Latest / Parsing the Truth: One Byte at a Time / How brute force & the Kik App saved a young girl

Transcript

How brute force & the Kik App saved a young girl · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky Specialty to cracking the complexities of
0:29
iPhone forensics Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time. I'm Stacy, and I'm joined by my
0:57
Co host Becky Passmore. In this episode, we're going to
1:00
walk you through a case that started with a single phone call
1:03
on a Monday morning where a 13 year old girl was missing and
1:08
there were no leads in the investigation that could help
1:11
find her. Yeah.
1:12
It was, it was really an interesting case.
1:14
So one Monday morning on my drive to work, I actually got a
1:18
call from one of our agents on the violent crime squad.
1:21
He's, you know, a great guy. I've worked with him.
1:24
I'd worked with him for a long period of time.
1:26
And he, he was calling to say, Hey, we, we got a call from a
1:31
Sheriff's Department here and they, they had a missing girl.
1:39
And it's a one of those cases where that's missing children's
1:44
case. And, you know, these are some of
1:46
the most emotional and complex cases to work at times.
1:49
So he just explained a little bit to me about the girl was
1:52
missing, not a whole lot of details.
1:54
But the Sheriff's Department didn't have any leads and they
1:57
had her devices. So the question was, could we
2:03
unlock them because they were obviously locked devices.
2:07
Right. So what kind of devices did they
2:09
have? Well, it was interesting because
2:12
it was. It was 3 devices actually, and
2:15
this was many years ago. 1 was an iPod.
2:18
An iPod it is a minute ago. A minute ago is right, it was an
2:23
Android phone and it was a some type of like a Kindle or Amazon
2:28
tablet. OK, so a few additional details
2:31
agent provided included that she was home alone with her adult
2:34
brother and the brother got a knock on the door in the early
2:39
hours of Sunday morning around 5:00 AM.
2:42
Wow. And when he.
2:43
Yeah, it was interesting. And when he answered the door,
2:45
there was just a strange man who told him his car had broken
2:48
down. It was in the driveway area and.
2:52
And then he let himself into the house and he talked to the
2:56
brother about his car and stayed in the house for a few minutes.
2:59
And then the next thing you know he left and said he would go try
3:04
to get his car to work again. And and surprisingly it it
3:09
worked. Car worked fine.
3:11
Well, if we all remember from one of the BTK episodes, I did
3:14
mention that I will not open my door unless I know you're coming
3:18
over. So you can bang on that door all
3:20
you want, ring the doorbell all you want, I ate opening my door.
3:24
Especially not at 5:00 AM. If only this guy had not opened
3:28
his door at 5:00 AM, right? I know, right?
3:31
It's weird. So where was the girl?
3:34
Why do you think this strange man knocked on the door so early
3:37
on a Sunday morning? I mean, his car broke down.
3:41
I don't know. He sounds fishy.
3:43
Kind of like a ruse situation, you know, so like I, yeah.
3:47
So I found out later that the girl was at home and she was in
3:51
her bedroom, which, you know, the agent had said that she was
3:54
in her bedroom and when this strange individual had knocked
3:57
on the door. So then the theory had suggested
4:01
that the man was using an intimidation or ruse factor to
4:05
persuade the girl to leave with him.
4:09
To provide a little bit more background on the case, the
4:11
agent stated that she had been communicating with an individual
4:16
through a Kik app and no one knew who this individual.
4:19
Was so, so many questions and comments already.
4:23
So First off, let's jump in the Wayback Machine as we do.
4:27
And if you don't remember or you're too young to know, bless
4:30
you. The Kik app was a messaging app.
4:33
It was very popular with teens at the time, but unfortunately
4:37
it became a real hot spot for predators.
4:40
So they were on there trying to get with the kids and lure them
4:44
out and that sort of stuff. It's so weird.
4:46
So she was home, but she didn't come out of her bedroom at 5:00
4:51
AM. But clearly he was trying to do
4:53
something to lure that girl out. He was coming for her because
4:58
obviously she must have shared some information with him about
5:02
where she lived through this. Kik app.
