13 ms·

Reliability of police mobile phone evidence questioned after hack

252 points by donohoe 6y ago

sodality2 6y ago
Related post: "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer" https://news.ycombinator.com/item?id=26891811 https://news.ycombinator.com/item?id=26891811 Blog post from moxie: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
- DyslexicAtheist 6y ago
  in the US some blowback is on the way too: https://twitter.com/mtmdlawyer/status/1386733853298069505 https://twitter.com/mtmdlawyer/status/1386733853298069505 (imho) sobering thoughts on this to consider: https://twitter.com/meganmcgraham/status/1385328533711450114 https://twitter.com/meganmcgraham/status/1385328533711450114
cto_of_antifa 6y ago
always carry a book
thrower123 6y ago
I was on a jury in the US for a case where the prosecution used text messages as a large chunk of how they tried (very badly) to make their case. Screenshots taken from one party's device, with sporadic timestamps, no indications whether messages could have been deleted. It was a farce, I'd disbar someone who tried to make a case on such a flimsy reed.
- londons_explore 6y ago
  You would hope that if there were other messages which said the same story differently, the defence would have brought them to court. Unfortunately, I don't have faith in all defence lawyers to do this kind of thing - some "free because you're poor" lawyers might spend only 20 minutes per case...
  - Waterluvian 6y ago
    It's because they are overworked and underresourced. Public defenders are some of the best people our legal systems have. Another possibility is that the investigators fail to share evidence as required.
    - londons_explore 6y ago
      In many cases investigators don't look very hard for evidence which makes their case fall apart. Imagine a murder case where the accused claims he was at the cinema at the time. Often the police won't go to the cinema and get CCTV tapes to back up the claim - they'll just use blurry footage from the murder scene and claim "looks kinda like the same guy ish". I suspect there are a lot of cases of innocent people in prison simply because evidence of them being innocent was deliberately overlooked or not collected.
      - speeder 6y ago
        We had a case in Brazil that was both sad and absurdly silly. A woman was found murdered in a cemetery. She was in town for a university-related festival/party, and was staying temporarily with some other students. The police suspected the other students first, and went to their house, and found out: 1. One was an RPG player, had RPG books. 2. The other was a heavy metal fan and had heavy metal-related posters. 3. The other guy was into literature and had some 'dark' literature. So conclusion of the officers: it was a satanic cult, and the woman was killed in a "RPG Satanic Ritual" The prosecutor's office at first went with it too. Later, already mid-trial, the prosecutor changed, the new prosecutor found a lot more formerly-useful now useless evidence that the police seemly deliberately ignored: 1. The police had in evidence storage some bloodied clothes that they never ran DNA tests on, the DNA was now useless (it has been years since the actual murder). Also the evidence was probably contaminated, the storage consisted of stuffing all the evidence in trash bags and leaving them in a random room in the police station. 2. People told the police multiple times, that the woman had drug debts, but they were ignored. 3. A known drug dealer was seen on the day past the murder, riding a bike around town, with his t-shirt having red stains on it, police even seen the guy themselves, and didn't bother stopping him and checking his t-shirt. The new prosecutor despite seeing all this, had hands tied and just went along with what the police wanted, and tried to prove in court that they were "satanists". The ruling was this (the judge was quite upset at it too): 1. The prosecution failed to prove they were satanists, evidence pointed out to the accused living there by coincidence, and their hobbies being "dark" or "fantasy" were coincidence too, only one of them was an RPG player, only one of them was a heavy metal fan, and so on, they didn't shared their hobbies with each other. 2. And even if they WERE satanists (they weren't), in Brazil being a satanist is not a crime. 3. For some reason the prosecution provided zero evidence that was actually related to the murder, they only tried to prove the accused were satanists and presumed this would be enough to know they were the murderers, but they never tried to link the accused with the crime scene, didn't even tried to explain when they would been at the cemetery.
