3 ms·

This is unlikely to be the case, despite the vulnerabilities that are described. The process of e-discovery is rife with risks of this sort. When you forensica

by wglb 6y ago

This is unlikely to be the case, despite the vulnerabilities that are described. The process of e-discovery is rife with risks of this sort. When you forensically collect data from a random set of devices from a party that may or may not have porn, HIPAA, GDPR, sample viruses, malware, who know what all. The short version of it even if the inhaling of this data crashes the device, there are mitigations and protections that will allow the evidence to be ultimately produced. A crash of the windows host in collection will not invalidate the case. disclosure: ex-CSO of Relativity, leading provider of e-discovery software.

Zak 6y ago
The vulnerability claimed here doesn't necessarily crash the computer running the software. It runs arbitrary code, and said code is able to modify the data Cellebrite extracts. It is not clear whether it is possible to detect whether data collected in the past is compromised. There may be mitigations, but without knowing the full details of the exploit, it sounds a lot like reasonable doubt to me. A good lawyer would spin it exactly that way, putting any cases without sufficient corroborating evidence in jeopardy.
- wglb 6y ago
  If the data is off on another server, it seems unlikely that past cases can be compromised. There are a whole set of rules about challenging evidence, including electronic evidence. Keep in mind that the other side gets a crack at it also. It is unlikely that the whole case would be thrown out because of a corrupted file. Reasonable doubt is not part of the forensic process--this is what a jury needs to consider to render a verdict. As pointed out elsewhere, many uses of this tool are extrajudicial.
  - holtalanm 6y ago
    > If the data is off on another server, it seems unlikely that past cases can be compromised. That isn't the point being made here. The data could have been compromised at the point of when it was gathered, not any time later.

by wglb 6y ago

Zak 6y ago

The vulnerability claimed here doesn't necessarily crash the computer running the software. It runs arbitrary code, and said code is able to modify the data Cellebrite extracts. It is not clear whether it is possible to detect whether data collected in the past is compromised. There may be mitigations, but without knowing the full details of the exploit, it sounds a lot like reasonable doubt to me. A good lawyer would spin it exactly that way, putting any cases without sufficient corroborating evidence in jeopardy.

wglb 6y ago
If the data is off on another server, it seems unlikely that past cases can be compromised. There are a whole set of rules about challenging evidence, including electronic evidence. Keep in mind that the other side gets a crack at it also. It is unlikely that the whole case would be thrown out because of a corrupted file. Reasonable doubt is not part of the forensic process--this is what a jury needs to consider to render a verdict. As pointed out elsewhere, many uses of this tool are extrajudicial.
- holtalanm 6y ago
  > If the data is off on another server, it seems unlikely that past cases can be compromised. That isn't the point being made here. The data could have been compromised at the point of when it was gathered, not any time later.