5:04
That's right. And that's the unfortunate part
5:07
about it, right? So many times we live in this
5:09
fantasy world where we're chatting on these apps and we're
5:12
communicating on everything that young kids don't realize how
5:16
much information they're sharing and predators have a way of
5:20
enticing it out of them. But the app still exists.
5:23
I looked it up. I was.
5:25
Never a Kik person in the past and I'm still not a kik person.
5:29
You know, I can tell you, I, I made a lot of presentations on
5:33
that Kik app to try to convince parents and students and
5:37
children to not if they're going to use it, everything can be
5:40
used in proper ways where it can be secured, right?
5:44
And so those, that was always my recommendation.
5:47
So the intimidation factor came from the guy who was much older,
5:51
in his 20s. He was just trying to get the
5:54
girl to leave with him, but she didn't want to go and he was.
5:57
Probably supposed to sneak out of the house or something I
6:00
imagine, which is why he was still like stuck around there at
6:03
5:00 AM. That's right.
6:05
And because she wouldn't leave, he claimed he would hurt her
6:08
family, including her brother. And he and the And the guy knew
6:13
her brother was home right at that time.
6:15
Sure. So to show he was serious, he
6:18
knocked on the door and started talking to the brother, which
6:21
led her to leave through the bedroom window.
6:24
OK, OK. It's coming together a little
6:26
bit. Right.
6:27
So, but, but she left all of her devices behind.
6:30
Unfortunately, no one knew her passwords.
6:33
All of those devices were locked.
6:35
And then sometime Sunday morning, the brother discovered
6:38
the girl was missing and then contacted authorities.
6:42
Well, ultimately one of the special agents got a call from
6:45
the Sheriff's Office to see if you would be able to help out.
6:48
Yes, because they had nothing as far as any leads goes, but they
6:53
had no way the Sheriff's Department had no way of even
6:57
trying to unlock these devices. So I was I just told the agent,
7:01
hey, bring them to the office so that we could take a look at
7:04
them. We have to determine if we can
7:07
assist by seeing what the devices, what kind of devices
7:10
make, model, serial number they are.
7:12
And then, you know, Stacy, even though there are tools out there
7:16
even back then that say they can access devices, it was just as
7:22
hard back then as it is today. You know, just because there's a
7:25
device and it's a make and it's a model and it's serial number
7:29
doesn't mean you can connect to the tools that are available
7:33
today or back then to extract it.
7:36
Yeah, I remember we'd go to the celebrate first, but because
7:41
that was supposed to get them all, but it never did.
7:43
And especially once you got into like androids and stuff like
7:46
that. And I feel that we had, in
7:48
addition to this celebrate, there was like 5 different
7:51
software packages we had available in the FBI and you
7:54
would run through them all and nothing worked.
7:56
And you'd like, sometimes it was just a matter of like, try, try,
7:59
try again. And then maybe it would work.
8:01
And you run through them all and, and sometimes you still
8:04
never got nothing. And you're like, I just tried
8:06
all these tools. Why is it so hard to get the
8:09
data off of the cell phone? And then you end up having to go
8:12
through it by hand and taking pictures of everything you're
8:16
doing, of every single message. It was, it was such a pain.
8:19
That's right. And if if you could get the
8:22
device unlocked right? Yeah, that's the first.
8:24
Step right, right. So once we received the devices,
8:28
we realized it was going to it was going to be a big challenge.
8:31
You know, none of the current tools that we had, we used on a
8:35
daily basis even had a capability of unlocking these
8:38
devices. And, and the challenge was, what
8:41
do we do? Because we have a missing girl,
8:45
right. No leads, strange man knocking
8:49
on the door. He has a description of the man,
8:51
but not of the vehicle. So it was, it was really, it
8:55
was, it was, it was a challenging situation.
8:58
Yeah. And that must have been so
8:59
frustrating because you feel like you're so close, you've got
9:02
the devices, the answers, or at least some really big clues are
9:05
probably inside, but you can't get to them.
