hello survivors welcome to my defcon talk um i know what you ate last summer a digital forensic
look into a pos system presented by me wesley offham you might wonder who i am i am the
president of the cyber knights at middle georgia state university we are a capture the flag
team and we do other cyber security things but the main thing is capture flag like ncl
hive mind and a few other those competitions i am not a fully trained or certified forensic
investigator i am just a normal general computer nerdy hacker person as shown by my plushes behind
me i'm also an avid cyclist and this is actually my first time ever speaking at defcon so hopefully
it goes well i had to do remote this year because of some scheduling conflicts but next year
i'll be right there with you guys in vegas what will we be talking about today today we'll be
talking about digital forensics and why it matters we'll be going over the background of
the system that i analyzed
we'll go over what is found on the system and also go over what food was found on the system
which is what everyone wants to kind of see probably um what we'll not be talking about
today we will not be talking about how to hide information from authorities and this will also
not be a very in-depth or detailed talk about digital forensics it's more of an introductory
level talk a high level talk per se but speaking of that this is the national institute of standards
technology's definition for what is digital forensics this is a very institutional term
and i have made my own definition for this talk and this is the definition we'll be using
gathering digital evidence from electronic devices to be used in a court of law
or in this case a fun defcon talk about pos system that we found
why is digital forensics important though it can be used to recover data on company systems that
have been either damaged or wiped or stored in a company system so we'll get into that in a moment
I'll make him used to find hackers who leave little bits of data or logs on
local systems. They can also be used to catch bad guys like the BTK
killer who on a floppy disk had a little bit of metadata from where he actually
created the disk. It was used a lot in CSAM cases which if you don't know what
CSAM is it's basically pedophiles. It has caught a lot of pedophiles and that
that small list of three I have on the screen is not in the tip of the
iceberg for those cases. I have a link right below there that actually is a
longer list of cases that forensics has been used in. Now time for the meat and
potatoes of the talk but first what do you call a baby potato? A tater tot. My
stand of a career is not going anywhere neither is this history of this system.
The system was bought in a lot of seven from a university that
the university was selling their systems and well one of the community
members bought them and we discovered that one of those systems still has
hard drive in it and it wasn't just the fact that has hard drive in it it was
not even wiped. That IT admin is probably kicking himself right now because guess
who gets guess you gotta look at it all me. So he cloned the he cloned the image
of the system and he sent it over to me analyze and also to turn to a VM so I
can actually kind of
get a feel for the system itself. So this is a picture of the system as I was
using Clonezilla on it what you have to do for Clonezilla is you basically
plug in a virtual ISO for Clonezilla then you attach the image and another
virtual USB Drive and then you just combine the two and it makes
basically your image but sadly I discovered while I was doing it the
MBR was messed up it was really badly messed up so I had to actually plug in
and Ryzen boot CD, an older version of it,
and asked you to make it to use their MBR checker tool to fix it.
And yeah, after that, I got into Windows Recovery Console.
And sadly, for that, I needed a password.
So guess what I had to do again?
My good old tool, Ryzen boot CD.
So I used NTP Editor to edit the passwords and change them
to make them whatever I wanted them to be.
So I changed both accounts while I was at it.
And then after hours of trying to fix it and make it work,
I got this, invalid license, and also nothing else works.
Mainly because I do not have a cashier ID or the cashier password
or an admin version of those, sadly.
So I decided after that, well, if I'm going to have to see the files,
I'm going to have to do an image of the system.
So what I did, I will use FTK Portable Imager
to apply the image to the system.
So I'm going to acquire a forensic image of the system.
Now, if you don't know what a forensic image is,
it's basically a bit-by-bit image of the entire drive.
In this case, it's not really a drive.
It's a virtual drive.
But I took a virtual image of the entire drive,
every bit and byte of it, all the ones and zeros,
and that created an image of 182.5 gigabytes,
which is very large and was very hard to work with at times
because my computer is only 8 gigabytes.
It's a RAM, and it filled it up really quickly.
So I used Optopsy to do the analysis of the image,
and what Optopsy does is it organizes and sorts things in different ways,
and I'm about to show you that.
So after hours of ingesting it through Optopsy, I got this.