- tantalor 6y ago
  Can you elaborate on "whether messages could have been deleted"?
  - thrower123 6y ago
    Some of the exchanges seemed rather nonsensical, to my mind, like there were pieces missing. It's not like the default Android SMS app indicates that messages have been deleted. And there was no provenance information provided as to where or when they were collected.
    - neodymiumphish 6y ago
      This is a difficulty that comes with most law enforcement interactions with victims, now. For example, the military is required to offer an attorney to a victim before conducting an interview. Often, these attorneys jump straight to "you can't have any evidence from my victim" without a detailed description of what you're seeking. This usually means we can only get screenshots from his/her phone of conversations between victim and subject, along with any contemporaneous conversations with other witnesses. I hate this, because screenshots come out looking like trash and it's very difficult with most messaging apps to show the timestamps for all messages. Eventually, this pendulum is going to swing (when cases start getting thrown out for this lack of timestamps/evidence of deleted messages, etc) and law enforcement (at least in the military environment) will have a bit more support in pulling relevant (and only relevant) data from victim devices for the purpose of evidence collection. One additional thing about screenshots: They can be totally faked, and the "contact" can't be validated from conversation screenshots. For example, if you buy a burner phone, you can create a whole conversation as though the burner phone is the assailant, then change the contact's number to the real assailant. Some chat apps keep the whole conversation, despite the number change, in the same chat and make it impossible to tell which number sent the messages. Cellebrite indicates the number (assuming we're talking about SMS here) where the message came from, even if the contact changes.
      - tfehring 6y ago
        Military law enforcement is going to have more leeway to conduct warrantless searches of the devices of people who haven’t even been accused of a crime? On what basis? I’m skeptical, but if you’re right that’s horrifying.
- thathndude 6y ago
  Lawyer here. I’d hope the Defense lawyer raised a slew of objections. There are serious foundation, authenticity, and chain of custody issues here. On top of that, another way around this is under the confrontation clause. The accused has the right to question any witnesses against them. So I’d demand to cross examine the “tech” that ran the scan and make it apparent that no one knows how the box works (that’s the whole point; it’s proprietary). And then ask them simple questions like “cookies images have been placed on my clients device if no one knows how the box works?” The real advantage of these celebrite boxes, for law enforcement, that they give them leads to otherwise admissible evidence. So that’s why I’m shocked to hear that they actually tried to use information from the phone.
  - omgwtfbyobbq 6y ago
    And then ask them simple questions like “cookies images have been placed on my clients device if no one knows how the box works?” I'm sure the answer to that would be delicious. ;)
    - meowster 6y ago
      I imagine it was an autoincorrect of "could imagines have..."
      - dylan604 6y ago
        or even an autoincorrect of "could images have..."
        generalizations 6y ago
        I thought it was "could these images have..."
      - salawat 6y ago
        >could imagines have... Auto-correct was a mistake. Either that or a malicious undertaking cleverly disguised in the cloak of legitimate best intentions. Could images have.
tupac_speedrap 6y ago
It is an advisory panel so I suspect Police Scotland will just ignore them or do some vague measure to look like they are doing something about it.
drdec 6y ago
Is this really different from the police taking a physical file folder and adding or removing pieces of paper? Isn't the point that the people operating the software and collecting the evidence are the ones that are supposed to safeguard it against tampering? Is there any type of evidence that could stand up if we no longer trust the people handling it?
- darkpicnic 6y ago
