3 ms·

>wasting their time I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change a

>wasting their time I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.

zenexer 6y ago
> anything running on your device Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.
- javajosh 6y ago
  I would expect the toolsets to converge over time. That is, I can't imagine a tool that a LEO would have access to that I would not. Nor can I imagine a tool they might have that I would not want to use myself. That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.
  - zenexer 6y ago
    I'm not entirely sure that makes sense here. If I understand correctly, Cellebrite mostly just provides an interface and degree of automation designed for law enforcement; you could, in theory, retrieve the same data on your own without Cellebrite, just without the LEO-centric UX. Depending on the device, I would think the tools to which you have access likely make more sense for a consumer's use case. Even for someone getting a bit more technical and tinkering with their device, tools like `adb` are fairly powerful on their own.
- polar 6y ago
  > devices seized by law enforcement Not exclusively[1]. [1] https://www.cellebrite.com/en/business-solutions/ https://www.cellebrite.com/en/business-solutions/
  - zenexer 6y ago
    Is it actually common for such hardware to be used in civil cases? I'm not sure I'm keen on someone crawling through all my data and potentially storing it indefinitely--including data with security implications (session cookies, partially-decrypted data from password managers, who knows what else) just because they managed to reach the discovery phase of a civil case.
alisonkisk 6y ago
Using an example of hacking into data that is already directly available is silly. It would be interesting if they did that to something restricted, like a Netflix movie.
- segfaultbuserr 6y ago
  +1. If what they were working on was not Signal but some proprietary applications (possibly with DRM), the hilarious blog post on their "code cracking" effort can actually be a legitimate one. In principle, the process is the same - break into something when you are root already. The only difference is the challenge of code obfuscation - which is a real one, unlike Signal.
  - bigiain 6y ago
    I greatly look forward to hearing Cellebrite executives doing jailtime for DMCA violations stemming from Hollywood or the music industry going after them in court for removing encryption on copyrighted material... (I can dream, right?)
yorwba 6y ago
Exactly. I've so far decrypted my own messages from two different apps because I needed some specific information that would've been too hard to find without RegExp-capable search. In both cases I was glad to find guides online explaining how to pull the database, get the decryption key and decrypt the database with the key. It may seem trivial from a security perspective since it doesn't involve breaking any cryptography, just using a decryption key as intended, but in practice the ability to get a plain-text dump of all messages is very useful.

>wasting their time I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.

zenexer 6y ago

> anything running on your device Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.

javajosh 6y ago
I would expect the toolsets to converge over time. That is, I can't imagine a tool that a LEO would have access to that I would not. Nor can I imagine a tool they might have that I would not want to use myself. That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.
- zenexer 6y ago
  I'm not entirely sure that makes sense here. If I understand correctly, Cellebrite mostly just provides an interface and degree of automation designed for law enforcement; you could, in theory, retrieve the same data on your own without Cellebrite, just without the LEO-centric UX. Depending on the device, I would think the tools to which you have access likely make more sense for a consumer's use case. Even for someone getting a bit more technical and tinkering with their device, tools like `adb` are fairly powerful on their own.
polar 6y ago
> devices seized by law enforcement Not exclusively[1]. [1] https://www.cellebrite.com/en/business-solutions/ https://www.cellebrite.com/en/business-solutions/
- zenexer 6y ago
  Is it actually common for such hardware to be used in civil cases? I'm not sure I'm keen on someone crawling through all my data and potentially storing it indefinitely--including data with security implications (session cookies, partially-decrypted data from password managers, who knows what else) just because they managed to reach the discovery phase of a civil case.

alisonkisk 6y ago

Using an example of hacking into data that is already directly available is silly. It would be interesting if they did that to something restricted, like a Netflix movie.

segfaultbuserr 6y ago
+1. If what they were working on was not Signal but some proprietary applications (possibly with DRM), the hilarious blog post on their "code cracking" effort can actually be a legitimate one. In principle, the process is the same - break into something when you are root already. The only difference is the challenge of code obfuscation - which is a real one, unlike Signal.
- bigiain 6y ago
  I greatly look forward to hearing Cellebrite executives doing jailtime for DMCA violations stemming from Hollywood or the music industry going after them in court for removing encryption on copyrighted material... (I can dream, right?)

yorwba 6y ago

Exactly. I've so far decrypted my own messages from two different apps because I needed some specific information that would've been too hard to find without RegExp-capable search. In both cases I was glad to find guides online explaining how to pull the database, get the decryption key and decrypt the database with the key. It may seem trivial from a security perspective since it doesn't involve breaking any cryptography, just using a decryption key as intended, but in practice the ability to get a plain-text dump of all messages is very useful.