This is about what Optopsy looks like.
Now, it's kind of messy, so let me add some labels for you guys
so you can easily see it.
So right up here on the top of the laser pointer,
right up here at the top is the volumes found on the system.
So there's the NBR up there, which is, by the way,
still a little messed up, so it doesn't always work.
The OS volume, which is right there, which is NTFS,
because it's a Windows system.
And then right below, there's unallocated space,
so that could be anything that just isn't allocated
to the operating system while it's being imaged.
Right over here on the other side of it, though, you have file types.
So if you're looking for a big file type, like a photo, a video,
or something like that.
If you're looking for a certain case, you can use file type to search for that.
There's also deleted files right there.
But deleted files, for those who do not know,
when you delete a file off a hard drive, it is still there.
It actually, all Windows does, it just removes the headers for the files
and also removes its knowledge of where it is.
So it can be overwritten.
Obviously, if it has not been overwritten yet,
it actually is still very much there.
And even if it is overwritten, it actually usually is.
But it's still a little bit there that you can actually pull from.
And that's what autopsy will do, is actually will pull those,
these headers and stuff, and actually fix them.
Right below that is file size.
So if you're looking for a specific file size,
so let's say someone had a large amount of explicit materials
that you're not supposed to have,
you can actually sort by file size and find something, any big file size.
So like a video.
Right below that is installed programs, so anything like software,
core updates for Windows, and any programs that are on the system
will actually be in this list.
Right below that is metadata, which is any RTF files that are found.
And right below that is operating system information,
which we'll go over on the next slide.
Right below that is recent documents,
which we'll also be going over on the next slide.
But that's kind of anything that's been opened up recently.
Right below that is run programs,
which are any programs that run on startup, per se.
So anything that starts up.
Shell bag is kind of anything that uses Shell or PowerShell,
which I'll just use it.
So it's kind of not really that useful for most cases.
USB device attach.
Those are anything that's been attached via USB,
and the system will actually log it.
And it's really hard to delete the fact that it's been logged.
Right below it, as you can see,
there is actually web bookmarks, web cookies, and web history below that.
And web search.
Those are actually all built into the operating system that it is.
This is just, those are all just default on there.
It's kind of weird.
Those are all just, it's just Windows.
Normally, you will have real data in there,
but since it's a POS system,
and you normally go, there's very little web browsing, obviously,
on a POS system,
and you actually cannot get out of the locked out system.
Right below that is extension mismatch detection.
So if you, let's say, change a PNG file to a video file
by just changing the extension on the back of it,
Windows isn't going to be able to read that,
but Optopsy will find it,
and they actually will correct it and fix it in itself,
and they actually will show you it on that list.
Right below that is keyword hits,
which is the tool I use to get my forensic analysis done of the food.
And then right below that is also OS accounts,
which is another interesting one.
We'll go over.
So what OS is it?
It is Windows XP Service Pack 3 Embedded Edition.
It was actually created by Sonolia Retail Systems.
IBM has four other options for the system.
It has PC DOS 2000.
It has Microsoft Windows 2000 Professional Edition and XP Professional.
And then last but not least,
it has IBM Retail Environment for SUSE Linux version 1.0.
Now,
if anyone has the ISO for that version,
please contact me at the end.
Contact me on my email.
That'd be really cool to get.
Obviously don't send it.
If you're going to send me anything other than the image,
the ISO file,
I will not respond to it.
Because I will not open it with my main system.
As we know,
Windows XP is dead and all those other systems that OS has ever listed are dead.
So that means any exploits or anything like that that applies to any of those
OS's are very much still involved in these systems, in these POS systems.
So if you have a POS system that's running XP, have fun.
The Linux one can technically still receive updates,
but you're basically rolling those yourself.
So anyone in the open source community who wants to make IBM Retail Edition Linux updates,
have fun with that.
Recent documents that have been opened.
So ncuser.dat,
which is basically just the user permissions and stuff,
I believe that was actually opened by me whenever I turned on the system
initially in my VM.
So that actually does create a little bit of tampering on systems.
So if this was a actual forensic investigation,
this whole entire analysis would be just thrown out the window and in court room,
because the hash value of the system that I am analyzing is not the same as the
actual system when it was imaged.
