17 ms·

No, Cellebrite Cannot “Break Signal Encryption”

645 points by hprotagonist 6y ago

hyperion2010 6y ago
Ah, what a solid Mickens reference. http://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf http://scholar.harvard.edu/files/mickens/files/thisworldofou...
- hprotagonist 6y ago
  i was very pleased to learn: he’s tenured now!
cgb223 6y ago
It’s shameful that one of the worlds best journalistic sources didn’t even bother to reach out to Signal to get comment on a story they ran about them I feel like a lot of today’s mistrust of news stems from publications not verifying sources, or checking evidence, or at least scrutinizing what others are saying. Wish we could fix that
- lemoncurd 6y ago
  i have more faith in the onion than bbc, they are from the best newspaper
  - pirocks 6y ago
    The BBC isn't a newspaper.
    - zepto 6y ago
      The onion is
    - lemoncurd 6y ago
      man i dont care about your technicals
- DaniloDias 6y ago
  It isn’t shameful. It is yet another indicator that the journalism industry is creating the intellectual equivalent of Animal Crossing. It’s a time waster that entertains- not a reflection of truth. How could any business be considered “the best” in its field and create such a shitty product? Simplest explanation: they are not trustworthy and never were.
  - Erlich_Bachman 6y ago
    This is not due to incompetence. This is done with the objective to influence the public opinion of cryptographic tools so that people will stop using them. The system has no way of actually breaking encryption, that's why it is focusing on the other ways to circumvent it - one of them being making most people (non-experts) believe that it doesn't work anyway so they will stop using it. This is a focused campaign, this is not just random occurence of incompetence.
    - pvg 6y ago
      This is a focused campaign What's the evidence for this?
- ffpip 6y ago
  BBC article states "BBC has contacted Cellebrite and Signal for comment" https://www.bbc.com/news/technology-55412230 https://www.bbc.com/news/technology-55412230
  - judge2020 6y ago
    How and when they contacted cellebrite/signal is important, but even when you see "refused to comment" there really isn't a timestamp for when contact was attempted/initiated. Is there a reason for this?
  - toby- 6y ago
    And the original blog post by Cellebrite does claim to have 'cracked' the encryption, doesn't it? So the BBC's headline isn't exactly inaccurate.
    - kortex 6y ago
      So what? There's plenty of dubious blogs claiming all manner of things. The actual accomplishment isn't noteworthy (they wrote a scraper). If it were encryption-breaking, it would indeed be noteworthy, and thus worthy of fact-checking or at least waiting for Signal's rebuttal of "lolwut, no, that's nonsense". "Accuracy" is moot here: BBC's headline is misinformation.
      - deleted 6y ago
        [deleted]
    - upofadown 6y ago
      No, it didn't. It specifically stated that access to the Android keystore was needed to get at the stored Signal data.
    - AsyncAwait 6y ago
      There's a blog post claiming the Earth is flat. Would the BBC publish an article on it outside of satire?
  - 6y ago
- andrepd 6y ago
  Related: the Gell-Mann effect. You read a newspaper story on a topic about which you are knowledgeable, and get mad at how wrong they've got everything. Then you turn the page and read the next story, on which you are not an expert, and take it at face value.
  - Matticus_Rex 6y ago
    In my circles this gets me into arguments all the time. Everyone reads a book, everyone but me likes it. I point out how one section I know a lot about is deeply wrong, everyone else says versions of "well other than that part it's a great book!" I wish LW-style rationalist circles didn't attract such obnoxious people, because I don't know of any other collection of people who recognize and try to adjust for things like this.
    - nerpderp82 6y ago
      Perhaps we should reframe how we approach new knowledge? "That was a super interesting book, it brought up lots of ideas and explanations, lets discuss what parts if any we think are true." ! Folks call out information and facts as fake news, not apply healthy skepticism but a rejection of all knowledge and then at the same time falling for hoaxes. The whole country needs to take a gap year and learn the scientific method.
      - alvarlagerlof 6y ago
        They are actually extremely rigorous about this in lower Swedish education. Source criticism is part of the curriculum. It becomes evident how much of a difference it makes when comparing the behavior of the elderly population at large (were only those who went to University have been thought it) to those who have had this from the start.
    - Retric 6y ago
      Rationalist circles make just as many horrific logical errors. If you want to dig into this stuff philosophy has dug deep, and frankly all they came up with is all sources should be treated as suspect. Aka, even if a source got the stuff you know about right, you should still be be skeptical. And yes, that includes purely logical reasoning about math. It’s not a satisfactory answer, but ¯\_(ツ)_/¯
- travmatt 6y ago
  I’m just as concerned about: > According to one cyber-security expert, the claims sounded "believable". One anonymous source at the topic of the article that bolsters the claim, then all the experts who were willing to attach their names to their words all temper the articles claim are towards the end of the article.
  - Brian_K_White 6y ago
    A post on the 2600 group on fb said "seems legit".
  - ehsankia 6y ago
    They couldn't even get a single named expert to comment on record?
- SoSoRoCoCo 6y ago
  > I feel like a lot of today’s mistrust of news stems from publications not verifying sources First, a nitpick: that is a thought not a feeling: you didn't state how it made you feel, you stated an idea. Moving on... That's not why people mistrust the media. They mistrust the media because they are told to by politicians seeking to discredit journalism and control the narrative.
  - NateEag 6y ago
    I approve of your nitpick. I am a counterexample to your main point. I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me. I think I've seen every media source I've followed get significant facts wrong about things I know well. I try to fight back against Gellman amnesia in my own head.
    - SoSoRoCoCo 6y ago
      > I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me. "Because I've never seen it, clearly it does not exist."
      - Brian_K_White 6y ago
        "I have no reason to believe this, but it clearly must exist" That's called faith and religion. You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there. IE, I can't see an atom with my eyes, and I can't duplicate all the research of history myself, but I can see some things with my eyesb and I can duplicate some research myself, and I can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales.
        SoSoRoCoCo 6y ago
        > "I have no reason to believe this, but it clearly must exist" Except I never said that, whereas the previous post had a congruent summary of OP. Strike one. > You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there. True. But that isn't what we are talking about, you ventured into strawman territory all on your own. The person was claiming they've never seen a truthful source, this is called the No True Scotsman fallacy. We're not talking about god, we're talking about the fact that some journalism is unbiased. There is much of it out there, but OP seems to think there isn't, or has convinced him/herself due to their own desire to not be wrong. Strike two. > can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales. You've demonstrated that you aren't very good at following a "logical chain of trust" because you've reasoned to yourself, poorly, something that wasn't even being discussed. Strike three. First time playing with logic? It never ceases to astonish me how people who throw around the terms "logic" and "rational thought" really, reeeeeally don't know how to deploy either.
- deleted 6y ago
  [deleted]
- mikece 6y ago
  There is a thin line between modern journalism and click-bait ad farms.
- will4274 6y ago
  Additionally shameful: - they haven't printed a retraction yet - the technology reporter in question doesn't understand the tech well enough to recognize the error, even when somebody states it explicitly (https://mobile.twitter.com/janewakefield/status/1341419657211854850 https://mobile.twitter.com/janewakefield/status/134141965721...)
  - andrewnicolalde 6y ago
    Hey, that's my tweet :)
- __MatrixMan__ 6y ago
  I used to work at a traffic signal company. We got bad press whenever somebody "hacked" our infrastructure. It was always a super sophisticated "default password attack". I tried to get the default password changed to unique-per-unit randomly chosen uuid, just to be so obnoxious as to convince the customer to set their own password. Encountered resistance of the "but then they'd need to be retrained" sort. I wish I could say we didn't deserve the bad name, but we kinda did.
AnonC 6y ago
