn't have time to map out what all those permissions meant, whether they were shared, read, write, that kind of stuff. 01:27:26.480 --> 01:27:33.740 But you get a plethora of information, including even the file size of the different files within Citrix ShareFile. 01:27:35.100 --> 01:27:36.600 Local items, very similar. 01:27:36.600 --> 01:27:39.100 You get the hashes, URLs this time, though. 01:27:39.100 --> 01:27:43.480 What I thought was interesting with this one, though, is that there was a URL within the local item database. 01:27:43.820 --> 01:27:52.200 It gave a, what I believe to be an instance ID, .sf-api.com, and then some directories and an item ID. 01:27:52.200 --> 01:27:56.200 I tried to visit those with a browser, and I got nothing. 01:27:56.320 --> 01:28:07.040 But I do have a feeling, though, that you're able to work with their API, you could probably then, by using this, gain access to some of their files using that API. 01:28:08.580 --> 01:28:13.760 Okay, and then the directory entry, this really just gives us a parent structure or a structure of where things are. 01:28:13.880 --> 01:28:23.360 If you look at that Citrix ShareFile underscore date, and then the date.log, these are some things that I've identified as words you might want to parse out for using grep or awk. 01:28:23.600 --> 01:28:36.440 Upload file, file system notifier, local, win, FSP, delete item, download, upload, read callback, those are all interesting actions when I did those in my lab environment that triggered these log files. 01:28:37.020 --> 01:28:48.720 So similar to Box, where they had that cache directory, if we go into the part cache, you've got these long gwids or hashes, and within those directories, you're then going to see 0.part. 01:28:49.640 --> 01:28:56.760 Almost identical to Box, though, if you open that with a hex editor, you're able to see it's an RTF file or a .docx file, sorry. 01:28:57.100 --> 01:28:58.760 And you just rename the file extension. 01:28:58.760 --> 01:29:00.020 So 0.docx. 01:29:00.020 --> 01:29:03.360 And I was able to recover the entire document that way as well. 01:29:04.160 --> 01:29:08.440 So a couple more things before we dive back into a lab or two. 01:29:08.920 --> 01:29:14.340 Some other areas that you might be interested in, okay, well, maybe they didn't download the application. 01:29:14.340 --> 01:29:25.880 So I'm looking at a system that I've either compromised as a offensive security professional or from defensive, I am analyzing this Windows system and trying to figure out what they did or maybe exfiltrated data. 01:29:26.500 --> 01:29:33.480 Well, sometimes you can use, obviously, these cloud file storing solutions without installing the application. 01:29:33.640 --> 01:29:39.760 And so if so, there may be evidence of that happening if you go ahead and look in their history, their browsing history. 01:29:39.980 --> 01:29:47.160 And if we look at their browser history, we can find things like for Google Docs or Google Drive, you're going to see docs.google.com. 01:29:47.160 --> 01:29:54.380 And we could see whether or not they were viewing or editing spreadsheets, presentations, documents, what type of file they were editing. 01:29:54.380 --> 01:30:02.800 So we don't get insight to which file, the name of the file, but we will be able to see if they view or edited any types of files in Google Drive. 01:30:04.700 --> 01:30:07.720 If they go to the root of Google Drive, it's different. 01:30:07.720 --> 01:30:10.720 So if they're actually editing, it's docs.google.com. 01:30:10.740 --> 01:30:20.520 If they're just viewing their drive and the folders in them without viewing a specific object, it's drive.google.com slash drive slash my drive. 01:30:20.940 --> 01:30:32.840 You can also, if they browse to any subdirectories that are in their Google Drive, so the finance or personal folder, their browsing history, you'll see drive.google.com slash drive dash folders. 01:30:33.940 --> 01:30:42.940 And then if they want to, if they delete something and they look in their trash, you're going to see drive.google.com slash drive slash trash, which meant they have visited their trash can recently. 