  I don't think this analogy works. I think it is more akin to police opening a folder and seeing paper evidence, but having no idea who put the paper there, when it was last opened/modified and unable to determine if the evidence is legitimate. For me, this story isn't about fear that police could leverage the bugs to manipulate a case. It's about the constant fear that laymen rely on unverified "experts" to put people behind bars for years.
  - deleted 6y ago
    [deleted]
  - an_opabinia 6y ago
    Yes, but you can’t join (“intersectionality”) your campaign against ad tech companies with a campaign against the police if you’re this busy being intellectually honest.
  - chris37879 6y ago
    Since the bug allows for arbitrary code execution, it's more akin to the officer reading the piece of paper and by doing so, he becomes the subject of some sort of curse that completely controls his actions.
    - KirillPanov 6y ago
      You mean like a bribe offer? I think investigative corruption is a pretty good analogy.
- jedimastert 6y ago
protoman3000 6y ago
Couldn’t you always claim that malware caused the offending clicks/placed the illegal files on your disk and is hiding/obfuscating itself so well that it’s not detectable by forensic methods? What’s the logic here to still get the criminal?
- deleted 6y ago
  [deleted]
- edenhyacinth 6y ago
  "Your honour, I think you'll find that someone broke into my house and planted drugs" This type of logic has been used plenty in court, it being in your possession, digital or not, is sufficient. The claim here is that due to the vulnerabilities Cellebrite has, the offending item may never have been on your device. This is more similar to saying that the images the police took in your house of drugs were kept on an unsecured server, there are recorded vulnerabilities for it, and therefore the images could have been digitally edited to show drugs where none were present.
  - dylan604 6y ago
    Possesion is 9/10ths goes both ways
- sjy 6y ago
  Yes, and it’s not an uncommon defence in child pornography cases. Similarly, you can always claim that the police framed you by lying about the device being found in your possession, or not being tampered with between seizure and forensic analysis. It is up to the jury to decide whether the defence gives rise to a reasonable doubt. The standard is not as high as most technically-minded people think. Juries can convict defendants on the uncorroborated testimony of a single witness: https://newrepublic.com/article/152305/who-to-believe-sexual-assault https://newrepublic.com/article/152305/who-to-believe-sexual...
  - giantg2 6y ago
    Yep, and society tends to view defendants as guilty from start.
ikonst 6y ago
It's the news article that was already widely published and a local take (not by any government body, "campaigners have called") in Scotland.
ycomnews2021 6y ago
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where the evidence was collected, until when its presented to the court, no one modified it. But these type of vulnerabilities present a problem, in that reading the device could/would modify timestaps of the data captured. The solution is to not use Cellebrite, there are lots of forensic analysis tools. To be effective Signal would need to exploit the major vendors equally.
- qwertox 6y ago
  > To be effective Signal would need to exploit the major vendors equally. Maybe they could, and that would be the problem. Cellebrite's case now raises the issue of what will happen to those decisions where Cellebrite's products were used. This can void those court decisions retroactively, which could also happen to any major vendor in the next couple of years. In any case, I doubt that this will make them stop using their products.
- _wldu 6y ago
  Most forensic analysts use write blockers when capturing an image of a device to ensure data integrity (no tampering). If Cellebrite altered something during extraction, investigation, etc. it would be easy to go back to the original image (collected with the aid of a write blocker) or the device itself to show that discrepancy. Edit - For the uninitiated: https://www.geeksforgeeks.org/write-blockers-an-introduction/ https://www.geeksforgeeks.org/write-blockers-an-introduction...
  - ycomnews2021 6y ago
    The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.
    - 6y ago
KuroSaru 6y ago
IT is also know in the forensics community. that on older burner style phones. cellebrite can fail to retrieve all messages. No tool is perfect and frankly Forensics tools are tested for repeatability not for potential exploits. Zip bombs would crash FTK until version 2 came out.

