6 ms·
Just link to the original blog post by Moxie instead? https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
by nanna 6y ago
Just link to the original blog post by Moxie instead?
https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
- nanna 6y ago> We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future. Love it.
- boomboomsubban 6y agoCellebrite's terrible response is also noteworthy. Responding to claims of vulnerabilities by saying you "save lives" and don't sell to sanctioned countries shows how seriously they take security.
- matheusmoreira 6y agoSignal saves lives too. No doubt certain users would be assassinated if their messages were intercepted.
- steve76 6y agoyeah, like pedophiles.
- celticninja 6y agoDoesn't even have to be assassinated, just plain old killed for being gay or imprisoned for saying something negative about the regime.
- mylons 6y agoThanks — the writing in the gizmodo article is pretty bad.
- S_A_P 6y agoMoxies response is pretty brilliant. Sounds like cellbrite has a lot of patching to do and a potential lawsuit from Apple to defend.
- teclordphrack2 6y agoSounds like cellbrite has a criminal investigation coming their way. While there is a chance that the code made its way to them in a way that they would only be civilly liable I find it hard to believe that there was not some action that delved into the criminal realm.
- robthebrew 6y agoI worked for Apple 10+ years ago, and cellebrite was used by Apple Geniuses in Store for data recovery. It doesn't surprise me at all that here is Apple code in it.
- lainga 6y agoConsidering they use Cellebrite, do you think they were aware of the Apple assets being bundled but decided to say nothing as long as it wasn't made public? (i.e. as long as they did not have a copyright to defend or lose)
- nisegami 6y agoYou're thinking of trademarks. They don't have to do anything about use of their copyrighted materials if they don't want to.
- alasdair_ 6y agoApple make a big deal about being a privacy-focused company. Right now, Apple code is being used to invade people’s privacy. They “have to” address this or it becomes a PR issue for them.
- anonAndOn 6y agoPossibly. The spotlight is also now on Apple to explain if parts of iTunes is being used to incriminate persecuted groups (journalists, homosexuals, activists, etc) what are they going to do about it?
- BasilPH 6y ago> In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files. I assume those images are going to be for the benefit of somebody looking at data extracted through Cellebrite?
- Y_Y 6y agoProbably they'll be the files that he talks about earlier which exploit the Cellebrite machine and fuck up all the reports. Or maybe it's just nothing.
- gnfargbl 6y agoIf this isn't merely a joke, and these proposed files are intended to contain Cellebrite exploits of some kind, then please, Moxie, let us have an opt out? As it stands, if law enforcement for some bizarre reason decide to examine my personal devices, there will be nothing on there of interest to them. If Signal start bundling exploits onto my device, that will no longer be the case. That's a potential risk to me, and Signal should be asking my permission before taking the risk.
- spaceribs 6y agoI probably broke 10 laws/regulations without knowing it just this morning before coffee, what makes you think you know you're "innocent"?
- celticninja 6y agoDont think of them as cellebrite exploits but as Signal security features. Yes you have nothing to hide, but the police in many cases aren't honest. What if you live in the Middle east and are gay, you use signal, this protects you. Cellebrite are happy to sell their product to oppressive regeimes and if you are black the US police could be considered oppressors.
- nextstep 6y agoor the discussion about the original blog post: https://news.ycombinator.com/item?id=26891811 https://news.ycombinator.com/item?id=26891811
- dang 6y agoDiscussed here and still on the front page: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer - https://news.ycombinator.com/item?id=26891811 https://news.ycombinator.com/item?id=26891811 - April 2021 (293 comments and counting)
- deleted 6y ago[deleted]