When I read the original blog post by Cellebrite, which is on archive.org [1], it left me scratching my head too. Signal is open source. They had access to the device to dump everything. Then they went through the source code to figure out how to decrypt the data. Just as this blog response says, they could’ve just opened the app and retrieved the contents (and even forwarded that to another device if they wanted). So someone enthusiastically posted about wasting their time as if it was a technological achievement. Then someone (else?) realized that the long technical post sounded stupid and had it replaced. And some people wonder where their tax money goes to — all these companies who are better at marketing themselves well as experts are getting free lunches! [1]: https://web.archive.org/web/20201210150311/https://www.cellebrite.com/en/blog/cellebrites-new-solution-for-decrypting-the-signal-app/ https://web.archive.org/web/20201210150311/https://www.celle...
- javajosh 6y ago
  >wasting their time I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.
  - zenexer 6y ago
    > anything running on your device Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.
    - javajosh 6y ago
      I would expect the toolsets to converge over time. That is, I can't imagine a tool that a LEO would have access to that I would not. Nor can I imagine a tool they might have that I would not want to use myself. That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.
e12e 6y ago
> [Cellbrite] is not magic, it is mediocre enterprise software. <3
- polar 6y ago
  > Poorly written, over-priced assumptionware. https://www.zdziarski.com/blog/?p=3717 https://www.zdziarski.com/blog/?p=3717
- ehsankia 6y ago
  The whole thing was the perfect level of angry and snarky.
- erostrate 6y ago
  > Articles about this post would have been more appropriately titled “Cellebrite accidentally reveals that their technical abilities are as bankrupt as their function in the world.” was also pretty good.
rapsey 6y ago
> If you have your device, Cellebrite is not your concern. But if the attacker has a 0day, which likely all the big players do, they don't need your physical device. Which means signal will do squat to protect your data in that case.
- edm0nd 6y ago
  All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. I think Signal is pretty safe from such things. Better than for example Whatsapp. Which seems to be where a majority of these nation-states using their 0days and exploits on.
  - rapsey 6y ago
    > All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. USA/Russia/Israel for sure have these programs. > The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+. This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person. > I think Signal is pretty safe from such things. You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.
    - richardlblair 6y ago
      If someone has gained root you're done. Every application must be assumed to be unsafe at that point. This isn't news, and it doesn't mean signal is broken.
    - Erlich_Bachman 6y ago
      Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...
pkulak 6y ago
Using only the homeowner's house key and extensive key-sliding-into-lock reverse-engineering, I'm able to break into their home. Whitepaper coming soon.
- edm0nd 6y ago
  This is the LockPickingLawyer here and today I'm going to read this whitepaper by pkulak
  - pkulak 6y ago
    Click out of one...
- scrps 6y ago
  Don't forget a snappy and memorable name (suggestions: Lock0ut, KeyMast3r, Tumbld) and the requisite domain name to accompany it.
  - segfaultbuserr 6y ago
    > Tumbld should be Tum61d.
h_anna_h 6y ago
> the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false The headline is actually true. Cellebrite did claim that after all. Whether or not it Cellebrite is lying is another story. Although it was pathetic of them to not reach out of Moxie. It only shows the quality of the mainstream media.
- kortex 6y ago
  That doesn't absolve BBC of spreading misinformation, which is what they are doing. It takes near zero effort to make a dubious claim on a blog. If BBC then writes, "kortex claimed to have hacked the NSA", that's accurate, I did make a wild claim. It's also misinformation if that headline is published without any investigation as to if that claim has any weight beyond internet rambling. "You can't put anything on the internet that isn't true" "Where'd you read that?" "Internet"
  - h_anna_h 6y ago
    Sure? I never said otherwise.
- everfree 6y ago
  They did? Signal seems to claim otherwise. From the linked Signal post: > Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
1cvmask 6y ago
Moxie of Signal has a great hilarious presentation on SSL at Def Con 19: https://www.youtube.com/watch?v=UawS3_iuHoA https://www.youtube.com/watch?v=UawS3_iuHoA
- segfaultbuserr 6y ago
  Thanks for the link. Moxie's talk is better all the talkshows I've seen, absolutely hilarious, how could I miss this one before...
  - 1cvmask 6y ago
    Here is another great one where he ties American action movies as narrative with secure communications: https://www.youtube.com/watch?v=tOMiAeRwpPA https://www.youtube.com/watch?v=tOMiAeRwpPA
- tialaramex 6y ago
  That is a fun presentation, although the title is misleading because it's 99% about the Web PKI which is orthogonal to SSL (and TLS). TLS doesn't care at all why you trust these certificates, if you want to trust certificates so long as the public key contains the decimal digits 42069 that's fine. Even PKIX (the IETF's profile for X.509 on the Internet) is orthogonal to TLS as designed, although in practice you're creating a world of pain for yourself if you decide you do want TLS but you don't want PKIX since the two have grown next to each other for decades. Anyway, almost all of Moxie's talk is about the Certificate Authorities in the Web PKI, and not about SSL/TLS per se at all. It's about his attempt (Convergence) at multi-perspective peer validation for authenticity to eventually replace Certificate Authorities. Could that have worked? Maybe, sort of. It never went anywhere much. Of course in hindsight we can't blame Moxie for not guessing what will happen next - I expect few if any of us spent last Xmas thinking "Better enjoy this, next Xmas will be a totally different ball game because of a pandemic virus" either.
Imnimo 6y ago
Signal says: >Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. But the original Cellebrite post says: >Decrypting messages and attachments sent with Signal has been all but impossible…until now. and >This time, the encryption is even harder to crack. It's just that Cellebrite's claim is totally baseless and what they're actually doing is not "breaking" or "cracking" anything. The BBC article should have been more critical of Cellebrite's language, but I don't agree with Signal that their headline was "false".
- coldcode 6y ago
  They automated taking pictures of app content on an unlocked Android phone, and bragged about it as a breakthrough tech, then deleted the article and replaced it with fluff. Embarrassing.
  - Imnimo 6y ago
    Right, Cellebrite's clearly way off base here. But the BBC's headline seems to accurately describe their wild claims.
  - polar 6y ago
    > automated taking pictures of app content There's a world of difference between taking screenshots of an application and extracting messages and metadata from a database. I should imagine that Cellebrite's audience of corporate and law enforcement investigators would be very keen on getting access to this breakthrough. OTOH, Cellebrite's competitors have been able to do that for a while!
smurf_t 6y ago
BBC, you failed us here.
olodus 6y ago
If Cellebrite thought they had broken the signal encryption - why did they release it in a simple blog post? As responsible people in the sec community shouldn't they tell this to the Signal devs first so that they could review it and fix it if possible/needed? Or is that just something real security researchers are required to do and not something companies feel themselves bound to in any way?
- raziel2p 6y ago
  Probably just the company wanting to push out some engineering blog content, and very unfortunate phrasing in the blogpost itself. If they'd framed it as "let's learn how Signal's encryption works" there would not have been any issue.
- saagarjha 6y ago
  Cellebrite isn't a responsible security research company; they sell tools to the government to break into devices using security vulnerabilities.
upofadown 6y ago
I suppose that the BBC article title could be considered to be correct in a narrow sense. Cellebrite makes products that can, in some cases, unlock phones. Signal Messenger depends on the phone OS to protect the key used to encrypt the saved data. So in some cases Cellebrite does have the power to break the saved data encryption. The Signal case is interesting because the app used to have a feature where you could protect the data with a separate strong passphrase. That would of prevented this particular attack. For reasons that are not clear to me, Signal eliminated this feature.
- tw25520481 6y ago
  > So in some cases Cellebrite does have the power to break the saved data encryption. IIUC, in those cases they could instead just open the Signal app.
  - upofadown 6y ago
    But you would never want to do something like that if you were looking for evidence you might want to present at a trial.
    - Brian_K_White 6y ago