01:30:43.560 --> 01:30:50.660 Similarly, if they look at the root directory in Box, you're going to see app.box.com slash folder and the root directory. 01:30:50.660 --> 01:30:55.020 So once they log in and they just look at all their files and folders, it's zero. 01:30:56.160 --> 01:31:08.800 Now, if they view in personal version, though, of Box, I'm sorry, of OneDrive, if they're in OneDrive, you're going to see onedrive.live.com slash question mark ID equals root, which means they're in the root. 01:31:08.800 --> 01:31:11.440 And then you're also going to be able to identify their CID. 01:31:11.440 --> 01:31:25.340 So if they say, no, it wasn't me that logged in, someone else was on my machine, you can actually map that CID back to see how much activity they're doing on the web versus maybe when you looked at the registry keys and you saw that they had synced OneDrive locally, 01:31:25.340 --> 01:31:32.420 that's how you can see that that same user was logged in the browser doing stuff in OneDrive as was installed on the application. 01:31:33.400 --> 01:31:36.480 Dropbox will just give you the root, you'll see slash home. 01:31:36.480 --> 01:31:47.040 If they go to any other documents or view it with their emulator of like, okay, you can view a Word doc or a PDF or something like that, you're going to see dropbox.com slash SCL. 01:31:47.040 --> 01:31:50.200 And that tells you that they have viewed things within the web browser. 01:31:51.020 --> 01:31:56.760 And if they want to go view or they view any contents and other folders, you're just going to see dropbox.com slash home. 01:31:56.760 --> 01:31:58.620 And then you will see the folder name. 01:31:58.620 --> 01:32:03.600 So you actually get to see finance operations or whatever the folder name is that they were looking at. 01:32:04.640 --> 01:32:10.700 So the data that I gave you for the lab environment that we're going to go back to in just a second here, I've got two slides left. 01:32:11.960 --> 01:32:17.880 The way I extracted that, and it was a new way of doing it for this lab, since we're all virtual, and I didn't want to hand out large VMs. 01:32:18.120 --> 01:32:20.700 I used a tool called CAPE. 01:32:20.740 --> 01:32:24.540 And I built a target, which basically says, what do you want to extract? 01:32:25.280 --> 01:32:31.520 Now, I copied some of the stuff that was in the original target that I looked at where they had some things for OneDrive, and I mimicked that. 01:32:31.520 --> 01:32:40.140 And I built it out for Dropbox, OneDrive, Box, Citrix share file, and I can't remember which one I missed there, Google Drive. 01:32:40.140 --> 01:32:47.260 But all five different ones that we've talked about today, the target that I built there, I built that out to extract that. 01:32:47.260 --> 01:32:49.500 And it does so within about 10 seconds. 01:32:49.660 --> 01:32:54.000 So if you run CAPE from the command line, you can see, I lied, it was 12 seconds. 01:32:54.000 --> 01:33:03.040 It's going to pull up all the registry keys, and all those cached files, and anything else that is identified with one of those cloud file storage solutions. 01:33:03.040 --> 01:33:05.880 Now, if they have tons of data, it might be a little bit longer. 01:33:05.880 --> 01:33:22.300 But the point is, within 12 seconds, whether I'm on an offensive or defensive engagement , I'm able to exfiltrate, or not exfiltrate, but grab all of that useful information that shows me any type of evidence that they are using those files, and possibly even the cached files that I can recreate. 01:33:23.380 --> 01:33:25.360 So that brings us into the lab. 01:33:25.360 --> 01:33:29.520 I think the second lab that we skipped over is going to go ahead and be Google Drive. 01:33:29.520 --> 01:33:34.240 If you've got to take off, I know it's, you know, I'm here in Los Angeles, it's already 5pm. 01:33:34.240 --> 01:33:38.640 But if you're on the East Coast, it's probably a bit later, or maybe somewhere else around the world. 01:33:38.700 --> 01:33:45.460 I encourage you to connect with me on Twitter, and LinkedIn, that's the best way to get a hold of me, and chat in the future. 