9 ms·

Is it legal to monetize zeroday like this?

by gingabriska 7y ago

wil421 7y ago
Not if you have connections and hire the right people.
eat 7y ago
Why wouldn't it be?
- simongr3dal 7y ago
  Because hacking is illegal in most jurisdictions. Exploiting probably isn't illegal, but as soon as you begin to use these exploits against other people to access their data it is illegal. So selling the exploit or performing it for clients would mean assisting someone in breaking the law. They probably aren't going to get in trouble since their clients are often government agencies themselves.
  - penagwin 7y ago
    It's only illegal to access a device without authorization, and they only sell to law enforcement (who presumably have a warrant or whatnot, and thus authorization) so Cellebrite themselves isn't accessing anybodies systems.
  - m463 7y ago
    Depends on the definition. unlocking a carrier-locked phone under contract -vs- unlocking a carrier-locked phone out of contract -vs- unlocking a phone (password or fingerprint locked) -vs- unlocking a phone stolen/you don't own (hacking)
    - penagwin 7y ago
      Accessing any computer system without authorization is that part that is generally illegal, "Hacking" itself isn't illegal, and while accessing your bosses computer while it's unlocked isn't "hacking" it's still illegal. However most countries can authorize law enforcement to access the device under various conditions (for example a warrant). So while the owner of the device doesn't authorize accessing the device, the law allows the police to access it.
  - teddyh 7y ago
    > Because hacking is illegal in most jurisdictions. You are writing this on “Hacker News”. Maybe you should rephrase that.
rolltiide 7y ago
Depends on the client and purpose and actual action. Thinly veiled PR like this is advertisement to state agencies who will contract their work out to you. Even if it is work with a government that your own government doesn't agree with, thats when the lack of munitions regulation on exploits comes into play. So as long as your state client isn't on the OFAC list, you can take the contract.
penagwin 7y ago
My understanding (under US law) is that accessing computer systems without authorization is illegal. However, you can totally make tools to hack your own stuff. And this company only advertises their unlocking abilities to law enforcement services, who are presumably authorized to access the device (via warrant). So the company itself isn't accessing devices without authorization, so they aren't technically "hacking anybody".
- maxaf 7y ago
  > law enforcement services, who are presumably authorized to access the device Cue Tony Soprano saying "warrant! WARRANT!" to his housekeeper. What are the chances that Cellebrite requires clients to supply a warrant for each device they unlock?
  - penagwin 7y ago
    I don't think they would need to? Cellebrite sells law enforcement an on-premise method to unlock devices. At that point it's no longer Cellebrite unlocking the phones, it's Law enforcement who is unlocking the devices. Since they (at glance) only sell to law enforcement I think it's reasonable to assume that they expect their device to be used legally (they aren't selling it to @xxXRUSKI1337Hax04xXX who we all no is up to no good.) Disclaimer: My understanding is mostly of US law, the company is Israeli and I'm not familiar with Israeli law, or the laws of other countries Cellebrite contracts with, although I think this would similarly apply to most jurisdictions
    - maxaf 7y ago
      Police officers conducting a search of a suspect's premises must present a valid search warrant. Police officers requesting that a telecom company aid in surveillance of a suspect must present a valid search warrant. Google, despite of late being the butt of all jokes, will not cooperate with police officers unless a valid warrant is presented. Thus it follows that Cellebrite isn't somehow excluded from following the law just like all those other companies, and cannot support unlocking of iPhones or other devices without being shown a valid search warrant.

Is it legal to monetize zeroday like this?

wil421 7y ago

Not if you have connections and hire the right people.

eat 7y ago

Why wouldn't it be?

simongr3dal 7y ago
Because hacking is illegal in most jurisdictions. Exploiting probably isn't illegal, but as soon as you begin to use these exploits against other people to access their data it is illegal. So selling the exploit or performing it for clients would mean assisting someone in breaking the law. They probably aren't going to get in trouble since their clients are often government agencies themselves.
- penagwin 7y ago
  It's only illegal to access a device without authorization, and they only sell to law enforcement (who presumably have a warrant or whatnot, and thus authorization) so Cellebrite themselves isn't accessing anybodies systems.
- m463 7y ago
  Depends on the definition. unlocking a carrier-locked phone under contract -vs- unlocking a carrier-locked phone out of contract -vs- unlocking a phone (password or fingerprint locked) -vs- unlocking a phone stolen/you don't own (hacking)
  - penagwin 7y ago
    Accessing any computer system without authorization is that part that is generally illegal, "Hacking" itself isn't illegal, and while accessing your bosses computer while it's unlocked isn't "hacking" it's still illegal. However most countries can authorize law enforcement to access the device under various conditions (for example a warrant). So while the owner of the device doesn't authorize accessing the device, the law allows the police to access it.
- teddyh 7y ago
  > Because hacking is illegal in most jurisdictions. You are writing this on “Hacker News”. Maybe you should rephrase that.

rolltiide 7y ago

Depends on the client and purpose and actual action. Thinly veiled PR like this is advertisement to state agencies who will contract their work out to you. Even if it is work with a government that your own government doesn't agree with, thats when the lack of munitions regulation on exploits comes into play. So as long as your state client isn't on the OFAC list, you can take the contract.

penagwin 7y ago

My understanding (under US law) is that accessing computer systems without authorization is illegal. However, you can totally make tools to hack your own stuff. And this company only advertises their unlocking abilities to law enforcement services, who are presumably authorized to access the device (via warrant). So the company itself isn't accessing devices without authorization, so they aren't technically "hacking anybody".

maxaf 7y ago
> law enforcement services, who are presumably authorized to access the device Cue Tony Soprano saying "warrant! WARRANT!" to his housekeeper. What are the chances that Cellebrite requires clients to supply a warrant for each device they unlock?
- penagwin 7y ago
  I don't think they would need to? Cellebrite sells law enforcement an on-premise method to unlock devices. At that point it's no longer Cellebrite unlocking the phones, it's Law enforcement who is unlocking the devices. Since they (at glance) only sell to law enforcement I think it's reasonable to assume that they expect their device to be used legally (they aren't selling it to @xxXRUSKI1337Hax04xXX who we all no is up to no good.) Disclaimer: My understanding is mostly of US law, the company is Israeli and I'm not familiar with Israeli law, or the laws of other countries Cellebrite contracts with, although I think this would similarly apply to most jurisdictions
  - maxaf 7y ago
    Police officers conducting a search of a suspect's premises must present a valid search warrant. Police officers requesting that a telecom company aid in surveillance of a suspect must present a valid search warrant. Google, despite of late being the butt of all jokes, will not cooperate with police officers unless a valid warrant is presented. Thus it follows that Cellebrite isn't somehow excluded from following the law just like all those other companies, and cannot support unlocking of iPhones or other devices without being shown a valid search warrant.