      So what? That's a procedural rule not the difference between "cracking encryption" and not. It still means all they did was automate something, not crack something.
      - polar 6y ago
        Opening up the database reveals more metadata than would be visible in the application's user interface.
mechnesium 6y ago
Friendly reminder that reproducible F-Droid builds of Signal are still rejected for weak reasons [1]. You must trust the Signal binaries on popular app stores [2][3]. Don’t worry though; the Signal devs assure you that signed Android binaries from their website are reproducible [4]. As if checksum collisions aren’t something that state actors could trivially create [5]. I don’t trust Signal. [1] https://github.com/signalapp/Signal-Android/wiki/F-Droid https://github.com/signalapp/Signal-Android/wiki/F-Droid [2] https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms https://play.google.com/store/apps/details?id=org.thoughtcri... [3] https://apps.apple.com/us/app/signal-private-messenger/id874139669 https://apps.apple.com/us/app/signal-private-messenger/id874... [4] https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ [5] https://shattered.io/ https://shattered.io/
- gruez 6y ago
  >As if checksum collisions aren’t something that state actors could trivially create [5]. >[5] https://shattered.io/ https://shattered.io/ Collision attacks are an issue when using md5/sha1, but I don't see how it's relevant in this case. If state actors wants to replace the signal apk with a backdoored one, they'll need to pull off a preimage attack, not a collision attack. A collision attack wouldn't be useful because you still need the original publisher to sign the apk for you, which seems unlikely considering OWS isn't a CA or anything. If OWS was compromised by state actors into signing, then they can just sign the backdoored version directly, no need for a collision attack.
  - mechnesium 6y ago
    Thanks for pointing out collision vs. preimage. Interesting distinction.
  - h_anna_h 6y ago
    I presume that the idea is that the compiled binary from the source and that the binary distributed by signal would be different but have the same sha1s. It does not make a lot of sense though because one could simply use another algorithm.
mikece 6y ago
While Signal's encryption is good, I don't like that (1) you have to have a phone number to register, (2) it asks for access to your contacts on your phone (3) you have to install the app on a computer rather than being able to just use it through a browser. For these reasons I prefer Wire... and you can log into three accounts at once on the free tier.
- angry_octet 6y ago
  Re your points: - (1) They are working on this, but it serves to limit spam, and it is easily comprehensible by the non technical. - (2) You don't have to give it access, it works either way. If does its best to only use this for finding which of your contacts use Signal, rather than uploading the full address book. - (3) client side crypto is supplied by the server, which fundamentally is a big problem for a system like Signal. Until web crypto is not a dumpster fire you can't do better. (I personally think allowing the Electron app is a huge mistake but it's their call.)
- dylan604 6y ago
  I found the original setup requiring a phone number off putting as well. However, I'm not sure how much it is used. In my case, I had a phone number that was used to set up signal. It was my number at the time. I now have a new number, yet there is no within Signal to update that number. It still shows the old number in my settings. ???? Signal still works just fine for me and all of my contacts
kvothe_ 6y ago
Whoever wrote the article for Signal should be writing bars in rap songs. Such a great article. I was laughing the whole way through. The author manages to poke fun of Cellebrite and plug Signal.
1vuio0pswjnm7 6y ago
"2. Cellebrite is not magic. Imagine that someone is physically holding your device, with the screen unlocked, in their hands. If they wanted to create a record of what's on your device right then, they could simply open each app on your device and take screenshots of what's there." Under the laws of many countries, that "record" alone would likely be inadmissible. Cellebrite's market is authorities who seize computers and then must follow forensics protocols for extracting digital evidence. It is not someone holding your device in their hands, opening up each app and taking screenshots.
Justsignedup 6y ago
Any time any encryption breaking has the words "well, if we can retrieve the decryption key from the phone" and doesn't back that up with a mechanism by which this is feasible, this isn't an encryption breaking as much as it is "if i had an already decrypted device, then man can i do cool stuff for you!"
elago 6y ago
More clarification on the topic would be nice. When I open the Signal app right now, I am nagged to "Create a PIN. PINs keep information that's stored with Signal encrypted. Remind Me Later / Create PIN". Would be interesting to know if an app specific PIN resists cellebrite analysis. Screen unlocked, Signal PIN enabled.
- pavon 6y ago
  No Signal does not ask you for your PIN to access your messages. It is required to transfer your account to a new device, if you don't have access to the old one.
ianopolous 6y ago
There is something which Signal could do to help even in this scenario. Give the user a logout option which leaves nothing but ciphertext on the device (e.g. by encrypting any plaintext keys with the passphrase). To login again you need a passphrase. Then as long as the user has enough time to click logout they are safe even when the device is out of their hands. Of course, after that, it might be prudent to consider the device compromised, and thus not login again afterwards in case it has been backdoored.
- upofadown 6y ago
  The Signal app used to have an option to protect the critical data with a strong passphrase but that option was removed. The developers might of considered that the real threat was a remote access trojan that would just keysniff the passphrase. I guess the Cellebrite thing is a reminder that there are other threats. As it is you are pretty much lost if someone is willing to snatch the phone from your hand while you are looking at cat pictures on the web. Phones really need more than one level of "unlocked".
  - ianopolous 6y ago
    The real use case for this kind of cryptographic logout is travelling through airports. That is a very common situation.
  - mr_toad 6y ago
    > the real threat was a remote access trojan The real threat for most people is forgetting the password.
    - ianopolous 6y ago
      Indeed, which is why logging out would be optional.
  - angry_octet 6y ago
    Signal can at least have timeouts for requiring re-auth (typically biometric). The isolation concept can indeed apply to more than just functional separation, including separation in time, or in search depth (number of records returned) or by classification. It would be quite simple -- require auth to scan backwards more than an hour. Or 'press and hold to mark message as sensitive|expiring'. And possibly require a passphrase to access those sensitive messages / threads. I've applied these techniques for database systems where NTK (need to know) rules apply, to force queries to be narrowly scoped. Likewise system backups don't all need to be online (or in the tape robot), most restores are from the most recent backup.
kortilla 6y ago
The annoying part is how effective this is for marketing Cellebrite. The types of people that use Cellebrite will never understand the nuance here.
- polar 6y ago
  > The types of people that use Cellebrite will never understand the nuance here. Au contraire, I would imagine a law enforcement or corporate investigator would knows the difference between encryption in transit and encryption at endpoints, and therefore be in the market for what Cellebrite has achieved (if they aren't using a competitor[1] already). [1] https://blog.oxygen-forensic.com/115-2/ https://blog.oxygen-forensic.com/115-2/
modraino 6y ago
It is true that Cellebrite blog post looks like an amateur work. However, an important context is missing from signal' blog post: Cellebrite specializes in breaking and extracting data from encrypted partitions, and (this is the important part) extracting keys from the secure keystore (Qualcomm/exynos). From Cellebrite point of view, the data and keystore are already "given", all the remains is "breaking" the app encryption scheme, which in signal's case is trivial.
- Throwaway1771 6y ago
  What other security oriented apps have their own encryption scheme, independent of device system security?
jeffrallen 6y ago
Read this blog post to the last sentence, your patience will be rewarded with the mother of all digs.
nelsonenzo 6y ago
I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed and marketing was happy to have some engineering thing to blog. to me what is embarrassing is that all of these major news outlets and professional journalists could not actually read the article and do some very basic research before blasting out to the public. It just really shows how low the bar is to get something published. I could blow my nose on YouTube and make stock picks based on where the bugger lands and I wouldn't be surprised if BBC Business picks up the breaking story. That's how low the bar is it seems. Sad.
