SANS Digital Forensics and Incident Response Blog: Tag - script

iOS Location Mapping with APOLLO Part 2: Cellular and Wi-Fi Data (locationd)

Myprevious articleshowed a new capability ofAPOLLOwith KMZ location file support. It worked great''for routined data, but there was something missing. What about the cellular and Wi-Fi locations that are stored in databases? Well, turns out I need to test better. I fixed the locationd modules to have the activity as "Location" versus "LOCATION". Case sensitivity is apparently thing in Python''my bad. '''''

I should also mention with the fixes, my total location data points for a iOS 12.1.1 device jumped to ~57,000! I should note this is not inclusive of workout locations. Those are a bit different as they are stored as separate records, one for latitude and one for longitude. In the future I might attempt to pair these up for KMZ support.

iOS Location Mapping with APOLLO Part 1: I Know Where You Were Today, Yesterday, Last Month, and Years Ago!

I added preliminary KMZ (zipped KML) support toAPOLLO. If anyAPOLLOmodule's SQL query has "Location" in its Activity field, it will extract the location coordinates in the column "Coordinates" as long as they are in Latitude, Longitude format (ie: 38, -77). These are more a less an upgrade/replacement from my previous iOS location scripts. (FYI: Those will not likely be updated further.)

A Threat Intelligence Script for Qualitative Analysis of Passwords Artifacts

The Verizon Data Breach Report has consistently said, over the years, passwords are a big part of breach compromises. Dr. Lori Cranor, and her team, at CMU has done extensive research on how to choose the best password policies verses usability. In addition, Alison Nixon's research describes techniques to determine valid password of an organization … Continue reading A Threat Intelligence Script for Qualitative Analysis of Passwords Artifacts