01:33:45.660 --> 01:33:54.960 For those of you who are staying around for the next 20 minutes or so, we're going to go ahead, I'll give you about 10 minutes to try the Google Drive lab. 01:33:55.200 --> 01:33:59.340 And after you try the Google Drive lab, then I'll do a quick walkthrough. 01:33:59.360 --> 01:34:03.600 So on my screen here, I'm just going to pull up the ones you see which one we're looking at. 01:34:05.160 --> 01:34:11.480 So it's going to be examining cloud file storage incidents lab, Google Drive, again, just like the other one, you've got the lab instructions. 01:34:11.640 --> 01:34:15.280 And then if you scroll all the way down, you'll be able to see the detailed walkthrough. 01:34:27.430 --> 01:34:30.850 Okay, I'll go ahead and do the walkthrough here. 01:34:31.750 --> 01:34:35.750 So the first instruction says to run DB browser for SQLite. 01:34:35.750 --> 01:34:42.490 And it's located, in this case, it says C program, DB browser SQLite, but we've got to install that. 01:34:42.490 --> 01:34:50.830 So let me go down to my installs and get that going. 01:35:02.910 --> 01:35:15.230 Okay, and then once this loads here and finishes up, we're going to browse to Google Drive, or it's in AppData, local Google Drive, and then user default. 01:35:15.390 --> 01:35:17.690 And we're looking for the sync config database. 01:35:17.690 --> 01:35:21.190 Okay, so I'm going to just run DB browser for SQLite. 01:35:24.420 --> 01:35:26.020 Pin this. 01:35:26.820 --> 01:35:27.700 Perfect. 01:35:27.700 --> 01:35:34.520 Okay, so we're open database. 01:35:34.520 --> 01:35:43.300 I'm going to go to my downloads, evidence, and C drive, users. 01:35:43.720 --> 01:35:45.440 Oops, sorry. 01:35:45.740 --> 01:35:49.000 Windows, system 32. 01:35:49.660 --> 01:35:51.040 No, I am all messed up here. 01:35:51.040 --> 01:35:51.900 I apologize. 01:35:51.900 --> 01:36:03.260 C, users, Bob, AppData, local, Google, Drive, user defaults. 01:36:03.260 --> 01:36:06.020 And then within here, that's where I'm looking for the sync config. 01:36:06.240 --> 01:36:12.280 So I've got that database, I open it up and expand this out a little bit. 01:36:15.070 --> 01:36:22.570 Okay, and then we go down the instructions here, we're going to look for, click on the browse data tab. 01:36:22.590 --> 01:36:28.890 So if we click over here, browse data, we get a better view of everything that's going on. 01:36:29.290 --> 01:36:30.770 Expand this out a little bit. 01:36:35.080 --> 01:36:35.780 Okay. 01:36:36.400 --> 01:36:39.980 And so the first question is, what is the data value for the following? 01:36:39.980 --> 01:36:44.540 So we're looking for the highest application version, local sync route path and user email. 01:36:44.620 --> 01:36:50.660 So we can see here, this is the version of Google Drive that was installed on the machine that we're looking at. 01:36:50.660 --> 01:36:56.420 So again, we can look for vulnerabilities, we can match it up to the system, whatever the use case is. 01:36:56.540 --> 01:36:58.760 And then local sync route path. 01:37:05.260 --> 01:37:07.420 Oops, I messed that up. 01:37:07.420 --> 01:37:11.280 Local sync route path, here we see it is cusers, Bob, Google Drive. 01:37:11.280 --> 01:37:15.680 And then for email, we see it's bob.mckley.re.gmail.com. 01:37:15.680 --> 01:37:18.140 It's the same one that the HR had in their file. 01:37:18.800 --> 01:37:22.900 Step two is we're going to browse to Cloud Graph. 01:37:22.900 --> 01:37:34.220 So I'm going to go open a new database and within Drive, it's user defaults, Cloud Graph, cloudgraph.db. 01:37:35.800 --> 01:37:37.960 And I don't want to save changes. 01:37:40.060 --> 01:37:43.840 Now on this one, I'm going to have to change the table here. 01:37:43.840 --> 01:37:46.780 And so it tells me to go to the Cloud Graph entry table. 01:37:46.880 --> 01:37:48.960 So click on that one. 01:37:48.960 --> 01:37:54.620 And then from here, we want to know what's the file name for doc type six. 01:37:54.620 --> 01:37:59.260 So I'm looking for doc type six here, I see one that's this one. 01:37:59.260 --> 01:38:03.000 So it's a remember from, what was it, three to 12 or 13. 01:38:03.000 --> 01:38:05.000 Those are Google formatted documents. 01:38:05.600 --> 01:38:09.320 And I'm gonna expand this file name to see what this file was called. 01:38:10.840 --> 01:38:13.140 Ways to tell your boss you're leaving. 