Investigating PTTPoC Communication Equipment and Smart Device Apps: A Digital Forensic Approach

Since Guglielmo Marconi's 1895 radio connection there has been a significant shift in propertied radio equipment from analog to digital. Digital radio equipment are two-way radios having features like address books, short message services, call logs, GPS, and telemetry. These days, telemetry applications include detecting and sending data from sensors in cars, smart meters, power supplies, Internet of Things wildlife, robotics, and many other areas. Push-to-talk over Cellular has revolutionized far-flung conversation by delivering swift talk across cellular towers, doing away with the need for individual radios [1]. Ever since its beginning in 1987 with Nextel's iDEN system, PoC has undergone considerable advancement, exploiting 3G and LTE innovations to craft a broadly extended worldwide radio infrastructure. PoC now empowers individuals across industries, whether coordinating emergency responses or collaborating on energy line installations, uniting dispersed teammates through pocket-sized devices connected to the mobile network [2].

Push-to-Talk Over Cellular (PoC) integrates smartphone technology and the fundamental PTT idea into one unit. To get beyond traditional PTT's limited coverage, users can use PoC to take advantage of the half-duplex communication mode for 2-way connectivity via 3G, 4G, or WiFi networks. PoC technology improves communication efficiency by leveraging cellular networks, offering a broader and more reliable reach compared to traditional radio-based systems. The global push-to-talk over cellular market, valued at 5.1 billion USD in 2023 is predicted to grow to 10.6 billion USD by 2032, at an 8.2% CAGR. Factors driving this growth include remote working adoption, emergencies, and cross-platform compatibility [3, 4].

Key benefits

• Provides real-time communication for quick response times and efficient team coordination.
• Incorporates end-to-end encryption for privacy and security in workplaces.
• Enables sharing of location and media files for precise information and visuals.

With a number of benefits this technology is also posing a threat to compromise the cause of compromising this technology owing to the vulnerabilities present in the communication ecosystem the descriptions of various vulnerabilities in PTTPoC system are:

1. Weak Authentication and Authorization

The initial layers of protection against unwanted access are authorization and authentication of the stored as well as in transit data sets. Insufficient authentication techniques including weak passwords or no multi-factor authentication (MFA) techniques expose the system to fraudsters who can pretend as authorized users. In such cases, attackers/fraudsters/hackers may gain confidential messages, personal information, or create system disruptions if sufficient authorization checks are not in place.

2. Insecure APIs

APIs enable PTTPoC systems to communicate with backend servers and internal storage repository of the devices. If these APIs are vulnerable, attackers can use this vulnerable APIs to gain unwanted access of device data and services.

3. Lack of End-to-End Encryption (E2EE)

End-to-end encryption ensures that messages are only readable by the intended receiver and prevents interception or tampering. If PTTPoC interactions are only encrypted during transmission rather than end-to-end, attackers with network access may be able to intercept the discussions.

4. Man-in-the-Middle (MITM) Attack

A Man-in-the-Middle (MITM) attack is the type of attack in which an attacker intercepts and modifies communication between two parties (sender & receiver). This may occur if communication certificates of the devices are not checked or messages are not adequately secured which allows a hacker to intercept or insert harmful content into discussions.

5. Vulnerabilities in the Underlying Network Infrastructure

PTTPoC services are dependent on cellular networks and related infrastructure. The weaknesses/loopholes in the cellular network such as SIM Swapping, SIM card cloning or vulnerabilities in mobile communication netwok could allow attackers to intercept the PTTPoC connection or reroute connections to take over the ongoing cellular sessions.

6. Denial of Service (DoS) & Distributed Denial of Service (DDoS) Attacks

DoS & DDoS attack attempts to disrupt the available PTTPoC services by flooding it with false traffic or requests. A successful DoS & DDoS attack on PTTPoC systems would prevent users from utilizing the service which impact the operations and communication of the service provider.

7. Vulnerabilities in the PTTPoC Client App

The PTTPoC communication mobile applications build for various mobile OS i.e Android, iOS, Symbian etc. can potentially have security weaknesses which expose it to intrusions. With the usage of such vulnerabilities can permit the attacker for unauthorized access to the functionality of the application installed within the mobile OS.

8.  Lack of Patch Management

In order to achieve smooth channel communications and interconnectivities, PTTPoC systems are dependent on external software or libraries. The attackers might exploit known vulnerabilities if particular components from this software and libraries are not patched and updated regularly. If patch management is overlooked, the old software may vulnerable to attack the system.

When it comes to radio technology, such as software-defined radio (SDR), packet radio, digital mobile radio, HF, VHF, and UHF transceivers, law enforcement agencies have limited investigative experience. Since radio equipment had minimal forensic value in the past this did not usually pose an issue. On the other hand, modern systems use a range of digital technologies, including GPS, computing & programming, digital speech and data channels, and more. Email, chat, location monitoring, and telemetry are examples of data communication methods that are feasible and have demonstrated potential for use in vehicle communication for some time. Furthermore, telecom operators and radio equipment rental companies across the globe provide PTT services. Radio communication equipment is transitioning from analog to digital devices, with features like call logs and GPS. This shift is gaining popularity in telemetry applications and for controlling data. However, there is limited literature on digital radio communication equipment. Law enforcement faces challenges in keeping up with new technologies and digital evidence backlogs, but there is limited research on digital forensic traces in radio communication devices, both in literature and practice. Due to lack of investigation into digital radio communication equipment can lead to the neglect of valuable evidence, requiring further research to understand current knowledge levels, evidence sources, and methods [5].

This paper discusses forensic acquisition and analysis of radio communication equipment as well as radio communication based smart mobile OS applications evaluating popular tools for artefact acquisition, and proposing a workflow for investigation.