9:08
No. And and that is the frustrating
9:10
part. You're holding a device in your
9:12
hand and you're like, how am I going to get the data off of
9:14
this? I know that answers are right
9:16
here in front of me now, but luckily as a cart coordinator
9:21
back then I had just purchased a few testing tools and one of
9:31
them was called an IP box and then the other was called an MFC
9:37
dongle. So did you ever experience using
9:40
any of those? Tools.
9:41
I did not use either one of these tools in the past, and
9:44
this is kind of one of my favorite parts.
9:46
And I hope the listeners like this too because I think we're
9:49
all fascinated by the tools we use to get the job done.
9:53
So Becky, tell us more. What is this IP box First off?
9:57
It was a little device. I'm going to describe it just
10:02
like it sounds. It looks like 2 cables connected
10:07
to A to to the iPod and, and, and it would it's a brute force
10:14
device. And so you hook it up to the
10:16
iPod or or even an iPhone and then it tries every single
10:20
possible passcode until it finds the right one.
10:23
The only the only thing was that it would error out so you would
10:28
have to do a reset so it would continue and it would error out
10:31
so you would have to do a. So I carried it home.
10:34
So was. It a routine, it would do it 100
10:36
times and then it would error out.
10:38
Or was it completely random? It was completely random, there
10:41
was no specific time, so I carried it home in this box,
10:46
these wires attached to this little device attached to this
10:50
iPod, and every time it would beep, I would reset it and it's
10:55
slept. I slept next to it at night that
10:57
night so that I could reset it every single time.
11:00
This is the. Crazy stuff we do.
11:02
I do crap like this today on actual cases.
11:06
I was somewhere on site, kind of like at a hotel.
11:10
We had to get all these phones done in a short amount of time
11:14
and so it's babysitting the extraction overnight.
11:17
I wake up, is it still going? Did it crap out?
11:20
Do I have to restart it? Can I start the next phone?
11:23
It's a tireless job. And by tireless, I mean super.
11:27
Exhausting, right? And I always say 80%
11:31
troubleshooting, 20% work. Yeah, it was challenging.
11:36
So there is some risk to trying to use a tool like this with an
11:42
iPhone and probably an iPod. Yeah, and we knew that risk, you
11:46
know, if the device is set to wipe after 10 failed attempts,
11:53
we could lose everything. So I called management, I
11:57
explained that risk and we got approval to try it.
12:00
I did ask the agent, are we certain that the Sheriff's
12:07
Department attempted to unlock this device already 10
12:12
different, you know, 10 times, right?
12:15
And the agent said yes. And I said, OK, we're good.
12:19
And I don't remember back then, did it give you the countdown
12:22
like you have 9 more attempts or or did it just count the other
12:26
way and say you've had five failed attempts, 6 failed
12:28
attempts, Do you remember? I think at one point I remember
12:32
that it did you have you have so many failed attempts, 5 failed
12:37
attempts, 6 failed attempts, but it never said this is your last
12:42
failed attempt on the 10th 1:00 and then your device wiped.
12:45
It just kind of was like 10th failed attempt and then it it
12:50
wiped. And so did you start with the
12:52
iPhone or the iPod? So we only had an iPod and an
12:56
Android phone. And that's right, right?
12:58
And the Android phone was one of those.
13:02
Huawei Huawei's don't. Feel bad, I only learned it was
13:07
Huawei this year so. I've always called it who Wawa.
13:11
I've probably called it a lot of different things, but it was a,
13:14
it was a Wawa, whatever we call it.
13:16
Huawei Wawa is the gas station. Huawei is the phone.
13:22
That's exactly right. So we, we'd already, we had
13:26
already investigated that one and there were no tools,
13:29
nothing. We had nothing in our toolbox
13:31
that we could get into that device with.
13:34
And the Kindle, Amazon tablet, it didn't store enough data.
13:38
So we knew that the iPod was the key, especially since the.
13:46
Well, not the iPod. The Android phone would have
13:48
been the. Key.
13:49
The iPod was our key. The iPod was the key.
13:52
Yeah, really we. Hooked up to that IP box.
13:54
Absolutely. OK, yeah, and we brute forced it
13:58
with that IP box and it never unlocked.