- PragmaticPulp 6y ago
  > I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed More likely the opposite: Some engineer was tasked with adding Signal database handling, marketing got wind of it, and they went to town on blog posts and PR pieces about it. Really though, they don't care that it's technically wrong. The target audience for this stuff isn't other engineers or technical people. It's their potential customers, who don't know the difference.
  - polar 6y ago
    > It's their potential customers, who don't know the difference. Their potential customers (forensic examiners not just in law enforcement, but also corporate investigators, incident response etc.) do know the difference. Being able to get data from the endpoint is exactly what they are after, because the alternative is that some poorly paid soul has to sit and photograph thousands of pages in numerous applications. Having access to the database saves time, reduces interaction with the exhibit and gets metadata which isn't shown on the phone.
- ehsankia 6y ago
  Right, some private company posting a misleading blog post is one thing, hell, even small news blogs posting about it, I could understand. But a large news organization such as the BBC not even bothering to contact Signal to get a statement or their side of the story? What the hell... Someone should get fired over this.
exikyut 6y ago
Ever since I learned Facebook greenlit "Signal is awesome, were using it" I've been trying to headscratch why. Then I realised WhatsApp had kicked the whole thing off years ago and got even more confused. Why do you want to encrypt everything??? It makes your life harder. It makes cooperating with law enforcement harder. It means legitimate users can't recover their messages. It means you can't do fun things with analytics, which is extremely contentious but concedably valuable. So, why?? I think I've figured it out. A tiny little bit of it, anyway. Imagine you're a multi-million (okay, multi-billion) dollar communications company. You're WhatsApp. Apple (iMessage). Facebook. Google (RCS). You store trillions of messages. In those trillions of messages, you are going to have the statistical >100.00% guarantee that there are chats and conversations between individuals and groups that would launch World Wars 4 through 16 if certain other individuals, groups, governments and so forth were to learn/verify that A did really say <thing> to B. The nuclear launch codes don't fit in a football anymore. I have no hope of ever confirming the validity of that Bloomberg article about the alleged Supermicro hack. But it seems "well duh" simple enough to be concerningly plausible (custom silicon packaged in WLCSP or SC70, bit-twiddling SPI? Too easy... :S). As a technically-flawless plausibility, I say it can serve as a concrete reference example of a fraction of the persistent, sweeping, ruthless, and terrifying scale of the super-industrial, Eye Of Sauron-style attacks that these companies have very obviously been facing for some time now. So, my possibly-not-really-a-conspiracy-theory-since-the-pieces-come-together-without-fantastic-levels-of-extrapolation theory is, someone stumbled on an idea one day, maybe in a stuffy committee meeting, or maybe in a bar, to solve the problem by giving the people what they wanted... end-to-end encrypt everything... and go from encryption at rest, which is basically nothing, to encryption everywhere; and you instantaneously divest the massive, massive burden of owning all that readable data. True, now "accidentally" forgetting the `s` in backend URLs doesn't let the NSA read everything anymore, but that kind of pales in comparison to being able to incontrovertibly, mathematically prove that, since the data really is encrypted before it leaves the device, there really is no chance any readable plaintext is leaking and potentially being stored; so if the nation states would kindly take stock of this situation and point the coherence death ray beams elsewhere that would be great since we are kind of on fire here at the moment and it's too hOT we are meLTING-- Getting this to catch on was obviously difficult. Anybody that can scare multi-billion dollar companies obviously has the skill to steer collective opinion and impression at scale. Whoever came up with the idea to piggyback on top of individual privacy is... a task-focused genius, I'll put it that way. On the one hand, the idea has scaled beautifully: all the tech folks have gone "Is private. Respects freedom. Og like." and loudly pushed for the idea everywhere they can. And from a sociopolitical perspective, the narrative is faultless and blameless, which is where the genius definitely shines through. The first bit I can't say I like is the narrative appearance of first-class support for end-to-end encryption as a Scientific Advancement™. It's not. It's an implementationally-scoped, crowd control spin campaign to increase datacenter security beyond what disk encryption at rest can ever achieve. The scale of wreckage in the form of technically minded people who really believe the privacy narrative is disillusioning to see. The other bit that I find unamusing is the long-term shifts in the attack landscape that will result from this. Specifically the fact that, an Eye Of Sauron style adversary is not ultimately going to care what their attack target is, or how to attack it, only that it gets vaporised. End-to-end encryption shifts the burden of responsibility to the owner of the server to the owner of the client. I can see the positive angle here from a think-tank standpoint - literal decentralization as a defence strategy - but still, Android/iOS are now the focus of some laser beams that were terrifying a bunch of rather large companies. Maybe it'll seem reasonable to heavily fund the vulnerability research scene to maintain a favorable status quo, and we'll see some impressive hacks going forward (or, er, we won't). Or maybe things are already "that bad" and I don't have anything to worry about. But considering that users are now that much more responsible for devices that are interesting in a way they were never before, this whole strategy kinda feels irresponsible to me if you squint at it from a certain angle. At the same time, it might ironically be ensuring our survival. In this picture, law enforcement really is the afterthought. It's well known the law court system doesn't understand technology and is 20 (40? 50?) years in the past. That situation extends beyond the courts though, with law enforcement generally in the same position. But it's worse than it may at first seem, because the notion of "the past" that refer to a collective public interpretation of "now" doesn't do justice to the technological development that has happened at these companies over the last 5-10 years - these private companies are internally fighting battles of a complexity that the public law enforcement system cannot hope to comprehend, let alone help with. In this fight, the best way to avoid World War 4 is to encrypt everything. But Washington is still getting over how cool they handled the Cold War, and the police still think it's "hard" and "complicated" and "special" to "hack phones".
radoslawc 6y ago
If reason for that blog post was to get famous. Well I'd day mission accomplished. I haven't heard about Cellebrite before.
- Throwaway1771 6y ago
  Infamous.
scrps 6y ago
I've made it even easier for Cellebrite... Have access to unlocked phone?: yes Enabled signal backup?: yes Copied key to decrypt backup?: yes Downloaded Xeals signal backup decryptor from github[1]?: yes Decrypted backup?: yes Contacted BBC to inform them you "cracked" signal's encryption?: check Profit [1]: https://github.com/xeals/signal-back https://github.com/xeals/signal-back
tempfs 6y ago
This whole thing was just BBC clickbait and Cellebrite advertising to the idiots in law enforcement. No one that actually knows even a tiny bit about how shit works believed the story for even a moment.
el_dev_hell 6y ago
From the original blog post: > After getting the decryption key, we now needed to know what decryption algorithm to use. We went back to Signal’s open-source code and found this: > Seeing that told us that Signal uses AES encryption in CTR mode. We used our decryption key with the AES encryption in CTR mode and decrypted the attachment files. Was this supposed to be satire?
- aemreunal 6y ago
  In the undying words of Bender from Futurama: Oh wait, you're serious. Let me laugh even harder https://www.youtube.com/watch?v=_n5E7feJHw0 https://www.youtube.com/watch?v=_n5E7feJHw0
methodsignature 6y ago
Signal seems a bit of a jerk company. They should have "stayed above the fray". Instead, they ridiculed. They were in their rights to do so but should have been the better. Throwing insults, however well grounded, is never good for a brand and shows a lack of level-headedness. They could have simple stated the story is a non-story and stated why. This could have been paired with working with the BBC to get a retraction in place, taught someone at BBC something, and maybe even gotten a little free positive PR from them in the process.
OJFord 6y ago
No, I Cannot Take This Case Seriously.

