Secret Office 365 forensics tool - it does exist.(many individual Microsoft employees appear to have been genuinely unaware of this data’s existence)

Friday, June 8. Out of the blue, an email popped onto the forensics community mailing list. It contained a single link, to an Anonymous video.

Ten days later, CrowdStrike released a beautiful blog post about the unmasked Activities API


Forensic analysts Ali Sawyer and Matt Durrin ran it against an Office 365 test instance set up in LMG’s research laboratory. It contained the granular details that we had only dreamed existed — and more.

In the case of the secret Office 365 tool, the very existence of this evidence was kept hidden by several respected forensics firms, as well as Microsoft itself, for well over a year by several accounts.

Today, most cloud providers have no obligation to collect logs. Even if they do have granular logs, like Microsoft, they have no requirement to make these easily accessible to customers.


http://lmgsecurity.com/exposing-the-secret-office-365-forensics-tool/

BYOD - Text messages are a blind spot for IT. For now, we only have forensic tools

The blind spot issue related  to  text message  either not-known or ignored (for now) but, we do have a few forensic solutions that includes recovering deleted messages.

SNIPPETS from the Article:-

There are a few vectors for accomplishing this. Katana Lantern, Oxygen Forensics, Paraben, BlackBag Technologies and others provide tools for performing the ethical hacking of the device, as well as the data carving tools for analyzing the data.

The links below has more information:

Physical possession of the device can allow imaging of the device that stems from initially jailbreaking the device via redsn0w/Cydia. As long as the examiner documents this, it's still permissible in court. 

A hybrid of the physical access is to take a powered-off iOS device and use the sequence of buttons to put it into DFU (Device Firmware Update) mode. 

Alternatively, you can target the iTunes backup.

The links below has more information:

http://www.cio.com/article/749610/How_Forensic_Tools_Unearth_Deleted_Text_Messages?source=rss_all

Toos / Utilities - SSLsplit - For man-in-the-middle attacks against SSL/TLS for PenTest and Forensics

.

SNIPPETS from the Article:-

Connections are transparently intercepted through a network address translation engine and redirected to SSLsplit. SSLsplit terminates SSL/TLS and initiates a new SSL/TLS connection to the original destination address, while logging all data transmitted

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs forged X509v3 certificates on-the-fly, based on the original server certificate subject DN and subjectAltName extension. SSLsplit fully supports Server Name Indication (SNI) and is able to work with RSA, DSA and ECDSA keys and DHE and ECDHE cipher suites. SSLsplit can also use existing certificates of which the private key is available, instead of generating forged ones. SSLsplit supports NULL-prefix CN certificates and can deny OCSP requests in a generic way.

The links below has more information:

http://www.toolswatch.org/2014/03/sslsplit-v0-4-8-transparent-and-scalable-ssltls-interception/

For curious minds - Short Intro to Mandiant Redline - A free Memory Analysis Tool

The links below has more information:

https://isc.sans.edu/diary/Introduction+to+Memory+Analysis+with+Mandiant+Redline/17797