01:38:13.380 --> 01:38:16.260 That sounds suspicious, something you might want to look into a little bit more. 01:38:17.940 --> 01:38:21.180 Okay, and then let me look down for 01:38:26.600 --> 01:38:27.320 here. 01:38:28.380 --> 01:38:32.180 And then we want to look at what type that was. 01:38:32.180 --> 01:38:35.580 Obviously, we can go back to the slides and see that that was a Google formatted doc. 01:38:36.740 --> 01:38:42.880 And we want to look at the modified date for a file of where the file type was six. 01:38:43.060 --> 01:38:50.040 So I can scroll over modified date, right this date, though, we're gonna want to copy this. 01:38:50.760 --> 01:38:54.420 And let me go ahead and do this. 01:38:54.600 --> 01:38:56.660 I'm just going to open up Google here. 01:39:03.440 --> 01:39:06.940 And I convert this, we could see the exact time. 01:39:08.400 --> 01:39:11.680 I'm going to paste in the time that we got. 01:39:12.480 --> 01:39:17.620 And it's going to tell us both are my local time as well as UTC or GMT. 01:39:18.260 --> 01:39:23.680 If we're looking at GMT, it was Friday, April 17 2020 601 25am. 01:39:24.040 --> 01:39:26.860 And that's something that we're going to want to go ahead and look at. 01:39:26.860 --> 01:39:32.120 And so even if we look at local time, though, for me, it was at 1101pm. 01:39:32.200 --> 01:39:37.680 So if this is a work machine, why are they the file name was tell your how to tell your boss you're leaving. 01:39:37.680 --> 01:39:44.880 And I believe this was the night before I believe on the 17th the morning of Bob McClee put in notice. 01:39:44.880 --> 01:39:48.200 So at 11pm was looking for ways to find bosses leaving. 01:39:50.540 --> 01:40:01.510 Okay, then we've got on the scroll down my tutorials. 01:40:07.470 --> 01:40:08.730 Catch up. 01:40:08.730 --> 01:40:09.210 Okay. 01:40:09.210 --> 01:40:13.930 And then after we converted that our next step or question is further examine the file. 01:40:15.130 --> 01:40:24.770 examination of file name column and database uncovers additional documents of interest, for example, Doc ID one, or one MP, blah, blah, blah. 01:40:25.170 --> 01:40:27.170 One was the document last modified. 01:40:27.170 --> 01:40:33.050 So I'm looking over here, there's one that we want to look at one MP. 01:40:33.050 --> 01:40:34.650 So I'm looking here one and 01:40:39.080 --> 01:40:40.020 this one here. 01:40:40.060 --> 01:40:43.860 And it says resignation letter ready dot RTF. 01:40:43.860 --> 01:40:48.880 And so we want to look here at the modified time and copy this again. 01:40:49.880 --> 01:40:52.880 I'm going to go back over to Google. 01:40:54.820 --> 01:41:03.880 pop this in convert and it looks like Friday, April 17 617 am. 01:41:03.920 --> 01:41:06.840 So oops, something scrolling way down. 01:41:07.040 --> 01:41:17.320 So it looks like the morning of right putting resignation around maybe eight or 9am when everyone came in the morning of on the work machine, this this document was modified. 01:41:17.860 --> 01:41:19.980 Or at least Yeah, last modified. 01:41:19.980 --> 01:41:21.320 So we don't know what it originally had. 01:41:21.320 --> 01:41:22.940 But obviously, it says it's ready to go. 01:41:22.940 --> 01:41:27.080 And we saw the resignation letter come in on the 17th in the morning. 01:41:28.500 --> 01:41:29.940 Go back. 01:41:32.000 --> 01:41:36.900 Next step is to what is the hash for the file file name client list. 01:41:36.900 --> 01:41:46.420 So if we look for the file here called client list in row 12 can scroll over and now we get the file hash here. 01:41:46.420 --> 01:41:49.280 And this might be important because we may see changes along the way. 01:41:49.280 --> 01:41:52.400 Maybe we look at the cached version and it's different than this. 01:41:52.800 --> 01:41:58.800 And maybe we want to verify this, this is the client list that he stole or that we have in our file server. 01:41:58.800 --> 01:42:00.580 So we might want to copy that hash down. 01:42:03.140 --> 01:42:06.500 Okay, next piece is that we are going to open up the sync log. 01:42:06.500 --> 01:42:11.420 So I'll minimize this, we'll go over here. 01:42:11.840 --> 01:42:33.080 And go to my downloads, go to the evidence we've collected, click in there, see, and users, Bob, app data, local, Google, drive, and then user default. 