7 ms·
Cellebrite Claims It Can Unlock Any iPhone
- xwdv 7y agoAll you need to unlock any iPhone is a proprietary zero day flaw. Not exactly newsworthy. Their technique can vanish at any moment if it’s discovered and fixed.
- gingabriska 7y agoIs it legal to monetize zeroday like this?
- wil421 7y agoNot if you have connections and hire the right people.
- eat 7y agoWhy wouldn't it be?
- simongr3dal 7y agoBecause hacking is illegal in most jurisdictions. Exploiting probably isn't illegal, but as soon as you begin to use these exploits against other people to access their data it is illegal. So selling the exploit or performing it for clients would mean assisting someone in breaking the law. They probably aren't going to get in trouble since their clients are often government agencies themselves.
- penagwin 7y agoIt's only illegal to access a device without authorization, and they only sell to law enforcement (who presumably have a warrant or whatnot, and thus authorization) so Cellebrite themselves isn't accessing anybodies systems.
- m463 7y agoDepends on the definition. unlocking a carrier-locked phone under contract -vs- unlocking a carrier-locked phone out of contract -vs- unlocking a phone (password or fingerprint locked) -vs- unlocking a phone stolen/you don't own (hacking)
- penagwin 7y agoAccessing any computer system without authorization is that part that is generally illegal, "Hacking" itself isn't illegal, and while accessing your bosses computer while it's unlocked isn't "hacking" it's still illegal. However most countries can authorize law enforcement to access the device under various conditions (for example a warrant). So while the owner of the device doesn't authorize accessing the device, the law allows the police to access it.
- teddyh 7y ago> Because hacking is illegal in most jurisdictions. You are writing this on “Hacker News”. Maybe you should rephrase that.
- rolltiide 7y agoDepends on the client and purpose and actual action. Thinly veiled PR like this is advertisement to state agencies who will contract their work out to you. Even if it is work with a government that your own government doesn't agree with, thats when the lack of munitions regulation on exploits comes into play. So as long as your state client isn't on the OFAC list, you can take the contract.
- penagwin 7y agoMy understanding (under US law) is that accessing computer systems without authorization is illegal. However, you can totally make tools to hack your own stuff. And this company only advertises their unlocking abilities to law enforcement services, who are presumably authorized to access the device (via warrant). So the company itself isn't accessing devices without authorization, so they aren't technically "hacking anybody".
- maxaf 7y ago> law enforcement services, who are presumably authorized to access the device Cue Tony Soprano saying "warrant! WARRANT!" to his housekeeper. What are the chances that Cellebrite requires clients to supply a warrant for each device they unlock?
- penagwin 7y agoI don't think they would need to? Cellebrite sells law enforcement an on-premise method to unlock devices. At that point it's no longer Cellebrite unlocking the phones, it's Law enforcement who is unlocking the devices. Since they (at glance) only sell to law enforcement I think it's reasonable to assume that they expect their device to be used legally (they aren't selling it to @xxXRUSKI1337Hax04xXX who we all no is up to no good.) Disclaimer: My understanding is mostly of US law, the company is Israeli and I'm not familiar with Israeli law, or the laws of other countries Cellebrite contracts with, although I think this would similarly apply to most jurisdictions
- maxaf 7y agoPolice officers conducting a search of a suspect's premises must present a valid search warrant. Police officers requesting that a telecom company aid in surveillance of a suspect must present a valid search warrant. Google, despite of late being the butt of all jokes, will not cooperate with police officers unless a valid warrant is presented. Thus it follows that Cellebrite isn't somehow excluded from following the law just like all those other companies, and cannot support unlocking of iPhones or other devices without being shown a valid search warrant.
- tinus_hn 7y agoOnly if it’s running, if it’s off you need some way to fetch data you’re not supposed to be able to fetch and then brute force the key which is supposed to use very large amounts of cpu power. A flaw in the security chip would allow you to use the secret data and run the calculation on the chip, but that severely limits the amount of calculations you can do. This may very well be limited to phones which have short numeric passcodes.
- Eldt 7y agoCouldn't there theoretically be a flaw in the crypto they're using?
