Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Beware Smartphone Lurkers: Cloud Storage File Remnants

Security investigators recovered Box, Dropbox and SugarSync files and unique file IDs, via forensic dump of iPhone and Android smartphone memory.

9 More Cloud Computing Pioneers
9 More Cloud Computing Pioneers
(click image for slideshow)
Cloud storage service apps leave recoverable traces of files on smartphones.

That finding comes from recently published research, "Using Smartphones as a Proxy for Forensic Evidence contained in Cloud Storage Services," conducted by University of Glasgow computer science PhD student George Grispos -- backed by computer forensics and e-discovery lecturer Brad Glisson and software engineering lecturer Tim Storer, both also of University of Glasgow -- which was presented at this year's 46th Hawaii International Conference on System Sciences.

The researchers said they'd expected to find "that smartphone devices will retain data from these storage services," but didn't know to what extent any leftover "artifacts" might include recoverable information. So they studied three popular cloud storage service apps running on the iPhone and on an HTC Desire running the Android operating system.

Here's what they found: "Using mobile forensic toolkits, data can be recovered from a smartphone device which has accessed a cloud storage service," they said. "The results from the experiment have shown that it is possible to recover files from the Dropbox, Box and SugarSync services using smartphone devices." In addition, artifacts left by those services' mobile apps in some cases allowed the researchers to gain a "proxy view" of files not stored on the device, but stored by the cloud service.

[ Companies have to protect their assets, but where do they cross the line into overzealous prying? See Monitoring Vs. Spying: Are Employers Going Too Far? ]

The extent to which they could recover files varied based on the operating system studied. "On the HTC Desire, both deleted and available files were recovered. The forensic toolkits recovered 9 files from Dropbox, 15 from Box and 11 from SugarSync," the researchers said. "On the iPhone, depending on application and device manipulation either 5 or 7 files were recovered from Dropbox, 7 or 15 from SugarSync and 5 from Box. No deleted application files were recovered from the iPhone."

Interestingly, the investigators could also use the Box app's file artifacts that they recovered to access copies of files that were no longer stored on devices, but still stored with Box. This required recovering file IDs for Box files that had been accessed, as well as authentication tokens linked to a specific Box user's account. With both pieces of information, the researchers could create a URL which accessed the Box API to download copies of files not present on the device, all without logging into the service. This digital forensic investigation technique worked on both the iPhone and Android devices.

Just to be clear, the researchers confined their study to these -- now superseded -- smartphone apps: "Dropbox (iOS version 1.4.7, Android version 2.1.3), Box (iOS version 2.7.1, Android version 1.6.7) and SugarSync (iOS version 3.0, Android version 3.6)."

What can smartphone users do to obscure any cloud-based files they've viewed? According to the researchers, clearing the cache led to them recovering fewer Dropbox and SugarSync files, but had no effect on the Box files. The researchers also reported that their file recovery success on the Android device depended, predictably, on whether the file had been saved for offline use, and if so, whether or not it had been saved to an external memory card, then deleted and overwritten, at which point it was unrecoverable.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
3/22/2013 | 4:28:13 AM
re: Beware Smartphone Lurkers: Cloud Storage File Remnants
From my point of view, this makes the use of an appropriate MDM solution all that much more important in an organization with a BYOD policy that also leverages these kinds of cloud services. Being able to do a full out "device nuke" in the event of a device loss becomes critical in light of these findings.

Andrew Hornback
InformationWeek Contributor
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3995
PUBLISHED: 2020-10-20
In VMware ESXi (6.7 before ESXi670-201908101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x before 15.1.0), Fusion (11.x before 11.1.0), the VMCI host drivers used by VMware hypervisors contain a memory leak vulnerability. A malicious actor with access to a virtual machine may be able to tr...
CVE-2020-7363
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7364
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of UCWeb's UC Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects UCWeb's UC Browser version 13.0.8 and prior versions.
CVE-2020-7369
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and prior versions, and was fixed in version ...
CVE-2020-7370
PUBLISHED: 2020-10-20
User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of Danyil Vasilenko's Bolt Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Bolt Browser version 1.4 and prior versions.