4 ms·

Here's the other fun thing to consider about this story.... Do you think Signal is the first or only one to set traps for Cellebrite?

ruined 6y ago
probably. cellebrite is really a police-level tool, and the people who worry about it are journalists, activists, and petty criminals, none of whom really have the resources to find or deploy something like this. if a state agent is worried about this kind of thing they just carry a clean device, and for most of them if they are ever in a situation where their device is inspected, the game is already over.
- exikyut 6y ago
  > if a state agent is ... ever in a situation where their device is inspected, the game is already over. (I don't think the above summarization alters the intent of your statement.) IMO, if you're at "state agent" level, well, just about all the countries either have the manufacturing capacity, either locally or through agency partnership with ally countries, to construct devices capable of maintaining a clean the appearance even while being examined with very expensive equipment. For example, you could probably do a lot if you could replace the 0th-stage bootloader in the NAND controller. And NAND is manufactured at such crazy scale, the one-off test runs probably wouldn't be all that expensive, and the turnaround time might even be weeks to days.
- buzer 6y ago
  Well, to me that sounds like it would be a very juicy target for other nation states. Country A does not like country B, country B is known to often use these devices and many of their "victims" are persons of interest for country A's intelligence organizations. Those people know it so they don't travel to country A or take special precautions, but because country B is friendly, they don't do the same things. So country A puts the exploit to couple of people's phones and they travel to country B. Country B scans the devices and now the only issue country A has now is how they will exfiltrate the data without raising alarms.
- hansel_der 6y ago
  > cellebrite is really a police-level tool it's widely used by phone-shop- and carrier service staff to migrate data.

ruined 6y ago

probably. cellebrite is really a police-level tool, and the people who worry about it are journalists, activists, and petty criminals, none of whom really have the resources to find or deploy something like this. if a state agent is worried about this kind of thing they just carry a clean device, and for most of them if they are ever in a situation where their device is inspected, the game is already over.

exikyut 6y ago
> if a state agent is ... ever in a situation where their device is inspected, the game is already over. (I don't think the above summarization alters the intent of your statement.) IMO, if you're at "state agent" level, well, just about all the countries either have the manufacturing capacity, either locally or through agency partnership with ally countries, to construct devices capable of maintaining a clean the appearance even while being examined with very expensive equipment. For example, you could probably do a lot if you could replace the 0th-stage bootloader in the NAND controller. And NAND is manufactured at such crazy scale, the one-off test runs probably wouldn't be all that expensive, and the turnaround time might even be weeks to days.
buzer 6y ago
Well, to me that sounds like it would be a very juicy target for other nation states. Country A does not like country B, country B is known to often use these devices and many of their "victims" are persons of interest for country A's intelligence organizations. Those people know it so they don't travel to country A or take special precautions, but because country B is friendly, they don't do the same things. So country A puts the exploit to couple of people's phones and they travel to country B. Country B scans the devices and now the only issue country A has now is how they will exfiltrate the data without raising alarms.
hansel_der 6y ago
> cellebrite is really a police-level tool it's widely used by phone-shop- and carrier service staff to migrate data.