- octosphere 7y agoThere is a myth in the infosec community that phones, because of their tendency to be 'always on' devices; that phones are more secure/private than a standard Windows desktop machine or even a macbook machine running OSX. This is a BS concept - Phones leak data all over the place and have a higher data exhaust than a desktop computer. Unless the phone is flashed with LineageOS[0], it will phone home data to Google nonstop and beacon out its presence to hackers 24/7. To make matters worse, there is a huge fragmentation problem with Android and some phones are disallowed from updating to the latest Android version. The same goes for iOS; a user can often be locked into using the same iOS version and cant upgrade to the latest version (a huge security hole) [0] https://www.lineageos.org/ https://www.lineageos.org/
- bsamuels 7y agoApple still provides security fixes for phones as old as the iphone 5s, which was released almost 6 years ago. I don't think that's even remotely comparable to the fragmentation problems Android has where you're lucky to get even 2 years of security updates with some providers
- jstarfish 7y ago> There is a myth in the infosec community ... that phones are more secure/private than a standard Windows desktop machine This doesn't make sense on any level. What subset of the infosec community actually believes this? Teenagers hiding porn from their parents?
- deleted 7y ago[deleted]
- unstatusthequo 7y agoThis is partly why being on iOS betas might be good personal mitigation. They may not have immediate capability on any particular iOS beta. The exploit may or may not exist, or their code would need to be updated to properly handle it. So, to me, it makes sense to stay ahead of their development cycle and avoid a threat if you have a reason to think law enforcement might want your phone contents.
- consp 7y agoOr, more likely, you open yourself up to programmer error and easier-to-find exploits since the software hasn't been properly tested since you are doing that for them.
- vxNsr 7y agoOn the other hand the people developing these hacks haven't had as long to find any new vunls so you're really only potentially vulnerable to old hacks.
- jstarfish 7y agoBeta software is by nature buggy and less-tested. An aggressive update schedule leaves you vulnerable to regressions or other exploitable trivialities. We don't run beta code in production for a reason, nor should anybody whose freedom is at stake. Whether or not local LE has immediate capability, if you're wanted for capital murder and they can't break your phone the case does not stall, they ship the phone off for analysis. Cellebrite may (or may not) discover a new 0-day just for you. Your phone is more damning than being caught with a cache of munitions. A stockpile of fertilizer and blasting caps can be argued as circumstantial, but phones often contain the evidence that betray intent-- a search query, a text message, an email.
- ebg13 7y agoDoes Apple attempt to infiltrate Cellebrite with secret agents so that whatever flaws they're exploiting can be identified and fixed?
- coldcode 7y agoI guarantee Apple has access to these as soon as they appear. I also have doubts that their claims are true, since we cannot verify that it in any way.
- SigmundA 7y agoApple uses Cellebrite in their stores to help transfer phones and recover them: https://twitter.com/antisocial_eng/status/1086301416157790208 https://twitter.com/antisocial_eng/status/108630141615779020...
- gojomo 7y agoAre you sure Apple really wants them fixed ASAP? Having these outside, ostensibly-unaffiliated teams provide law enforcement with access helps prevent government/legal pressure on Apple to explicitly backdoor their systems. The ideal bit of kabuki-theater for Apple would be for Apple to always maintain a public stance of total devotion to end-user security... while reliably letting enough subtle, hard-to-find flaws linger so that a few of the most-well-resourced government-friendly agencies can run a business like this. "Everybody" wins! Indeed, I'd expect it more likely that Cellebrite & their ilk infiltrate Apple with secret agents, or in other ways obtain Apple-proprietary information, to assist their tool-building. Forbes has reported that a competitor to Cellebrite, Grayshift, includes at least one ex-Apple security engineer among its "Principals": https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/#6128308c2950 https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple...
- clubm8 7y agoI suspect these things rely on the device not being powered up when seized.
- wmf 7y agoHow does that help?
- novok 7y agoEven if this is fixed, law enforcement just has to capture a device and wait until someone creates a security exploit for the new version. They might wait a couple of years, but either way, you can't treat your devices as eternally safe encryption vaults.
- henryfjordan 7y agoMaybe we should put a sort of dead-man's switch in these things? Delete everything if the phone hasn't been unlocked in 3 months?
- modsiw 7y agoThat requires execution. The adversary can prevent execution.
- dang 7y agohttps://news.ycombinator.com/item?id=20193808 https://news.ycombinator.com/item?id=20193808