01:42:33.420 --> 01:42:39.380 And then within here, we should see the we're looking for sync log. 01:42:40.420 --> 01:42:47.900 This one open up and expand that a little bigger for you. 01:42:48.380 --> 01:42:54.180 And within here, again, ideally, you do something like Sumo logic or some other tool to parse this out. 01:42:54.220 --> 01:42:58.180 We want to look at where did the file originate from. 01:42:58.580 --> 01:43:03.380 And, and we're looking for specific things like resignation letter. 01:43:03.380 --> 01:43:06.100 So I want to see when things were synced and changed here. 01:43:06.100 --> 01:43:20.360 So let me do a search and find and I'm going to search for resignation letter. 01:43:23.700 --> 01:43:30.480 Okay, and then here, we see that close this out. 01:43:31.540 --> 01:43:39.300 Right, so we get the date and the time all the way on the far left there was the 16 2235, at least local time. 01:43:40.620 --> 01:43:44.680 Over here, we see receive change directions upload. 01:43:44.680 --> 01:43:49.920 So the user on this system that the work machine, the file was changed. 01:43:49.920 --> 01:43:57.940 And then this, the changes were synced or uploaded to the cloud and matches the file name. 01:43:57.940 --> 01:44:01.640 And look at this resignation draft, we saw resignation letter ready. 01:44:01.640 --> 01:44:04.280 So this might have been changed around that time. 01:44:04.280 --> 01:44:07.460 Originally, it was in draft format, and the user changed that. 01:44:09.860 --> 01:44:12.940 And sometimes we also get hashes here as well. 01:44:12.980 --> 01:44:14.700 Okay, but it was a local system. 01:44:14.940 --> 01:44:19.360 So it was the direction was upload, they made that change locally, it got synced up. 01:44:20.500 --> 01:44:29.540 Next question is, we want to find all for all instances of this. 01:44:29.540 --> 01:44:31.500 And again, some other parsing tools better. 01:44:31.500 --> 01:44:41.280 But if I go here to search, and I type find again, and I do find all in open document, this is going to give us a list. 01:44:41.280 --> 01:44:43.420 And I don't know how to make this bigger for you. 01:44:44.260 --> 01:44:51.580 But we can see here all the different times that resignation letter was was in here. 01:44:51.580 --> 01:45:05.960 But basically, what I would do in a much better way with some other tools, I'm looking here for the name resignation letter draft, draft, draft, draft, and I want to kind of find down here where it's changed from draft. 01:45:05.960 --> 01:45:09.440 So I see ready down here, I don't want to spend all the time doing this. 01:45:09.440 --> 01:45:14.700 But I'm going to look for the line item where it says draft, and then the next one says ready. 01:45:14.700 --> 01:45:19.660 And that's going to tell us when that change was made, where they renamed the file, and now it's ready. 01:45:21.100 --> 01:45:22.460 Okay, and then 01:45:25.520 --> 01:45:28.400 next step, we go back to SQL Lite. 01:45:28.620 --> 01:45:32.400 And we look for an inode ID for an office lease. 01:45:32.520 --> 01:45:34.600 I know we're pretty much out of time there. 01:45:34.600 --> 01:45:38.220 So I know all the other steps are in the detailed walkthrough. 01:45:38.220 --> 01:45:43.720 If you want any of that, I did want to give a couple of minutes for questions before I've got to leave and be respectful of everyone's time. 01:45:43.720 --> 01:45:49.420 So again, there's a couple more steps to that lab, but you can look through those we didn't get to the box lab. 01:45:49.920 --> 01:45:54.400 But you can absolutely go through those and hit me up on LinkedIn if you have any questions around that. 01:45:54.400 --> 01:45:57.860 So I'm going to switch back to my slides and see one more time. 01:45:57.860 --> 01:46:12.460 If there's any questions, I also want to give a big shout out and thanks to all the people at the cloud village, the ones that you heard vocally, but then there's tons of people on the back end who have made this possible and obviously for free. 01:46:12.460 --> 01:46:15.000 So big thanks to them and thank you for having me here.