645 points by hprotagonist 6y ago

hyperion2010 6y ago

Ah, what a solid Mickens reference. http://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf http://scholar.harvard.edu/files/mickens/files/thisworldofou...

hprotagonist 6y ago
i was very pleased to learn: he’s tenured now!

cgb223 6y ago

It’s shameful that one of the worlds best journalistic sources didn’t even bother to reach out to Signal to get comment on a story they ran about them I feel like a lot of today’s mistrust of news stems from publications not verifying sources, or checking evidence, or at least scrutinizing what others are saying. Wish we could fix that

lemoncurd 6y ago
i have more faith in the onion than bbc, they are from the best newspaper
- pirocks 6y ago
  The BBC isn't a newspaper.
  - zepto 6y ago
    The onion is
  - lemoncurd 6y ago
    man i dont care about your technicals
DaniloDias 6y ago
It isn’t shameful. It is yet another indicator that the journalism industry is creating the intellectual equivalent of Animal Crossing. It’s a time waster that entertains- not a reflection of truth. How could any business be considered “the best” in its field and create such a shitty product? Simplest explanation: they are not trustworthy and never were.
- Erlich_Bachman 6y ago
  This is not due to incompetence. This is done with the objective to influence the public opinion of cryptographic tools so that people will stop using them. The system has no way of actually breaking encryption, that's why it is focusing on the other ways to circumvent it - one of them being making most people (non-experts) believe that it doesn't work anyway so they will stop using it. This is a focused campaign, this is not just random occurence of incompetence.
  - pvg 6y ago
    This is a focused campaign What's the evidence for this?
ffpip 6y ago
BBC article states "BBC has contacted Cellebrite and Signal for comment" https://www.bbc.com/news/technology-55412230 https://www.bbc.com/news/technology-55412230
- judge2020 6y ago
  How and when they contacted cellebrite/signal is important, but even when you see "refused to comment" there really isn't a timestamp for when contact was attempted/initiated. Is there a reason for this?
- toby- 6y ago
  And the original blog post by Cellebrite does claim to have 'cracked' the encryption, doesn't it? So the BBC's headline isn't exactly inaccurate.
  - kortex 6y ago
    So what? There's plenty of dubious blogs claiming all manner of things. The actual accomplishment isn't noteworthy (they wrote a scraper). If it were encryption-breaking, it would indeed be noteworthy, and thus worthy of fact-checking or at least waiting for Signal's rebuttal of "lolwut, no, that's nonsense". "Accuracy" is moot here: BBC's headline is misinformation.
    - deleted 6y ago
      [deleted]
  - upofadown 6y ago
    No, it didn't. It specifically stated that access to the Android keystore was needed to get at the stored Signal data.
  - AsyncAwait 6y ago
    There's a blog post claiming the Earth is flat. Would the BBC publish an article on it outside of satire?
- 6y ago
andrepd 6y ago
Related: the Gell-Mann effect. You read a newspaper story on a topic about which you are knowledgeable, and get mad at how wrong they've got everything. Then you turn the page and read the next story, on which you are not an expert, and take it at face value.
- Matticus_Rex 6y ago
  In my circles this gets me into arguments all the time. Everyone reads a book, everyone but me likes it. I point out how one section I know a lot about is deeply wrong, everyone else says versions of "well other than that part it's a great book!" I wish LW-style rationalist circles didn't attract such obnoxious people, because I don't know of any other collection of people who recognize and try to adjust for things like this.
  - nerpderp82 6y ago
    Perhaps we should reframe how we approach new knowledge? "That was a super interesting book, it brought up lots of ideas and explanations, lets discuss what parts if any we think are true." ! Folks call out information and facts as fake news, not apply healthy skepticism but a rejection of all knowledge and then at the same time falling for hoaxes. The whole country needs to take a gap year and learn the scientific method.
    - alvarlagerlof 6y ago
      They are actually extremely rigorous about this in lower Swedish education. Source criticism is part of the curriculum. It becomes evident how much of a difference it makes when comparing the behavior of the elderly population at large (were only those who went to University have been thought it) to those who have had this from the start.
  - Retric 6y ago
    Rationalist circles make just as many horrific logical errors. If you want to dig into this stuff philosophy has dug deep, and frankly all they came up with is all sources should be treated as suspect. Aka, even if a source got the stuff you know about right, you should still be be skeptical. And yes, that includes purely logical reasoning about math. It’s not a satisfactory answer, but ¯\_(ツ)_/¯
travmatt 6y ago
I’m just as concerned about: > According to one cyber-security expert, the claims sounded "believable". One anonymous source at the topic of the article that bolsters the claim, then all the experts who were willing to attach their names to their words all temper the articles claim are towards the end of the article.
- Brian_K_White 6y ago
  A post on the 2600 group on fb said "seems legit".
- ehsankia 6y ago
  They couldn't even get a single named expert to comment on record?
SoSoRoCoCo 6y ago
> I feel like a lot of today’s mistrust of news stems from publications not verifying sources First, a nitpick: that is a thought not a feeling: you didn't state how it made you feel, you stated an idea. Moving on... That's not why people mistrust the media. They mistrust the media because they are told to by politicians seeking to discredit journalism and control the narrative.
- NateEag 6y ago
  I approve of your nitpick. I am a counterexample to your main point. I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me. I think I've seen every media source I've followed get significant facts wrong about things I know well. I try to fight back against Gellman amnesia in my own head.
  - SoSoRoCoCo 6y ago
    > I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me. "Because I've never seen it, clearly it does not exist."
    - Brian_K_White 6y ago
      "I have no reason to believe this, but it clearly must exist" That's called faith and religion. You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there. IE, I can't see an atom with my eyes, and I can't duplicate all the research of history myself, but I can see some things with my eyesb and I can duplicate some research myself, and I can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales.
      - SoSoRoCoCo 6y ago
        > "I have no reason to believe this, but it clearly must exist" Except I never said that, whereas the previous post had a congruent summary of OP. Strike one. > You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there. True. But that isn't what we are talking about, you ventured into strawman territory all on your own. The person was claiming they've never seen a truthful source, this is called the No True Scotsman fallacy. We're not talking about god, we're talking about the fact that some journalism is unbiased. There is much of it out there, but OP seems to think there isn't, or has convinced him/herself due to their own desire to not be wrong. Strike two. > can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales. You've demonstrated that you aren't very good at following a "logical chain of trust" because you've reasoned to yourself, poorly, something that wasn't even being discussed. Strike three. First time playing with logic? It never ceases to astonish me how people who throw around the terms "logic" and "rational thought" really, reeeeeally don't know how to deploy either.
deleted 6y ago
[deleted]
mikece 6y ago
There is a thin line between modern journalism and click-bait ad farms.
will4274 6y ago
Additionally shameful: - they haven't printed a retraction yet - the technology reporter in question doesn't understand the tech well enough to recognize the error, even when somebody states it explicitly (https://mobile.twitter.com/janewakefield/status/1341419657211854850 https://mobile.twitter.com/janewakefield/status/134141965721...)
- andrewnicolalde 6y ago
  Hey, that's my tweet :)
__MatrixMan__ 6y ago
I used to work at a traffic signal company. We got bad press whenever somebody "hacked" our infrastructure. It was always a super sophisticated "default password attack". I tried to get the default password changed to unique-per-unit randomly chosen uuid, just to be so obnoxious as to convince the customer to set their own password. Encountered resistance of the "but then they'd need to be retrained" sort. I wish I could say we didn't deserve the bad name, but we kinda did.

