Mobile Part 5
Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »
Video Transcription
00:00
>> Hey, everyone. Welcome back to the course.
00:00
In the last video, we wrapped up
00:00
our discussion on Android devices.
00:00
In this video, we're going to talk about iOS devices.
00:00
So our iOS architecture,
00:00
we have our Core OS layer,
00:00
things like your Bluetooth,
00:00
external accessories, or core services layer,
00:00
things like the iCloud, in-app purchases, SQLite.
00:00
Media layer, as the name implies,
00:00
things like our graphics,
00:00
audio, or video files.
00:00
Then our Cocoa Touch, your storyboard,
00:00
documents, and then things
00:00
like our notifications as well.
00:00
You'll just want to understand
00:00
these different components of
00:00
the iOS architecture for the exam.
00:00
The iOS boot process,
00:00
the normal boot process,
00:00
we're going to visualize
00:00
some components and then also check
00:00
signatures of the lower level bootloader or the LLB.
00:00
Then we move into the LOB where that's
00:00
loaded and then check the signature of the iBoot,
00:00
which is a stage 2 bootloader.
00:00
Then the iBoot is loaded and checks
00:00
a kernel and also the device tree signatures.
00:00
Then from there we move into
00:00
the kernel and the device tree is being
00:00
loaded and then the kernel checks
00:00
the signature of all user applications.
00:00
Now if we launch this in DFU,
00:00
which we'll talk about in just a little bit.
00:00
But if we launch it in DFU,
00:00
then we have the BootROM, then iBSS, and then iBEC.
00:00
Then the kernel and RamDisk.
00:00
We eliminate the iBoot in that process.
00:00
What is DFU mode?
00:00
Well, this is a mode called Device Firmware Upgrade.
00:00
This allows your device to be restored from any state,
00:00
not like a normal restore.
00:00
This is like allowing us to restore it from any state.
00:00
As an investigator, this is a good tool for
00:00
users to get information from the device.
00:00
Disk Image of iPhone with SSH,
00:00
number 1, it has to be jailbroken.
00:00
The iOS phone has to be jailbroken.
00:00
Then this allows us to get an image
00:00
of the whole disk of the phone.
00:00
Similar to the dd command
00:00
that we talked about earlier in this course,
00:00
similar to that command.
00:00
Again, to get that bit by bit copy.
00:00
One way we can bypass,
00:00
but bypass an iPhone passcode
00:00
is using a tool called iExplorer.
00:00
Just remember that for your exam.
00:00
If you need to bypass an iPhone passcode
00:00
and you see iExplorer,
00:00
that's probably the answer.
00:00
iOS rooting, you'll notice a difference here of
00:00
where android devices pretty
00:00
much always said, "Root in the name."
00:00
You'll see iOS rooting
00:00
or jailbreaking tools have a lot of different names.
00:00
That's why I mentioned with the Android 1 is
00:00
just kind of remember that Android is root.
00:00
That way it'll help you if you see
00:00
other answers or if you get
00:00
a question asking about, for example,
00:00
iOS devices and jailbreaking them,
00:00
you'll know that like any answer
00:00
listed that has root is probably not the right answer.
00:00
So just keep that in mind,
00:00
that really will help you on
00:00
the exam just in case it's asked.
00:00
Different tools we can use for
00:00
iOS jailbreaking are going
00:00
to be things like Pangu jailbreak,
00:00
Redsnow, GeekSnow, and SnowBreeze.
00:00
SIM cloning, if we want to clone
00:00
a SIM card on any device,
00:00
we can use a tool called
00:00
MOBILedit and remember that for your exam.
00:00
That'll allow us to get a logical acquisition.
00:00
Then we can also use oxygen forensic suite to
00:00
grab a physical and file system acquisition as well.
00:00
Cellular network components are
00:00
specific to iOS, but I want to mention them.
00:00
We have things like our CDMA or EDGE or iDEN.
00:00
Also the general packet radio service,
00:00
global system for mobile communications,
00:00
or time division for multiple access.
00:00
Again, just some different components.
00:00
You probably don't need to know
00:00
these for the exam itself,
00:00
I just wanted to mention them as
00:00
more as of a just-in-case type of thing.
00:00
Again, not specific to iOS devices,
00:00
but are things that you may possibly see on the exam.
00:00
Just a quick few post-assessment questions here.
00:00
Number 1, the iExplorer tool can
00:00
be used to bypass an iPhone's passcode,
00:00
is that going to be true or false?
00:00
That one's true. We talked about that
00:00
that tool is one that you can use
00:00
to bypass the passcode on an iOS device.
00:00
Again, just remember that for your exam.
00:00
Our next question, Redsnow
00:00
is used for root Android phones,
00:00
is that going to be true or false?
00:00
All right, that one's false.
00:00
If you remember that most Android jailbreaking tools
00:00
are going to be labeling as root in the name.
00:00
Redsnow is actually for iOS devices.
00:00
All right, in this module we talked about
00:00
different iOS device information
00:00
as well as some different information about
00:00
cellular networks in general.
00:00
In the next module, we're going to cover reporting.
00:00
That will actually be our last module of the course
Up Next
Instructed By
Similar Content