14:01
It OK yeah cuz I would have started with the iPod too
14:04
thinking if we if we accidentally wipe this we'll
14:09
probably lose the least amount of data.
14:12
But if we can get in, it might give us a pin code that we can
14:15
reuse on the other devices. Right, that's exactly right.
14:19
But unfortunately we didn't get into the iPod or we had no tools
14:24
to get into the Android device, even after I babysat that device
14:29
all night long, resetting it every time and it never
14:33
unlocked. That is so frustrating.
14:35
So after a sleepless night, you're back in the office
14:38
Tuesday. You're tired, needing a lot of
14:41
caffeine. There's no progress.
14:44
What happens next? We said, well, if this tool
14:47
doesn't work, let's try the MFC dongle, which was another tool
14:52
for bypassing iOS passcodes. It was set up by my colleague
14:57
and we started babysitting it in the lab that morning.
15:00
So another agent that was helping out with the case, he
15:04
came by the office a couple hours after we got it started
15:09
and he just came down to the lab.
15:10
They used to do that routinely, just come down to the lab and
15:13
see what what's going on and what's going on because we have
15:17
nothing else better to do than stand around and answer
15:20
questions about what we're doing.
15:22
But he's also like many other agents and investigators, they
15:26
stand over computer forensic examiners and they say, how much
15:29
longer can we go faster? When's it going to be done?
15:32
But he didn't really say much. He was just observing, looking
15:35
over the equipment and then the device.
15:38
And while it's going through, it's, you know, processes of
15:42
bypassing or brute force code entry.
15:46
Whatever that digital forensics magic is.
15:48
And it is sometimes magic and then BAM, it just completely
15:52
unlocked it. And he calmly said, and, and
15:55
this agent is just as calm as ever.
15:58
He said, I think this device just unlocked.
16:00
And I was like, he said, what? And I jumped up from one end of
16:04
the lab and ran to the device. And my colleagues jumped up from
16:07
the other areas of the lab and ran to the device.
16:10
And we just kind of like scooted him out of the way and, and we
16:15
grabbed it and we're like, let us do our job.
16:19
Awesome. So incredible that you got into
16:22
that device, especially with the first unsuccessful sleepless
16:26
night of not getting in. Right, exactly.
16:29
And here we are. You know, I still remember that
16:32
feeling like it was yesterday. You know, it just is.
16:35
It's just an overwhelming feeling.
16:37
When you finally get into a device, you know you're going to
16:40
get a lead from this. You know that it's going to take
16:43
you somewhere. So we all jumped into action and
16:45
started working simultaneously to get that data.
16:49
So I disabled the passcode on the device and I connected it
16:53
to. Thinking yeah, yeah.
16:56
Because did the device tell you what it was or it just simply
17:00
unlocked it? It unlocked it, but the MFC
17:03
dongle logged the code. OK, so my partner took that MFC
17:08
dongle. Yep.
17:09
And he plugged it into his computer and read the log and I
17:13
went into the device and unlocked it so it wouldn't lock
17:16
back. Sure.
17:17
And then another colleague of ours, he just was starting to
17:21
take notes of everything that was going on in the lab.
17:23
You're doing an extraction, you're doing a log collection.
17:26
Like, it was just funny. And so the three of us are
17:29
working simultaneously on that, on the effort and yeah, and the
17:34
agents are standing around like, what do I do?
17:36
He's observing the organized chaos in the CART lab, which is
17:41
the standard operating procedure in the FBI.
17:44
That's exactly right. That is so true.
17:47
So true. It was all happening while he
17:49
was just standing there. So in fact, my colleague that
17:52
took the reporting of the device and started taking the note,
17:55
starting taking notes, I just started doing this extraction
17:58
and and trying to get the data off the phone as quickly as
18:02
possible. OK, so it sounds like we're
18:04
finally at a turning point. What did you find?
18:07
I'm dying to know, and so is everybody else.
18:10
Tell us more, Becky. Yeah.