AnonC 6y ago

When I read the original blog post by Cellebrite, which is on archive.org [1], it left me scratching my head too. Signal is open source. They had access to the device to dump everything. Then they went through the source code to figure out how to decrypt the data. Just as this blog response says, they could’ve just opened the app and retrieved the contents (and even forwarded that to another device if they wanted). So someone enthusiastically posted about wasting their time as if it was a technological achievement. Then someone (else?) realized that the long technical post sounded stupid and had it replaced. And some people wonder where their tax money goes to — all these companies who are better at marketing themselves well as experts are getting free lunches! [1]: https://web.archive.org/web/20201210150311/https://www.cellebrite.com/en/blog/cellebrites-new-solution-for-decrypting-the-signal-app/ https://web.archive.org/web/20201210150311/https://www.celle...

javajosh 6y ago
>wasting their time I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.
- zenexer 6y ago
  > anything running on your device Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.
  - javajosh 6y ago
    I would expect the toolsets to converge over time. That is, I can't imagine a tool that a LEO would have access to that I would not. Nor can I imagine a tool they might have that I would not want to use myself. That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.

e12e 6y ago

> [Cellbrite] is not magic, it is mediocre enterprise software. <3

polar 6y ago
> Poorly written, over-priced assumptionware. https://www.zdziarski.com/blog/?p=3717 https://www.zdziarski.com/blog/?p=3717
ehsankia 6y ago
The whole thing was the perfect level of angry and snarky.
erostrate 6y ago
> Articles about this post would have been more appropriately titled “Cellebrite accidentally reveals that their technical abilities are as bankrupt as their function in the world.” was also pretty good.

rapsey 6y ago

> If you have your device, Cellebrite is not your concern. But if the attacker has a 0day, which likely all the big players do, they don't need your physical device. Which means signal will do squat to protect your data in that case.

edm0nd 6y ago
All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. I think Signal is pretty safe from such things. Better than for example Whatsapp. Which seems to be where a majority of these nation-states using their 0days and exploits on.
- rapsey 6y ago
  > All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. USA/Russia/Israel for sure have these programs. > The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+. This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person. > I think Signal is pretty safe from such things. You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.
  - richardlblair 6y ago
    If someone has gained root you're done. Every application must be assumed to be unsafe at that point. This isn't news, and it doesn't mean signal is broken.
  - Erlich_Bachman 6y ago
    Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...

pkulak 6y ago

Using only the homeowner's house key and extensive key-sliding-into-lock reverse-engineering, I'm able to break into their home. Whitepaper coming soon.

edm0nd 6y ago
This is the LockPickingLawyer here and today I'm going to read this whitepaper by pkulak
- pkulak 6y ago
  Click out of one...
scrps 6y ago
Don't forget a snappy and memorable name (suggestions: Lock0ut, KeyMast3r, Tumbld) and the requisite domain name to accompany it.
- segfaultbuserr 6y ago
  > Tumbld should be Tum61d.

h_anna_h 6y ago

> the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false The headline is actually true. Cellebrite did claim that after all. Whether or not it Cellebrite is lying is another story. Although it was pathetic of them to not reach out of Moxie. It only shows the quality of the mainstream media.

kortex 6y ago
That doesn't absolve BBC of spreading misinformation, which is what they are doing. It takes near zero effort to make a dubious claim on a blog. If BBC then writes, "kortex claimed to have hacked the NSA", that's accurate, I did make a wild claim. It's also misinformation if that headline is published without any investigation as to if that claim has any weight beyond internet rambling. "You can't put anything on the internet that isn't true" "Where'd you read that?" "Internet"
- h_anna_h 6y ago
  Sure? I never said otherwise.
everfree 6y ago
They did? Signal seems to claim otherwise. From the linked Signal post: > Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

1cvmask 6y ago

Moxie of Signal has a great hilarious presentation on SSL at Def Con 19: https://www.youtube.com/watch?v=UawS3_iuHoA https://www.youtube.com/watch?v=UawS3_iuHoA

segfaultbuserr 6y ago
Thanks for the link. Moxie's talk is better all the talkshows I've seen, absolutely hilarious, how could I miss this one before...
- 1cvmask 6y ago
  Here is another great one where he ties American action movies as narrative with secure communications: https://www.youtube.com/watch?v=tOMiAeRwpPA https://www.youtube.com/watch?v=tOMiAeRwpPA
tialaramex 6y ago
That is a fun presentation, although the title is misleading because it's 99% about the Web PKI which is orthogonal to SSL (and TLS). TLS doesn't care at all why you trust these certificates, if you want to trust certificates so long as the public key contains the decimal digits 42069 that's fine. Even PKIX (the IETF's profile for X.509 on the Internet) is orthogonal to TLS as designed, although in practice you're creating a world of pain for yourself if you decide you do want TLS but you don't want PKIX since the two have grown next to each other for decades. Anyway, almost all of Moxie's talk is about the Certificate Authorities in the Web PKI, and not about SSL/TLS per se at all. It's about his attempt (Convergence) at multi-perspective peer validation for authenticity to eventually replace Certificate Authorities. Could that have worked? Maybe, sort of. It never went anywhere much. Of course in hindsight we can't blame Moxie for not guessing what will happen next - I expect few if any of us spent last Xmas thinking "Better enjoy this, next Xmas will be a totally different ball game because of a pandemic virus" either.

Imnimo 6y ago

Signal says: >Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. But the original Cellebrite post says: >Decrypting messages and attachments sent with Signal has been all but impossible…until now. and >This time, the encryption is even harder to crack. It's just that Cellebrite's claim is totally baseless and what they're actually doing is not "breaking" or "cracking" anything. The BBC article should have been more critical of Cellebrite's language, but I don't agree with Signal that their headline was "false".

coldcode 6y ago
They automated taking pictures of app content on an unlocked Android phone, and bragged about it as a breakthrough tech, then deleted the article and replaced it with fluff. Embarrassing.
- Imnimo 6y ago
  Right, Cellebrite's clearly way off base here. But the BBC's headline seems to accurately describe their wild claims.
- polar 6y ago
  > automated taking pictures of app content There's a world of difference between taking screenshots of an application and extracting messages and metadata from a database. I should imagine that Cellebrite's audience of corporate and law enforcement investigators would be very keen on getting access to this breakthrough. OTOH, Cellebrite's competitors have been able to do that for a while!

smurf_t 6y ago

BBC, you failed us here.

olodus 6y ago

If Cellebrite thought they had broken the signal encryption - why did they release it in a simple blog post? As responsible people in the sec community shouldn't they tell this to the Signal devs first so that they could review it and fix it if possible/needed? Or is that just something real security researchers are required to do and not something companies feel themselves bound to in any way?

raziel2p 6y ago
Probably just the company wanting to push out some engineering blog content, and very unfortunate phrasing in the blogpost itself. If they'd framed it as "let's learn how Signal's encryption works" there would not have been any issue.
saagarjha 6y ago
Cellebrite isn't a responsible security research company; they sell tools to the government to break into devices using security vulnerabilities.

upofadown 6y ago

I suppose that the BBC article title could be considered to be correct in a narrow sense. Cellebrite makes products that can, in some cases, unlock phones. Signal Messenger depends on the phone OS to protect the key used to encrypt the saved data. So in some cases Cellebrite does have the power to break the saved data encryption. The Signal case is interesting because the app used to have a feature where you could protect the data with a separate strong passphrase. That would of prevented this particular attack. For reasons that are not clear to me, Signal eliminated this feature.