So run program,
there's another interesting one.
All these programs I have in this red box over here,
those are all from Sanoi Retailing.
So they have one for offline credit card processing,
they have one for routing services,
things like that.
Those all will run on startup and be controllable.
So if you ever,
so at some point I was trying to reverse engineering those types of programs,
but sadly I had no luck.
But everything else listed on there,
below that is actually just normal Windows XP program.
So that's kind of cool.
Here's a list of attached USB devices that have ever been,
all the USB devices that have ever been attached to the system.
There's a list of them.
I actually have cherry picked a few of them to actually go over here.
So if you're the person who owns a iPhone 3GS back in 2012,
and you plugged your phone into a cash register to charge it,
I have that.
On the log for you.
And then I also have an LG that was also charging on it,
a iPhone 4S,
a HTC phone,
and a Huawei phone as well.
And a Samsung phone,
of course.
So all these devices at some point were plugged into the system for charging or whatever.
And I have that's all logged in the system.
Also,
I have a log of all the flash drives that were ever plugged into the system.
And I don't know why you would want to plug in a flash drive,
into a POS system other than to be malicious of some malicious,
but about a few flash drives or someone was doing admin work with it.
Yeah.
So also you can also see another evidence of my tampering.
You can see my virtual box.
It's also logged in the log.
What else we got?
Yeah.
OS accounts.
So here's all the default.
So the cash administrator actually is the default administrator account that comes with Windows,
but it has password change.
They had a cash.
There's a cashier account.
And then there's a few other regular windows accounts.
The guest account on the system actually was disabled.
Thankfully,
so they actually were doing a little bit security there.
But there was a few other things a little bit wrong.
So the passwords on the systems,
the password on the system actually was never set to actually expire.
So it would always be the same password.
So once you had the password,
you're out of luck,
but the register was set to auto login for the cashier account.
and then the cashier account has been logged in 425 times and then the
administrator account was only logged into 70 times and then the last fell
login was 2018 though for the administrator account okay let's get
into everyone's to talk about the food stats so the most bought food from this
POS system was Papa John's one topping pizza and this will also just one slice
by the way there's just one slice of pizza was the most commonly bought thing
at twenty eight thousand and eighty pizza slices and this is also just the
only the one topping and only the one slice so if you combine all the pizza
so that she is more than that the least bought food was turkey and stuffing wrap
which sounds disgusting at only four people ever have been purchased it
remember this is a college so of course healthy food was also pretty low on the
list there
an honorable mention for food was the roast beef and asparagus baguette at
zero per people have ever purchased it it was mentioned only once in the files
and it was only item for a little bit on the menu but no one ever bought it on
this system here's the full list of things that were bought so the top five
includes waffle fries from Chick-fil-a fountain drinks chicken sandwiches were
also from Chick-fil-a
iga and garlic Parmesan breadsticks and then as you can see there's a few other
pizza slices and other things right below all that and that here's some
notable meals that were on the system so the very first meal of the system
that anyone's ever bought from this peer register was three pizza slices 31
topping pizza slices for a total of seven dollars and 77 cents from hash and
this was back in 2010 now ten years later the very last meal I could find on the system
sadly I don't know what really happened I don't remember right
not know what the person ate i just knew the person bought a meal plan or used their meal
plan to buy it so whenever the system was first around it was actually part of a different
restaurant than what it ended up being um that's why the welcome to is different for both of those
receipts and so they started taking meal plans and then i stopped having good logs of what people
were actually eating sadly um and that's about all um thank you all for listening i hope you
all enjoy my talk about digital forensics on a pos system i hope you all at some point find a
mystery system and do some forensic analysis on it using autopsy or some of the other things i
mentioned below i would like to make a special thanks to the retail hacking village for letting
me speak today and then also like to thank little baron victor for helping me do some slide review
and some editing of editing um helping me with my speaking and stuff and also like to thank my
professors at the college for teaching me
so well my social media accounts are well i have my email so if you need any have any questions or
need anything well there's my email then i have my instagram tag and that's about it um there should
be a q a after this i believe and hope all of you have a wonderful sunday um and that's it thank you
so much