18:12
So once the device completed with the extraction, which was
18:16
really quick for you know, most devices, I was actually
18:21
surprised. I just went back to the the last
18:24
conversation in Kik, which I was able to to obtain the girl
18:30
having a conversation with we're going to call him the suspect
18:34
now. OK, so this provided us a
18:38
username for him. So I announced the username in
18:41
the lab and my colleague who was sitting at his computer
18:44
immediately Googled that username.
18:46
OK. And when he did so, he was able
18:49
to find the name, address and location.
18:54
So one of our examiners ran it. Yeah, yeah, I mean, absolutely.
18:59
And and it gave it was linked to multiple accounts with the name
19:05
and phone number and address, all in Texas.
19:09
So it's looking pretty legit. Like it wasn't just one thing.
19:14
It was like many accounts and it was all sort of consistent.
19:18
Absolutely and gotcha it was linking up to all these
19:22
different accounts same name, same address, same location in
19:26
Texas so so you must remember now we.
19:29
Should tell people you were in Arkansas, not that's right.
19:33
We were in Arkansas. You also have to remember that
19:35
we are now on Tuesday morning. It's about between 10:00 and
19:39
11:00 in the morning, right? And we know that this girl went
19:44
missing sometime Sunday morning. So it has been clearly longer
19:49
than 48 hours and right, And everyone in this situation was
19:52
desperate to just get one lead on this investigation.
19:56
So the agent who was still standing in our lab was
19:58
speechless. He was extremely motivated by
20:02
what he just witnessed and off he went.
20:04
Great, great. He So he went off to to take the
20:07
awesome lead you had just found out to everyone else and make
20:11
them do stuff. He did I.
20:13
It was really awesome because he was like, I can't believe this
20:17
just happened. So we were able to give this
20:20
information to the case agent who then started working, the
20:24
lead from his role and the original agent who had contacted
20:28
me. And this agent started
20:29
contacting the Sheriff's Office here in Arkansas and then
20:33
working with analysts to find out more information about this
20:35
subject. Once the agent contacted the
20:38
Sheriff's Office, that investigator at the Sheriff's
20:40
Office then contacted the local Sheriff's Office in Texas and
20:45
asked him to do a welfare check. So the welfare check was done in
20:49
an effort to identify if the young girl was at that
20:52
residence. Gotcha.
20:54
So what did they find when they went to that address in Texas?
20:58
They found the missing. Girl, amazing.
21:00
Amazing. 13 years old and she was rescued safely and the 25
21:04
year old man who was holding her was arrested.
21:07
It was a relief for everyone just to be able to find this
21:10
missing girl when there was absolutely no leads to go on.
21:15
Our team was able to persevere and unlock one of these devices
21:21
that provided the lead to find her.
21:24
It just gives me pills for so many reasons because you've got
21:28
nothing but locked devices. And then you go in there and I
21:32
was thinking maybe you could find her because he was like,
21:35
you need to come over to my place.
21:37
Or he's telling her where he lives.
21:39
But you figured out whom and where this person was just by
21:43
his user information on the the Kik app.
21:47
So this is amazing. You go from a locked a locked
21:50
iPod to saving a life. Amazing.
21:53
Let's let's let's just unpack this for a minute for our
21:56
listeners and find out what the big lessons for investigators,
21:59
even parents and everyone should take away from this case.
22:03
So for investigators, we need them to always be prepared.
22:06
Don't be afraid to try new tools.
22:08
Not. And don't be afraid to ask if
22:11
there are new tools out there. Do research if you need to find
22:14
a new way possible just to be able to keep up with these new
22:17
tools, or find a new way to use tools and you just never know
22:21
when you'll need them. Persistence is the key, and when
22:25
one method fails, keep pushing and understand the technology
22:30
well enough to make smart calculated decisions under
22:33
pressure. When we're talking about trying
22:35
new tools, we don't necessarily try them as the first thing
22:39
right out of the gate. You know, we've got to start
22:42
with that conservative approach. So we start with the things that
22:46
we've tested and validated that we know work well.
22:49
And then we try to go through all that stuff.