tw25520481 6y ago
> So in some cases Cellebrite does have the power to break the saved data encryption. IIUC, in those cases they could instead just open the Signal app.
- upofadown 6y ago
  But you would never want to do something like that if you were looking for evidence you might want to present at a trial.
  - Brian_K_White 6y ago
    So what? That's a procedural rule not the difference between "cracking encryption" and not. It still means all they did was automate something, not crack something.
    - polar 6y ago
      Opening up the database reveals more metadata than would be visible in the application's user interface.

mechnesium 6y ago

Friendly reminder that reproducible F-Droid builds of Signal are still rejected for weak reasons [1]. You must trust the Signal binaries on popular app stores [2][3]. Don’t worry though; the Signal devs assure you that signed Android binaries from their website are reproducible [4]. As if checksum collisions aren’t something that state actors could trivially create [5]. I don’t trust Signal. [1] https://github.com/signalapp/Signal-Android/wiki/F-Droid https://github.com/signalapp/Signal-Android/wiki/F-Droid [2] https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms https://play.google.com/store/apps/details?id=org.thoughtcri... [3] https://apps.apple.com/us/app/signal-private-messenger/id874139669 https://apps.apple.com/us/app/signal-private-messenger/id874... [4] https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ [5] https://shattered.io/ https://shattered.io/

gruez 6y ago
>As if checksum collisions aren’t something that state actors could trivially create [5]. >[5] https://shattered.io/ https://shattered.io/ Collision attacks are an issue when using md5/sha1, but I don't see how it's relevant in this case. If state actors wants to replace the signal apk with a backdoored one, they'll need to pull off a preimage attack, not a collision attack. A collision attack wouldn't be useful because you still need the original publisher to sign the apk for you, which seems unlikely considering OWS isn't a CA or anything. If OWS was compromised by state actors into signing, then they can just sign the backdoored version directly, no need for a collision attack.
- mechnesium 6y ago
  Thanks for pointing out collision vs. preimage. Interesting distinction.
- h_anna_h 6y ago
  I presume that the idea is that the compiled binary from the source and that the binary distributed by signal would be different but have the same sha1s. It does not make a lot of sense though because one could simply use another algorithm.

mikece 6y ago

While Signal's encryption is good, I don't like that (1) you have to have a phone number to register, (2) it asks for access to your contacts on your phone (3) you have to install the app on a computer rather than being able to just use it through a browser. For these reasons I prefer Wire... and you can log into three accounts at once on the free tier.

angry_octet 6y ago
Re your points: - (1) They are working on this, but it serves to limit spam, and it is easily comprehensible by the non technical. - (2) You don't have to give it access, it works either way. If does its best to only use this for finding which of your contacts use Signal, rather than uploading the full address book. - (3) client side crypto is supplied by the server, which fundamentally is a big problem for a system like Signal. Until web crypto is not a dumpster fire you can't do better. (I personally think allowing the Electron app is a huge mistake but it's their call.)
dylan604 6y ago
I found the original setup requiring a phone number off putting as well. However, I'm not sure how much it is used. In my case, I had a phone number that was used to set up signal. It was my number at the time. I now have a new number, yet there is no within Signal to update that number. It still shows the old number in my settings. ???? Signal still works just fine for me and all of my contacts

kvothe_ 6y ago

Whoever wrote the article for Signal should be writing bars in rap songs. Such a great article. I was laughing the whole way through. The author manages to poke fun of Cellebrite and plug Signal.

1vuio0pswjnm7 6y ago

"2. Cellebrite is not magic. Imagine that someone is physically holding your device, with the screen unlocked, in their hands. If they wanted to create a record of what's on your device right then, they could simply open each app on your device and take screenshots of what's there." Under the laws of many countries, that "record" alone would likely be inadmissible. Cellebrite's market is authorities who seize computers and then must follow forensics protocols for extracting digital evidence. It is not someone holding your device in their hands, opening up each app and taking screenshots.

Justsignedup 6y ago

Any time any encryption breaking has the words "well, if we can retrieve the decryption key from the phone" and doesn't back that up with a mechanism by which this is feasible, this isn't an encryption breaking as much as it is "if i had an already decrypted device, then man can i do cool stuff for you!"

elago 6y ago

More clarification on the topic would be nice. When I open the Signal app right now, I am nagged to "Create a PIN. PINs keep information that's stored with Signal encrypted. Remind Me Later / Create PIN". Would be interesting to know if an app specific PIN resists cellebrite analysis. Screen unlocked, Signal PIN enabled.

pavon 6y ago
No Signal does not ask you for your PIN to access your messages. It is required to transfer your account to a new device, if you don't have access to the old one.

ianopolous 6y ago

There is something which Signal could do to help even in this scenario. Give the user a logout option which leaves nothing but ciphertext on the device (e.g. by encrypting any plaintext keys with the passphrase). To login again you need a passphrase. Then as long as the user has enough time to click logout they are safe even when the device is out of their hands. Of course, after that, it might be prudent to consider the device compromised, and thus not login again afterwards in case it has been backdoored.

upofadown 6y ago
The Signal app used to have an option to protect the critical data with a strong passphrase but that option was removed. The developers might of considered that the real threat was a remote access trojan that would just keysniff the passphrase. I guess the Cellebrite thing is a reminder that there are other threats. As it is you are pretty much lost if someone is willing to snatch the phone from your hand while you are looking at cat pictures on the web. Phones really need more than one level of "unlocked".
- ianopolous 6y ago
  The real use case for this kind of cryptographic logout is travelling through airports. That is a very common situation.
- mr_toad 6y ago
  > the real threat was a remote access trojan The real threat for most people is forgetting the password.
  - ianopolous 6y ago
    Indeed, which is why logging out would be optional.
- angry_octet 6y ago
  Signal can at least have timeouts for requiring re-auth (typically biometric). The isolation concept can indeed apply to more than just functional separation, including separation in time, or in search depth (number of records returned) or by classification. It would be quite simple -- require auth to scan backwards more than an hour. Or 'press and hold to mark message as sensitive|expiring'. And possibly require a passphrase to access those sensitive messages / threads. I've applied these techniques for database systems where NTK (need to know) rules apply, to force queries to be narrowly scoped. Likewise system backups don't all need to be online (or in the tape robot), most restores are from the most recent backup.

kortilla 6y ago

The annoying part is how effective this is for marketing Cellebrite. The types of people that use Cellebrite will never understand the nuance here.

polar 6y ago
> The types of people that use Cellebrite will never understand the nuance here. Au contraire, I would imagine a law enforcement or corporate investigator would knows the difference between encryption in transit and encryption at endpoints, and therefore be in the market for what Cellebrite has achieved (if they aren't using a competitor[1] already). [1] https://blog.oxygen-forensic.com/115-2/ https://blog.oxygen-forensic.com/115-2/

modraino 6y ago

It is true that Cellebrite blog post looks like an amateur work. However, an important context is missing from signal' blog post: Cellebrite specializes in breaking and extracting data from encrypted partitions, and (this is the important part) extracting keys from the secure keystore (Qualcomm/exynos). From Cellebrite point of view, the data and keystore are already "given", all the remains is "breaking" the app encryption scheme, which in signal's case is trivial.

Throwaway1771 6y ago
What other security oriented apps have their own encryption scheme, independent of device system security?

jeffrallen 6y ago

Read this blog post to the last sentence, your patience will be rewarded with the mother of all digs.

nelsonenzo 6y ago

I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed and marketing was happy to have some engineering thing to blog. to me what is embarrassing is that all of these major news outlets and professional journalists could not actually read the article and do some very basic research before blasting out to the public. It just really shows how low the bar is to get something published. I could blow my nose on YouTube and make stock picks based on where the bugger lands and I wouldn't be surprised if BBC Business picks up the breaking story. That's how low the bar is it seems. Sad.

