Ubiquity Forensics: Your iCloud and You

Architecture and Background

Ubiquity or "Everything, Everywhere” - Apple uses this term describe iCloud related items and its availability across all devices. iCloud enables us to have our data synced with every Mac, iPhone, iPad, PC as well as accessible with your handy web browser.

Vulnerability Analysis

You can access your email, documents, contacts, browsing history, notes, keychains, photos, and more all with just a click of the mouse or a tap of the finger - on any device, all synced within seconds. Much of this data gets cached on your devices, this presentation will explore the forensic artifacts related to this cached data.

Exploitation and Demonstrations

Where is the data stored; how to look at it; how is it synced; and what other sensitive information can be found that you may not have known existed! Sarah is an digital forensic analyst who has worked with various federal law enforcement agencies.

Remediation and Defensive Strategies

She has performed a variety of investigations including computer intrusions, criminal, counter intelligence, counter-narcotic, and counter terrorism. Sarah's research and analytical interests include Mac forensics, mobile device forensics, digital profiling, and malware reverse engineering. Sarah has presented at many industry conferences including; Shmoocon, CEIC, various Bsides, DEF CON, and the SANS DFIR Summit. Sarah is author and instructor of the SANS Mac Forensic Analysis Course - FOR518.