252 points by donohoe 6y ago

Related post: "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer" https://news.ycombinator.com/item?id=26891811 https://news.ycombinator.com/item?id=26891811 Blog post from moxie: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/

DyslexicAtheist 6y ago
in the US some blowback is on the way too: https://twitter.com/mtmdlawyer/status/1386733853298069505 https://twitter.com/mtmdlawyer/status/1386733853298069505 (imho) sobering thoughts on this to consider: https://twitter.com/meganmcgraham/status/1385328533711450114 https://twitter.com/meganmcgraham/status/1385328533711450114

cto_of_antifa 6y ago

always carry a book

thrower123 6y ago

I was on a jury in the US for a case where the prosecution used text messages as a large chunk of how they tried (very badly) to make their case. Screenshots taken from one party's device, with sporadic timestamps, no indications whether messages could have been deleted. It was a farce, I'd disbar someone who tried to make a case on such a flimsy reed.

londons_explore 6y ago
You would hope that if there were other messages which said the same story differently, the defence would have brought them to court. Unfortunately, I don't have faith in all defence lawyers to do this kind of thing - some "free because you're poor" lawyers might spend only 20 minutes per case...
- Waterluvian 6y ago
  It's because they are overworked and underresourced. Public defenders are some of the best people our legal systems have. Another possibility is that the investigators fail to share evidence as required.
  - londons_explore 6y ago
    In many cases investigators don't look very hard for evidence which makes their case fall apart. Imagine a murder case where the accused claims he was at the cinema at the time. Often the police won't go to the cinema and get CCTV tapes to back up the claim - they'll just use blurry footage from the murder scene and claim "looks kinda like the same guy ish". I suspect there are a lot of cases of innocent people in prison simply because evidence of them being innocent was deliberately overlooked or not collected.
    - speeder 6y ago
      We had a case in Brazil that was both sad and absurdly silly. A woman was found murdered in a cemetery. She was in town for a university-related festival/party, and was staying temporarily with some other students. The police suspected the other students first, and went to their house, and found out: 1. One was an RPG player, had RPG books. 2. The other was a heavy metal fan and had heavy metal-related posters. 3. The other guy was into literature and had some 'dark' literature. So conclusion of the officers: it was a satanic cult, and the woman was killed in a "RPG Satanic Ritual" The prosecutor's office at first went with it too. Later, already mid-trial, the prosecutor changed, the new prosecutor found a lot more formerly-useful now useless evidence that the police seemly deliberately ignored: 1. The police had in evidence storage some bloodied clothes that they never ran DNA tests on, the DNA was now useless (it has been years since the actual murder). Also the evidence was probably contaminated, the storage consisted of stuffing all the evidence in trash bags and leaving them in a random room in the police station. 2. People told the police multiple times, that the woman had drug debts, but they were ignored. 3. A known drug dealer was seen on the day past the murder, riding a bike around town, with his t-shirt having red stains on it, police even seen the guy themselves, and didn't bother stopping him and checking his t-shirt. The new prosecutor despite seeing all this, had hands tied and just went along with what the police wanted, and tried to prove in court that they were "satanists". The ruling was this (the judge was quite upset at it too): 1. The prosecution failed to prove they were satanists, evidence pointed out to the accused living there by coincidence, and their hobbies being "dark" or "fantasy" were coincidence too, only one of them was an RPG player, only one of them was a heavy metal fan, and so on, they didn't shared their hobbies with each other. 2. And even if they WERE satanists (they weren't), in Brazil being a satanist is not a crime. 3. For some reason the prosecution provided zero evidence that was actually related to the murder, they only tried to prove the accused were satanists and presumed this would be enough to know they were the murderers, but they never tried to link the accused with the crime scene, didn't even tried to explain when they would been at the cemetery.
tantalor 6y ago
Can you elaborate on "whether messages could have been deleted"?
- thrower123 6y ago
  Some of the exchanges seemed rather nonsensical, to my mind, like there were pieces missing. It's not like the default Android SMS app indicates that messages have been deleted. And there was no provenance information provided as to where or when they were collected.
  - neodymiumphish 6y ago
    This is a difficulty that comes with most law enforcement interactions with victims, now. For example, the military is required to offer an attorney to a victim before conducting an interview. Often, these attorneys jump straight to "you can't have any evidence from my victim" without a detailed description of what you're seeking. This usually means we can only get screenshots from his/her phone of conversations between victim and subject, along with any contemporaneous conversations with other witnesses. I hate this, because screenshots come out looking like trash and it's very difficult with most messaging apps to show the timestamps for all messages. Eventually, this pendulum is going to swing (when cases start getting thrown out for this lack of timestamps/evidence of deleted messages, etc) and law enforcement (at least in the military environment) will have a bit more support in pulling relevant (and only relevant) data from victim devices for the purpose of evidence collection. One additional thing about screenshots: They can be totally faked, and the "contact" can't be validated from conversation screenshots. For example, if you buy a burner phone, you can create a whole conversation as though the burner phone is the assailant, then change the contact's number to the real assailant. Some chat apps keep the whole conversation, despite the number change, in the same chat and make it impossible to tell which number sent the messages. Cellebrite indicates the number (assuming we're talking about SMS here) where the message came from, even if the contact changes.
    - tfehring 6y ago
      Military law enforcement is going to have more leeway to conduct warrantless searches of the devices of people who haven’t even been accused of a crime? On what basis? I’m skeptical, but if you’re right that’s horrifying.
thathndude 6y ago
Lawyer here. I’d hope the Defense lawyer raised a slew of objections. There are serious foundation, authenticity, and chain of custody issues here. On top of that, another way around this is under the confrontation clause. The accused has the right to question any witnesses against them. So I’d demand to cross examine the “tech” that ran the scan and make it apparent that no one knows how the box works (that’s the whole point; it’s proprietary). And then ask them simple questions like “cookies images have been placed on my clients device if no one knows how the box works?” The real advantage of these celebrite boxes, for law enforcement, that they give them leads to otherwise admissible evidence. So that’s why I’m shocked to hear that they actually tried to use information from the phone.
- omgwtfbyobbq 6y ago
  And then ask them simple questions like “cookies images have been placed on my clients device if no one knows how the box works?” I'm sure the answer to that would be delicious. ;)
  - meowster 6y ago
    I imagine it was an autoincorrect of "could imagines have..."
    - dylan604 6y ago
      or even an autoincorrect of "could images have..."
      - generalizations 6y ago
        I thought it was "could these images have..."
    - salawat 6y ago
      >could imagines have... Auto-correct was a mistake. Either that or a malicious undertaking cleverly disguised in the cloak of legitimate best intentions. Could images have.