PragmaticPulp 6y ago
> I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed More likely the opposite: Some engineer was tasked with adding Signal database handling, marketing got wind of it, and they went to town on blog posts and PR pieces about it. Really though, they don't care that it's technically wrong. The target audience for this stuff isn't other engineers or technical people. It's their potential customers, who don't know the difference.
- polar 6y ago
  > It's their potential customers, who don't know the difference. Their potential customers (forensic examiners not just in law enforcement, but also corporate investigators, incident response etc.) do know the difference. Being able to get data from the endpoint is exactly what they are after, because the alternative is that some poorly paid soul has to sit and photograph thousands of pages in numerous applications. Having access to the database saves time, reduces interaction with the exhibit and gets metadata which isn't shown on the phone.
ehsankia 6y ago
Right, some private company posting a misleading blog post is one thing, hell, even small news blogs posting about it, I could understand. But a large news organization such as the BBC not even bothering to contact Signal to get a statement or their side of the story? What the hell... Someone should get fired over this.

exikyut 6y ago

Ever since I learned Facebook greenlit "Signal is awesome, were using it" I've been trying to headscratch why. Then I realised WhatsApp had kicked the whole thing off years ago and got even more confused. Why do you want to encrypt everything??? It makes your life harder. It makes cooperating with law enforcement harder. It means legitimate users can't recover their messages. It means you can't do fun things with analytics, which is extremely contentious but concedably valuable. So, why?? I think I've figured it out. A tiny little bit of it, anyway. Imagine you're a multi-million (okay, multi-billion) dollar communications company. You're WhatsApp. Apple (iMessage). Facebook. Google (RCS). You store trillions of messages. In those trillions of messages, you are going to have the statistical >100.00% guarantee that there are chats and conversations between individuals and groups that would launch World Wars 4 through 16 if certain other individuals, groups, governments and so forth were to learn/verify that A did really say <thing> to B. The nuclear launch codes don't fit in a football anymore. I have no hope of ever confirming the validity of that Bloomberg article about the alleged Supermicro hack. But it seems "well duh" simple enough to be concerningly plausible (custom silicon packaged in WLCSP or SC70, bit-twiddling SPI? Too easy... :S). As a technically-flawless plausibility, I say it can serve as a concrete reference example of a fraction of the persistent, sweeping, ruthless, and terrifying scale of the super-industrial, Eye Of Sauron-style attacks that these companies have very obviously been facing for some time now. So, my possibly-not-really-a-conspiracy-theory-since-the-pieces-come-together-without-fantastic-levels-of-extrapolation theory is, someone stumbled on an idea one day, maybe in a stuffy committee meeting, or maybe in a bar, to solve the problem by giving the people what they wanted... end-to-end encrypt everything... and go from encryption at rest, which is basically nothing, to encryption everywhere; and you instantaneously divest the massive, massive burden of owning all that readable data. True, now "accidentally" forgetting the `s` in backend URLs doesn't let the NSA read everything anymore, but that kind of pales in comparison to being able to incontrovertibly, mathematically prove that, since the data really is encrypted before it leaves the device, there really is no chance any readable plaintext is leaking and potentially being stored; so if the nation states would kindly take stock of this situation and point the coherence death ray beams elsewhere that would be great since we are kind of on fire here at the moment and it's too hOT we are meLTING-- Getting this to catch on was obviously difficult. Anybody that can scare multi-billion dollar companies obviously has the skill to steer collective opinion and impression at scale. Whoever came up with the idea to piggyback on top of individual privacy is... a task-focused genius, I'll put it that way. On the one hand, the idea has scaled beautifully: all the tech folks have gone "Is private. Respects freedom. Og like." and loudly pushed for the idea everywhere they can. And from a sociopolitical perspective, the narrative is faultless and blameless, which is where the genius definitely shines through. The first bit I can't say I like is the narrative appearance of first-class support for end-to-end encryption as a Scientific Advancement™. It's not. It's an implementationally-scoped, crowd control spin campaign to increase datacenter security beyond what disk encryption at rest can ever achieve. The scale of wreckage in the form of technically minded people who really believe the privacy narrative is disillusioning to see. The other bit that I find unamusing is the long-term shifts in the attack landscape that will result from this. Specifically the fact that, an Eye Of Sauron style adversary is not ultimately going to care what their attack target is, or how to attack it, only that it gets vaporised. End-to-end encryption shifts the burden of responsibility to the owner of the server to the owner of the client. I can see the positive angle here from a think-tank standpoint - literal decentralization as a defence strategy - but still, Android/iOS are now the focus of some laser beams that were terrifying a bunch of rather large companies. Maybe it'll seem reasonable to heavily fund the vulnerability research scene to maintain a favorable status quo, and we'll see some impressive hacks going forward (or, er, we won't). Or maybe things are already "that bad" and I don't have anything to worry about. But considering that users are now that much more responsible for devices that are interesting in a way they were never before, this whole strategy kinda feels irresponsible to me if you squint at it from a certain angle. At the same time, it might ironically be ensuring our survival. In this picture, law enforcement really is the afterthought. It's well known the law court system doesn't understand technology and is 20 (40? 50?) years in the past. That situation extends beyond the courts though, with law enforcement generally in the same position. But it's worse than it may at first seem, because the notion of "the past" that refer to a collective public interpretation of "now" doesn't do justice to the technological development that has happened at these companies over the last 5-10 years - these private companies are internally fighting battles of a complexity that the public law enforcement system cannot hope to comprehend, let alone help with. In this fight, the best way to avoid World War 4 is to encrypt everything. But Washington is still getting over how cool they handled the Cold War, and the police still think it's "hard" and "complicated" and "special" to "hack phones".

radoslawc 6y ago

If reason for that blog post was to get famous. Well I'd day mission accomplished. I haven't heard about Cellebrite before.

Throwaway1771 6y ago
Infamous.

scrps 6y ago

I've made it even easier for Cellebrite... Have access to unlocked phone?: yes Enabled signal backup?: yes Copied key to decrypt backup?: yes Downloaded Xeals signal backup decryptor from github[1]?: yes Decrypted backup?: yes Contacted BBC to inform them you "cracked" signal's encryption?: check Profit [1]: https://github.com/xeals/signal-back https://github.com/xeals/signal-back

tempfs 6y ago

This whole thing was just BBC clickbait and Cellebrite advertising to the idiots in law enforcement. No one that actually knows even a tiny bit about how shit works believed the story for even a moment.

el_dev_hell 6y ago

From the original blog post: > After getting the decryption key, we now needed to know what decryption algorithm to use. We went back to Signal’s open-source code and found this: > Seeing that told us that Signal uses AES encryption in CTR mode. We used our decryption key with the AES encryption in CTR mode and decrypted the attachment files. Was this supposed to be satire?

aemreunal 6y ago
In the undying words of Bender from Futurama: Oh wait, you're serious. Let me laugh even harder https://www.youtube.com/watch?v=_n5E7feJHw0 https://www.youtube.com/watch?v=_n5E7feJHw0

methodsignature 6y ago

Signal seems a bit of a jerk company. They should have "stayed above the fray". Instead, they ridiculed. They were in their rights to do so but should have been the better. Throwing insults, however well grounded, is never good for a brand and shows a lack of level-headedness. They could have simple stated the story is a non-story and stated why. This could have been paired with working with the BBC to get a retraction in place, taught someone at BBC something, and maybe even gotten a little free positive PR from them in the process.

OJFord 6y ago

No, I Cannot Take This Case Seriously.