 Mobile device forensics & digital investigationMonthly report n⁰30 - 2024-08https://pts-project.org/blog/monthly-report-n30-2024-08/Project overviewPiRogue Tool Suite (PTS) provides a platform combining analysis tools, knowledge management, incident response management and artifact management, which allows NGOs with limited resources to equip themselves at a low cost. The project consists of an open-source tool suite that provides a comprehensive mobile device forensics and digital investigation platform.
📢 Announcements
🎉 Impacts and resultsEvidence collection: By integrating SingleFile browser extension with Colander, we’ve streamlined the process of collecting and organizing online content. When released, investigators will be able to push unsorted content for later sorting and distribution within Colander. PiRogue virtualization: Our efforts in virtualizing PiRogue have resulted in improved deployment options and enhanced security. We’ve integrated Nginx as a reverse proxy for secure access, integrated initial WireGuard support for VPN connectivity, and designed the communication protocol for remote administration. Documentation: We’ve prioritized improving our project documentation to ensure accessibility and understanding. We’ve updated information about Raspberry Pi 5 support to reflect recent enhancements and documented limitations of Suricata support. Maintenance: We’ve focused on maintaining PiRogue’s reliability and security. We’ve improved the Colander API with new functionalities. The Colander Python client now supports metadata injection from evidence collection. Community and outreach: We’ve initiated planning for a communication strategy, including social media and outreach efforts, to enhance our communication and engagement with users. Governance: We’ve taken steps to strengthen our governance and ensure the project’s long-term sustainability. We’ve invited individuals to join our advisory committee and we are actively researching potential donors and funding models to secure future resources. 📒 Activity reportYou can find more details about the different activities in the project roadmap. 📦 US4 - Evidence collection #22Efforts will be directed towards the extraction and preservation of artifacts and evidence, particularly those extracted from online content and mobile devices. The system will automatically archive and index various forms of online content such as photos, videos, social media posts, and web pages. Additionally, the capability of saving a watermarked capture or recording of the victim’s phone screen will be added to the PiRogue. In the context of forensic analysis, it is crucial to not only collect potential evidence of a compromise but also collect its context, such as the attack vector. As an example, retrieving and storing tweets was key in the Citizen Lab investigation on Predator, retrieving and storing WhatsApp messages in the Citizen Lab investigation on Tibetan groups being targeted. Overview of the different activitiesArchive and index online content #20This monthThe choice was made to use SingleFile as a first tool to collect content around the internet. It’s a well-supported project and can be integrated as an extension third-party library. On the Colander side, work has been done to receive such contents : a new endpoint has been introduced, working as a user ‘dropbox’. This approach offers the advantage to extend naturally to any other third-party collector tool in the future. As a first step, investigators will be able to push any kind of content, unsorted, with the SingleFile extension. As a second step, when getting back on Colander, investigators will be invited to sort and distribute evidence into corresponding cases. Next monthWe will extend the ‘dropbox’ endpoint to support direct case association as an investigation convenience. We will start the implementation of a first version of the Colander ‘dropbox’ evidence triage interface. We will try to package our first Colander browser extension with the SingleFile third-party library. ChallengesVideo content is still difficult to integrate seamlessly in the whole gathering experience. That said, we have good hopes this can be delegate to a third-party service while using our future Colander browser extension. Take a watermarked capture/recording of the phone screen #21This monthThe two commands responsible for intercepting TLS client randoms now utilize friTap. Given that friTap supports a broader range of TLS implementations compared to our initial implementation, we have decided to integrate friTap directly. We have added the dynamic generation of hooks to the commands The release of the Debian package has been postponed, more testing has to be performed before its first release. Next monthWe are planning to document and release this Debian package next month. ChallengesNone. 📦 US9 - PiRogue virtualization #35We want to provide end users with OS images and installation procedure allowing them to deploy PiRogue in a virtual environment (VM, cloud…). One of the direct implication is supporting a vast variety of configuration such as:
Overview of the different activities
ViRogue - Design and architecture #40This monthTo minimize the attack surface while exposing PiRogue services to the Internet, we have opted to use Nginx as a reverse proxy for the following types of deployment:
For Internet-exposed instances, Nginx will work in conjunction with Certbot to manage TLS termination and automate the renewal of TLS certificates issued by Let’s Encrypt. Local deployments will not support TLS. Nginx will expose only two services:
Both services will require user authentication via either a username and password or an authentication token. Users will have the capability to manage their PiRogue both locally and remotely. To ensure a consistent user experience, the same administration tool will be utilized for both local and remote administration. As part of the project roadmap, a web interface will be developed to simplify the administration and usage of the PiRogue, making it more accessible to users who are not familiar with the command line. This web interface will utilize the same administration tool as the command-line version, ensuring a seamless and consistent experience. The communication protocol between the administration daemon and the administration client will be documented and published in the pirogue-admin GitHub repository. This protocol is defined using the gRPC Interface Definition Language (IDL). Next monthNext month, we will refine the software architecture details, and document the final architecture and the technical choices. ChallengesNone. ViRogue - Debian packaging #28This monthThe initial integration of WireGuard into the The Next monthA few issues were opened to keep track of proposed improvements and cleanup, but VPN support is considered to be feature-complete already. The APPLIANCE mode needs to be extended to support as many use cases as possible. In this scenario, we expect users to deploy a Debian system on a generic machine, and we want to be able to deal with as many use cases as possible: there are multiple components that can manage the network (e.g. depending on the selected desktop environments) and we’re only support ChallengesA number of packages had been modified to fit into a ViRogue - Local and remote administration #29This monthThe Python Next monthWe will package nginx and certbot as pirogue managed dependencies. The reaming features will be implemented for the ChallengesThe more features are implemented, the more the whole development environment is tedious to deploy and test. We should find the time to think about a one-click solution to test the entire ecosystem. ViRogue - Tests #30This monthThe redesigned packages and the introduction of the Next monthThe Debian-provided Cloud image used to run tests in a virtual machine is expected to work in any QEMU/KVM-based environment, but we want to move to testing what happens with actual cloud providers. We will discuss which one(s) we want to be testing and maybe even advertise as being supported officially, and make sure everything runs fine there. ChallengesNone. 📦 US100 - Documentation #36Documenting the project is key in its usability. We are continuously documenting the different tools and features we develop and build new learning materials to facilitate skills development. This monthWe have received feedback on the project documentation and have incorporated most of the suggestions. The section on the Raspberry Pi 5 has been updated to reflect improvements in its support. We are now providing the hardware drivers that are not available on the official Debian repository. Additionally, we have documented a significant change regarding Suricata support, which is now limited to devices with more than 2.5GB of RAM. Next monthWe will continue to improve the project documentation to accurately reflect ongoing changes and updates. ChallengesNone. 📦 US101 - Maintenance #37We manufacture PiRogues to supply organizations, while taking care of its maintenance. We will include OS upgrades, improvement of the documentation and fixing bugs. Regarding Colander and Threatr, we maintain the public Colander server, upgrade dependencies, improve the documentation and fix bugs. This monthThe Colander API and the Colander Python client v1.0.4 now support querying Teams, creating Cases, and both querying and creating relationships between Entities. The Python client now supports the files Regarding the distribution of the Debian packages we maintain, we have introduced an archive keyring which is the minimal collection of PGP keys. It provides the keys that are used when signing the release of the Debian packages we publish on our PPA. Support for Raspberry Pi 5 was improved by merging the required packages in our repository and adjusting our image generation process accordingly. This means we’re back to the original situation, just like in the case of Raspberry Pi 3 and Pi 4 images: users only need official Debian and PTS repositories (no more extra Raspberry OS repository). Next monthNo further work is planned regarding Raspberry Pi 5 support. We hope to have mainline and Debian support in the next major Debian release (Debian 13 “Trixie”, scheduled mid 2025), at which point the separate, experimental image for Raspberry Pi 5 can be retired. We will continue the maintenance of all the Debian packages we maintain. ChallengesWe don’t want to stay on the same version of 📦 US102 - Community and outreach #38Given the success of events, webinars and demos with members of the civil society, NGOs and security researchers, we continue with our outreach plan. We organize trainings and demonstration sessions as well as creating spaces for the community to share feedback and request new features via our mailing list, GitHub issues or Discord server. We analyze one Android app that has received the community’s interest (ex COP28 app) per month. The application to be analyzed is chosen by the community. The analysis report is first privately shared with the community and one month later it is publicly released. We organize monthly calls open to all members of the community to share project updates and get the community’s feedback. This monthAs Khadija recently joined the team, a significant portion of the time was dedicated to help her get a better understanding of PTS intricacies, particularly focusing on Colander. We initiated the planning process for a comprehensive strategic communication plan (thinking of a content calendar, new social media platforms and new outreach plan). This plan will guide our messaging and outreach efforts to ensure continuity of regular use of social media, given that there were no dedicated resources for communication. As part of the communication activities, two work sessions were live-streamed through Twitch:
Next monthWe plan to finalize the strategic communication plan and begin its implementation. We will distribute the feedback form to current users and begin analyzing the responses. The insights gained will be used to refine our communication strategies and improve user engagement. This will inform future activities for finding new users and reaching out to new organizations to start using PTS. Two major events for us will take place next month:
More live sessions are expected, in particular around ChallengesNone. 📦 US103 - Governance #39This monthThree of the people we invited expressed an interest in joining the advisory committee. As August is a vacation month, we are hoping for more replies, positive or negative, next month. We began researching potential new donors and avenues for monetizing PTS, focusing on researching similar organizations and their funding models. This work included identifying potential strategies for planning and fundraising and monetization. Next monthWe will organize the first meeting with the members of the advisory committee. ChallengesNone. |