22:51
We try, try, try again, because that's just how cell phones and
22:54
some devices work. But then if ultimately you're
22:56
not in to your point, you just had some new tools, you
22:59
evaluated the risk, the pros and cons and decided, you know,
23:03
we're going to take this chance, we're going to try this and, and
23:05
see what we can get. And you were successful in this
23:09
case, but you just didn't approach it like, cool, new toy,
23:12
I want to do this. You know, the Sheriff's Office
23:15
had already tried a lot of stuff to get into the phone.
23:17
That's right. Or then the iPod and the other
23:20
devices. And that's right.
23:22
We still have to follow our same methodologies, our processes,
23:25
our procedures. You know, even though someone
23:29
has been arrested in this case, it's still has to follow the,
23:35
you know, the standard evidence best practices.
23:37
Yep, absolutely. And one of the takeaways for the
23:40
parents is to be actively aware regarding the apps that your
23:46
kids are using on their devices. Now, Kik probably isn't relevant
23:50
for your kids today, but there's tons of other devices, or excuse
23:55
me, there's tons of other apps. People seem to be moving away
23:59
from your standard text messaging apps.
24:01
And so they're going to be using a wide variety of apps.
24:05
And the predators will always migrate to wherever the kids are
24:10
communicating online because they'll eventually figure it out
24:14
and they go there and there's all sorts of interesting crazy
24:17
things happening all the time. I'm in a few different groups on
24:21
Facebook and things like that where parents are talking about
24:23
their kids and technology and how to manage it and what to do.
24:28
But then they also talk about the horrible things that have
24:32
happened to their children. They also talk about how the
24:34
kids are getting around all of these parental controls.
24:38
And so in my opinion, one of the biggest things you can do for
24:41
your children, with your children is to have those
24:45
conversations as hard and awkward and as difficult as they
24:49
are with your children, about what apps are you using, who are
24:53
you talking to? And even the dangers of online
24:57
safety. And I know at school they talk
24:59
about that to the children. But it's still, I think a great
25:04
idea for you as a parent to try to work in those conversations
25:08
with your children beforehand and in the non adversarial
25:12
manner. So that way when something bad
25:15
has happened, you're not trying to have that conversation while
25:18
you're trying to keep yourself from exploding and freaking out.
25:21
I agree. I agree 100%.
25:24
In this case is proof that technology can be both the risk
25:28
and the solution for us sent. So I'm still very curious about
25:32
the case. Did you find out any more
25:35
details? Because sometimes we don't, they
25:37
just run away and do stuff. But did you figure out anything
25:41
more about why this happened or how it happened?
25:44
Yeah. And that was the that was the
25:47
best part about working in small field office.
25:50
Was that you knew the agents very closely and, and so they
25:54
would share the details about the case and they were always
25:57
very grateful for our, our work, whether we, we were just trying
26:02
to unlock a device or we were going out on searches with them
26:05
or we were just putting some analysis together for this case.
26:09
The reason she went with him was to protect her family and his
26:13
plans, I did find out, were to put her into human trafficking,
26:18
where a lot of these cases sometimes end up.
26:21
So we literally were able to save her from that situation.
26:24
It's very scary, but I'm thankful that you babysat that
26:29
iPod all night and switched to another tool the next day and
26:33
you just didn't call it one and done.
26:34
You didn't give up. Yeah, absolutely.
26:36
And, and in the end, because of quick action, persistence, a
26:40
little creativity, a child made it home safely.
26:44
And that's what digital, that's why digital forensic matters.
26:48
It's not just about the technology, it's definitely
26:51
about the people. And you know, I had an amazing
26:54
team. We worked, we all worked so well
26:56
together. And it just, you know, this was
26:59
a high 5 situation for us. Anyway, thank you all for
27:03
joining us on this episode of Parsing the Truth one bite at a
27:06
time. Until next time, stay safe, stay
27:09
sharp, and as always, keep parsing the truth one bite at a
27:13
time. If you enjoyed this episode,
27:16
make sure to follow us to get notified the next time a new
27:20
episode drops. If you can do more, head on over
27:24
to parsingthetruth.com and donate by clicking on the donate
27:28
button. Parsing the Truth is a nonprofit
27:30
organization and we are raising money to send a new digital
27:33
forensic examiner to I Asus training next year in Orlando.
27:38
Thanks.