Micro Web Servers
Anti-Forensics
Copyright 2011 Technoids.com
What is Anti-Forensics ?
Anti-Forensics definition: "The prevention and or removal of forensic information"
All electronic devices contain personal forensic information which is hidden from the consumer. Due to the fact that criminals and unscrupulous corporations have access to this information, it is in the best interest of the consumer to eliminate forensic data containing personal information. This will substantially reduce the chances of identity theft. This will also reduce unnecessary Internet traffic and generally let the device operate faster and more efficiently. Options that contain "enhance your experience" or "Diagnostics" should be disabled.
Anti-Forensic & Security Tips for iDevices
Non Jailbroken iDevices
Diagnostics & Usage iOS 5.X
Settings > General > About > Diagnostics & Usage > Don't Send
Note Older iDevices such as iPod Touch 2G and iPhone 3G do not have this option and jailbreaking is recommended to limit location data collection and disable Carrier IQ
Location Services
Turn Location Services Off
Settings > Location Services > Off
or
Settings > Location Services > On
Turn off Location Services to all 3rd party apps
Turm on App Location Services only when needed
Auto-Lock
Settings > General > Auto-Lock > 15 Minutes or less
Turn on Passcode Lock
(Use a long password with letters numbers and special characters)
Settings > General > Passcode Lock > Turn Passcode On
> Require Passcode Immediately
> Simple Passcode > Off
> Picture Frame > Off
> Erase Data > On
iCloud
It is too early to determine whether your personal data is safe on iCloud. In the iTunes backup, there is an unencrypted plist file containing your iCloud email (login) and the URL's where your data is stored.
Use iCloud at your own risk and make sure Encrypt Backup in iTunes is enabled
Wireless & 3G
Turn off wireless and 3G when not using the Internet
Settings > Wi-Fi > Off
Settings > Airplane Mode > On
NOTE
Even with Locations Services turned off it is still active recording the last 7 days of location data and sending that info to Apple and or their partners. Only with a jailbreak can this be turned off completely. iOS older then 4.3.3 records up to 1 year and is backed up to your PC when using iTunes backup.
iTunes Backup
Enable Encrypt Backup
(Use a long password with letters numbers and special characters)
Jailbroken iDevices
Same as above as well as below
Change true to false in com.apple.iqagent.plist (Stops Carrier IQ in all iOS versions)
Unload or delete unnecessary plists
ie com.apple.wifi.plist contains all the wi-fi routers you have
connected to. See a real example here
Delete location databases ie cache.db consolidated.db and lockCache_encrytedA.db More information is here
Add domains to block in your hosts file (/private/etc/hosts)
Here is one done by Technoids. It blocks over 16,000 ad,
call home, and malicious domains
ZeroTracks.com (A spin off of Technoids.com) has location data
cleaning & lockdown tools and will be updating them to handle all
the above issues iOS 3.X - 5.X
Use Firewall IP
SSH
Use a strong password (Only the first 8 characters are recognized)
and change port 22 to another port. Turn it off when not in use.
Apple and most iStore apps want to know your geo location as well as your UUID (universally unique identifier)
Over 300 million iDevices have been sold. iPad Hits Three Billion Downloads in just one year. 25 billion apps for all iDevices have been downloaded, with more than 1/2 million available apps
This study shows 74% of consumers believe it’s “very important” or “extremely important” to understand what personal information a mobile app collects. 52% of consumers reported that they have read a privacy policy for a mobile app. Unfortunately, out of the top free mobile apps only 19% have a privacy policy
Apple's Privacy Policy
All iDevice Terms and Conditions of acceptance
Apple and Telco carriers still insist collecting your location data is "anonymous" The fact is "diagnostics data" contains your unique iDevice id's which is tied to your iTunes account, your credit card, your personal information, your geo locations as well as your internal network information. Apple's iADS in Safari uses geo located ad delivery paradoxically called "interest-based ads".
Franken’s Location-Privacy Bill Would Close Mobile-Tracking ‘Loopholes’
Device Software Diagnostic Log
Version: 3
OS-Version: iPhone OS 5.0.1 (9A405)
Model: iPad1,1
Serial Number: GXXXXXXXXXV
Created: 2011-12-29 23:57:12 -0500
After public discovery and distain over Google's Wi-Fi location data collection, Google has finally offered a Wi-Fi Opt-Out but Google announces privacy changes across products; users can’t opt out
Google Launches Opt-Out Village - Parody Video
How easy is it for anyone to listen in on your cell phone conversations, track your location, see through your camera lense, capture your email and text messages ? A lot easier then you think.There are thousands of web sites selling the necessary information and software. This invasion of privacy has been around for many years, used by law enforcement, criminals and countless ordinary individuals. Researcher warns of risks from rogue iPhone apps
If you "loose" your iDevice and get it back, there is a strong possibility that someone has installed spyware on your iDevice.
Restore the iOS with a fresh copy in "recovery mode" (See Below) and do not do a restore of your old data. Re-enter any contacts and other personal info by hand. Never input personal information such as bank accounts, credit cards and especially passwords. Enable a strong passcode. iDevice manuals are here
How to remotely wipe your personal iDevice (may or may not work)
Restoring Your iDevice to a Fresh iOS and Removing All Personal Data
Caveat: This will erase any apps or data from Cydia on a Jailbroken iDevice and will have to be Jailbroken again
NOTE: Restoring in Recovery Mode Only will remove any potential spyware ( Also used incase you forgot your passcocode )
- Make sure you sync your iTunes purchased apps and media ( Needed to restore your lastest purchases )
(Your purchaded apps and media are in this folder %userprofile%\Music\iTunes\iTunes Media\)
- Optional intermediate method - How to back up your data and set up as a new device
IMPORTANT: To ensure spyware is not reinstalled from your iTunes backup, cut and paste your backup folder elsewhere or delete it, before continuing ( Windows backup location %AppData%\Apple Computer\MobileSync\Backup\"WhatEverFolders" )
- With the iDevice connected to the computer you registered it from. Load iTunes. Power off the iDevice.
- With the iDevice off, press and hold the Home button, then press the Power button for a few seconds.
- Keep holding the Home button until you see an iTunes message message about an
iDevice connected in Recovery Mode. (see iDevice image on right)
- In iTunes, select the Summary tab and click Restore and follow the prompts.
Restore as a new iDevice
- When the process is finished, sync your purchased apps and media.
