4 ms·
Signal CEO Hacks Cellebrite iPhone Hacking Device Used by Cops
- twobitshifter 6y ago> In their analysis of the device, Signal researchers also found that it contained packages signed by Apple, and likely extracted from the Windows installer for iTunes version 12.9.0.167. According to Marlinspike, this could be a copyright violation. Cellebrite will need a good legal team. I expected them to have some deep exploit but it looks like they’re just using Apple’s own code against them.
- rdtwo 6y agoI bet Apple isn’t really interested in making a big stink and still let this go
- alsetmusic 6y agoPrior discussion: https://news.ycombinator.com/item?id=26891811 https://news.ycombinator.com/item?id=26891811
- not1ofU 6y ago"Marlinspike published details about the exploits outside of normal "responsible disclosure"" No deets published, this ^ is a lie.
- wglb 6y agoDisagree. He published that it uses old version of FFMPEG. A simple google search leads me to https://www.cvedetails.com/vulnerability-list/vendor_id-3611/Ffmpeg.html https://www.cvedetails.com/vulnerability-list/vendor_id-3611.... And https://security.googleblog.com/2014/01/ffmpeg-and-thousand-fixes.html https://security.googleblog.com/2014/01/ffmpeg-and-thousand-... Not clear what other deets one would need.
- not1ofU 5y agoFair, but you had to search for it, and the results are publised by someone else, but I supposed that's just semantics.
- wglb 5y agoTo be fair, I remember the fuzz project from back when it was done. My point is that I feel that this is enough of a disclosure, since it was such a broken piece of software.