3 ms·

I assume most likely these are being used to defeat/render ineffective one of Cellebrite’s features. By having other (benign) data travel alongside your data...

I assume most likely these are being used to defeat/render ineffective one of Cellebrite’s features. By having other (benign) data travel alongside your data... it makes it harder for an attacker to know what data is “useful”.

hatsunearu 6y ago
No... if you read the article carefully, the outline goes something like this: 1. We found a cellebrite kit that "dropped out from the back of a van" (yeah right lol) 2. Cellebrite is a tool to extract data out of phones (general intro to what Cellebrite is) 3. Looks like Cellebrite is using a bunch of open source libraries and they also use Apple DLLs (???!!!) 4. Oops looks like they are using like YEARS old libraries and there are hundreds of KNOWN vulnerabilities on each of those libraries. 5. Oops looks like the vulnerabilities allow ACE. Here's a demo where we placed a carefully crafted file with the ACE payload on a phone where if you just click the scan button on Cellebrite's software, you can do ACE (this is the video in the middle of the article) 6. (by the way for cellebrite users) this calls into question all data extracted with Cellebrite since these exploits are trivially exploitable. There are so many exploits possible so you can use any of them to create ACE attacks. 7. For COMPLETELY TOTALLY UNRELATED AESTHETIC REASONS we are putting some files on the Signal app. You're welcome! --- to spell it out: yes, they are putting ACE payloads on Signal to try to crash investigators/spies/whatever trying to use Cellebrite on phones with the Signal app.
- pieter_mj 6y ago
  I like 6 a lot, could be an avenue for legal refutation of obtained evidence (in a supposed crime or other illegal activity), 7 is a bit unnecessary.
  - SAI_Peregrinus 6y ago
    Not at all! 7 is actually a lot more subtle, I didn't get it at first. They're putting some files on some signal phones, somewhat randomly, and only those which seem like they've been in active normal use since before this disclosure. So likely none of the devices Cellbrite might own for testing, and no device Cellbrite might buy in the future, but some random set of existing devices in the field. And there might be multiple such files, so even if Cellbrite find one they can't be sure they've got them all. Now assume these files are (as somewhat implied) exploits that cause the falsification of data in all current and future reports issued by a given Cellbrite device. That means that if a Cellbrite has, after this point, ever scanned a phone with Signal installed it might be issuing false reports. THAT means that there's a reasonable doubt in any evidence obtained by the use of a Cellbrite device, going forward. That gives an easy out to defense attorneys in the US, where Cellbrite devices are used by police to gather evidence. Any defense attorney can now argue that evidence obtained from a Cellbrite shouldn't be admitted in court, since they don't maintain forensic integrity. This essentially spoils Cellbrite's entire business in the US (and any other country with similar standards for the admissibility of evidence). So Cellbrite has to find ALL the exploits in their system, and be very, very sure they've not missed any. Because defense attorneys will then try to call that into doubt. Etc.

hatsunearu 6y ago

No... if you read the article carefully, the outline goes something like this: 1. We found a cellebrite kit that "dropped out from the back of a van" (yeah right lol) 2. Cellebrite is a tool to extract data out of phones (general intro to what Cellebrite is) 3. Looks like Cellebrite is using a bunch of open source libraries and they also use Apple DLLs (???!!!) 4. Oops looks like they are using like YEARS old libraries and there are hundreds of KNOWN vulnerabilities on each of those libraries. 5. Oops looks like the vulnerabilities allow ACE. Here's a demo where we placed a carefully crafted file with the ACE payload on a phone where if you just click the scan button on Cellebrite's software, you can do ACE (this is the video in the middle of the article) 6. (by the way for cellebrite users) this calls into question all data extracted with Cellebrite since these exploits are trivially exploitable. There are so many exploits possible so you can use any of them to create ACE attacks. 7. For COMPLETELY TOTALLY UNRELATED AESTHETIC REASONS we are putting some files on the Signal app. You're welcome! --- to spell it out: yes, they are putting ACE payloads on Signal to try to crash investigators/spies/whatever trying to use Cellebrite on phones with the Signal app.

pieter_mj 6y ago
I like 6 a lot, could be an avenue for legal refutation of obtained evidence (in a supposed crime or other illegal activity), 7 is a bit unnecessary.
- SAI_Peregrinus 6y ago
  Not at all! 7 is actually a lot more subtle, I didn't get it at first. They're putting some files on some signal phones, somewhat randomly, and only those which seem like they've been in active normal use since before this disclosure. So likely none of the devices Cellbrite might own for testing, and no device Cellbrite might buy in the future, but some random set of existing devices in the field. And there might be multiple such files, so even if Cellbrite find one they can't be sure they've got them all. Now assume these files are (as somewhat implied) exploits that cause the falsification of data in all current and future reports issued by a given Cellbrite device. That means that if a Cellbrite has, after this point, ever scanned a phone with Signal installed it might be issuing false reports. THAT means that there's a reasonable doubt in any evidence obtained by the use of a Cellbrite device, going forward. That gives an easy out to defense attorneys in the US, where Cellbrite devices are used by police to gather evidence. Any defense attorney can now argue that evidence obtained from a Cellbrite shouldn't be admitted in court, since they don't maintain forensic integrity. This essentially spoils Cellbrite's entire business in the US (and any other country with similar standards for the admissibility of evidence). So Cellbrite has to find ALL the exploits in their system, and be very, very sure they've not missed any. Because defense attorneys will then try to call that into doubt. Etc.