tupac_speedrap 6y ago

It is an advisory panel so I suspect Police Scotland will just ignore them or do some vague measure to look like they are doing something about it.

drdec 6y ago

Is this really different from the police taking a physical file folder and adding or removing pieces of paper? Isn't the point that the people operating the software and collecting the evidence are the ones that are supposed to safeguard it against tampering? Is there any type of evidence that could stand up if we no longer trust the people handling it?

darkpicnic 6y ago
I don't think this analogy works. I think it is more akin to police opening a folder and seeing paper evidence, but having no idea who put the paper there, when it was last opened/modified and unable to determine if the evidence is legitimate. For me, this story isn't about fear that police could leverage the bugs to manipulate a case. It's about the constant fear that laymen rely on unverified "experts" to put people behind bars for years.
- deleted 6y ago
  [deleted]
- an_opabinia 6y ago
  Yes, but you can’t join (“intersectionality”) your campaign against ad tech companies with a campaign against the police if you’re this busy being intellectually honest.
- chris37879 6y ago
  Since the bug allows for arbitrary code execution, it's more akin to the officer reading the piece of paper and by doing so, he becomes the subject of some sort of curse that completely controls his actions.
  - KirillPanov 6y ago
    You mean like a bribe offer? I think investigative corruption is a pretty good analogy.
jedimastert 6y ago

protoman3000 6y ago

Couldn’t you always claim that malware caused the offending clicks/placed the illegal files on your disk and is hiding/obfuscating itself so well that it’s not detectable by forensic methods? What’s the logic here to still get the criminal?

deleted 6y ago
[deleted]
edenhyacinth 6y ago
"Your honour, I think you'll find that someone broke into my house and planted drugs" This type of logic has been used plenty in court, it being in your possession, digital or not, is sufficient. The claim here is that due to the vulnerabilities Cellebrite has, the offending item may never have been on your device. This is more similar to saying that the images the police took in your house of drugs were kept on an unsecured server, there are recorded vulnerabilities for it, and therefore the images could have been digitally edited to show drugs where none were present.
- dylan604 6y ago
  Possesion is 9/10ths goes both ways
sjy 6y ago
Yes, and it’s not an uncommon defence in child pornography cases. Similarly, you can always claim that the police framed you by lying about the device being found in your possession, or not being tampered with between seizure and forensic analysis. It is up to the jury to decide whether the defence gives rise to a reasonable doubt. The standard is not as high as most technically-minded people think. Juries can convict defendants on the uncorroborated testimony of a single witness: https://newrepublic.com/article/152305/who-to-believe-sexual-assault https://newrepublic.com/article/152305/who-to-believe-sexual...
- giantg2 6y ago
  Yep, and society tends to view defendants as guilty from start.

ikonst 6y ago

It's the news article that was already widely published and a local take (not by any government body, "campaigners have called") in Scotland.

ycomnews2021 6y ago

The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where the evidence was collected, until when its presented to the court, no one modified it. But these type of vulnerabilities present a problem, in that reading the device could/would modify timestaps of the data captured. The solution is to not use Cellebrite, there are lots of forensic analysis tools. To be effective Signal would need to exploit the major vendors equally.

qwertox 6y ago
> To be effective Signal would need to exploit the major vendors equally. Maybe they could, and that would be the problem. Cellebrite's case now raises the issue of what will happen to those decisions where Cellebrite's products were used. This can void those court decisions retroactively, which could also happen to any major vendor in the next couple of years. In any case, I doubt that this will make them stop using their products.
_wldu 6y ago
Most forensic analysts use write blockers when capturing an image of a device to ensure data integrity (no tampering). If Cellebrite altered something during extraction, investigation, etc. it would be easy to go back to the original image (collected with the aid of a write blocker) or the device itself to show that discrepancy. Edit - For the uninitiated: https://www.geeksforgeeks.org/write-blockers-an-introduction/ https://www.geeksforgeeks.org/write-blockers-an-introduction...
- ycomnews2021 6y ago
  The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.
  - 6y ago

KuroSaru 6y ago

IT is also know in the forensics community. that on older burner style phones. cellebrite can fail to retrieve all messages. No tool is perfect and frankly Forensics tools are tested for repeatability not for potential exploits. Zip bombs would crash FTK until version 2 came out.