Radio communication equipment, such as HF transceivers, linked devices, and computer programs, can include important digital forensic traces. Radio repeaters are primarily receivers that transmit the received payload on another frequency. Portable and mobile two-way radios can contain configuration data, call logs, and message logs, which can be analyzed using the customer program software (CPS) application. Accessories like remote speakers/microphones or Bluetooth devices can also contain valuable digital traces. An involvement in a crime scene may be revealed by remote PTT buttons that pair with a smartphone or two-way radio via Bluetooth.

Mobile device and application forensics are a mature research area, but challenges persist due to rapid advancements and the wide range of mobile devices. Data acquisition from mobile devices remains a key operational and research challenge, especially when data-at-rest and data-in-transit encryption solutions are not supported by existing commercial tools [10].

3.1 Forensic investigation acquisition & analysis process

The Lowrance LHR 80I is a portable radio VHF/GPS with both analogue and digital radio capabilities. It was tested using the Customer Programming Software (CPS) version V7.06.02.006 on a clean virtual Windows machine. This cutting-edge software is intended to improve the communication experience by allowing easy programming and customization on Motorola devices. The radio's antenna was removed to prevent remote disabling and the transceiver was active on channel RPTR-1_TG9.2 in zone RePeaTeR-1. The code plug file, Lowrance LHR 80I.rcdx, was read-only and saved. It was possible to retrieve the radio's unique components, including its make and model, serial number, frequency range that has been used, radio alias, and Radio ID. The analysis report revealed the anonymous Radio-ID and Radio-Alias [10, 11].

In Figure 3, the procedure for acquiring and extracting processes pertaining to the radiomodules is illustrated. The diagram encompasses the entire forensic process lifecycle beginning from acquisition to the subsequent analysis. beginning from acquisition to the subsequent analysis.

3.png

Figure 3. Flowchart data acquisition of Radio Modules

3.2 Smartphone push-to-talk application

Data acquisition involves cloning and copying digital data from mobile devices. Traditional methods, such as manual extraction, logical acquisition, physical acquisition, and chip-off, are considered insufficient due to the security revolution in mobile devices. Logical acquisition is a method that extracts bit-by-bit copies of logical storage objects from their allocated space but it cannot access slack spaces. It works best on unrooted & jail broken mobile phones. Physical acquisition involves creating bit-by-bit copies of physical storage. Professional forensic examiners can use hardware-based data acquisition methods like JTAG and CHIP-Off, which can result in damaged chips [11]. Software-based acquisition doesn't cause physical harm to the device, but requires file system privilege to access the data sets.

4.png

Figure 4. Flowchart for 3rd party data acquisition in mobile forensics

3.3 Other possible traces

Investigating radio communication devices may require additional sources beyond the scope of this paper. Provider agencies may keep records of frequency users, real-time radio signals, and dispatch equipment, which may include call logs, text messages, GPS data, or recorded voice as shown in Figure 4. These additional sources can provide valuable insights into potential users and their activities. Recorded voice and data from mobile radio networks can be valuable for investigation, but may have a short retention time. Many countries use a one-week retention time, while service provider system has log files on the Central Message Servers (CMS). PTT applications like zello, voxer etc can also provide valuable logs. Digital radio devices use Radio-IDs for communication, and Ham-radio amateurs connect their repeaters to Ham DMR networks. These networks offer useful information and last-heard connections.

3.4 Analysis process

A forensic investigator examines a forensic image by searching for the app's folder name, which must be identical to its package name. If the folder exists, the investigator can examine the files in the app's folder, which typically includes sub-folders like shared_prefs, cache, files, databases, and lib. However, folders do not necessarily store a single type of evidence. Automated forensic knowledge-sharing platforms like Cellebrite UFED, Oxygen Forensic Suite, Magnet Axiom and MSAB XRY can help extract forensic artifacts from mobile devices. File formats in these folders are a better indication of potential evidence, such as XML files, web cache data, SQLite files, and standalone media files. Integrating these steps and processes is not straightforward, resulting in multiple re-iterations of the discovery process [11]. Figure 5 presents a flowchart depicting the steps involved in third-party data acquisition for mobile forensic investigations.

5.png

Figure 5. Flowchart for 3rd party data acquisition in mobile forensics

The current research in cyber forensic for the digital traces in radio communication equipment and services emphasizes the significance of understanding digital radio technology, standards, products, and user behaviour. However, there is a significant knowledge gap when it comes to extracting data from digital two-way radios using standard mobile forensic tools such as Cellebrite UFED, MSAB XRY, Oxygen Forensic Suite and Magnet Axiom as mentioned in this paper. Despite these constraints procedural flowcharts have been created to assist in the manual gathering of data from transceivers and other radio components resulting in successful data extraction from radio communication equipment. These procedures necessitate manual intervention and have scope for improvement in efficiency and automation. Radio communication devices and their infrastructure, including digital trails, settings, frequencies, and connections, are potential sources of forensic evidence that digital investigators need to search for. Advanced data access methods like APIs, JTAG, and chip-offs are necessary for modern digital radios because of their IP capabilities and proprietary restrictions.

Furthermore, in the era of smart devices, many Push-to-Talk over Cellular (PTTPoC) applications are widely used. This research paper discusses the forensic analysis of these applications, demonstrating that ample information can be extracted through traditional mobile forensics approaches using available commercial and open-source toolsets. Consequently, law enforcement digital experts must adapt to the evolving landscape of digital communication tools and continue to refine and expand their forensic techniques to effectively gather evidence from both digital two-way radios and modern PTTPoC applications.