3 ms·
> Just perhaps not on a $50 Cricket phone with no HSM. On some more expensive devices keys can be obtained from RAM[1]. [1] https://www.cellebrite.com/en/blog
by polar 6y ago
> Just perhaps not on a $50 Cricket phone with no HSM.
On some more expensive devices keys can be obtained from RAM[1].
[1] https://www.cellebrite.com/en/blog/decrypting-databases-using-ram-dump-health-data/ https://www.cellebrite.com/en/blog/decrypting-databases-usin...
- MacsHeadroom 6y agoIf the keys are in RAM then they aren't in an HSM- they're in RAM (as well as the HSM, but that's irrelevant). More importantly, the app is already unlocked anyway if the keys are in RAM. So that just lets you keep it unlocked. It doesn't help you unlock an app that was locked when you got access to the device.
- polar 6y agoIndeed. It is still very useful to an investigator who has to examine an unlocked device -- in most corporate investigations this is unlikely to be an issue. Forensic examiners working for the police are likely to have more of a hard time getting codes etc., but they have access to more advanced services[1][2]. [1] https://www.msab.com/2018/12/11/msab-introduces-access-services-to-help-customers-get-access-to-the-most-challenging-mobile-phones/ https://www.msab.com/2018/12/11/msab-introduces-access-servi... [2] https://www.cellebrite.com/en/advanced-services/ https://www.cellebrite.com/en/advanced-services/