5 ms·

Is this really different from the police taking a physical file folder and adding or removing pieces of paper? Isn't the point that the people operating the so

• darkpicnic 5y ago
  I don't think this analogy works. I think it is more akin to police opening a folder and seeing paper evidence, but having no idea who put the paper there, when it was last opened/modified and unable to determine if the evidence is legitimate. For me, this story isn't about fear that police could leverage the bugs to manipulate a case. It's about the constant fear that laymen rely on unverified "experts" to put people behind bars for years.
  • deleted 5y ago
    [deleted]
  • an_opabinia 5y ago
    Yes, but you can’t join (“intersectionality”) your campaign against ad tech companies with a campaign against the police if you’re this busy being intellectually honest.
  • chris37879 5y ago
    Since the bug allows for arbitrary code execution, it's more akin to the officer reading the piece of paper and by doing so, he becomes the subject of some sort of curse that completely controls his actions.
    • KirillPanov 5y ago
      You mean like a bribe offer? I think investigative corruption is a pretty good analogy.
• jedimastert 5y ago
  The vulnerabilities also proved that a third party could tamper with evidence without the police detecting it.
• alias_neo 5y ago
  I'm not sure you can draw parallels here. Who are the people "handling it", Cellebrite, the police? The vulnerability allows any device plugged in to the "kiosk" with a malicious file to do anything it wants to any existing report on the "kiosk" as well as plant code for future execution in order to do anything else it wants. Let's assume the device which does this does so silently, at what point are the police or Cellebrite supposed to know nothing in the kiosk can be relied on, ever? With a piece of paper on the other hand, the other sheets in the folder don't suddenly rot when you add a maliciois sheet of paper, although this does sound like an interesting and potentially novel attack vector.
  • drdec 5y ago
    > The vulnerability allows any device plugged in to the "kiosk" with a malicious file to do anything it wants to any existing report on the "kiosk" as well as plant code for future execution in order to do anything else it wants. It is not clear from the article that analyzing a phone with malicious files will trigger the issue, unbeknownst to the operator. (E.g. it says "it is possible to execute code that...", etc.) However, I'll take your word for it and assume it was poor reporting in this case. That does change things, thanks for the clarification.
    • alias_neo 5y ago
      You're correct, the reporting is pretty poor, Moxie's own account of this on the Signal blog[1] is better. [1] https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
• kschwab 5y ago
  Probably a better analogy is that the back door to the evidence room that leads outside has been unlocked for an extended period of time.
  • fuzzylightbulb 5y ago
    "Probably a better analogy is that the back door to the evidence room that leads outside has been unlocked for an extended period of time." And the evidence logs are written in pencil
• syshum 5y ago
  High Trust vs Low Trust society. Clearly we are entering a time of Low Trust Society, and the institutions have only themselves to blame as they have abused the populations trust for decades only now with free flow of information are regular people able to directly see the abuse that has existed for a very very long time. We used to have a High Trust society, not because the people in power were trust worthy but because the people in power directly controlled the information. This is no longer the case, and as that power is shifting we are now seeing the people that control information today looking for ways to retain that control and instead of allowing it to flow freely inject their own filters into the streams.
  • smhost 5y ago
    you have it almost exactly backwards. we haven't lived in a high trust society (as you defined it) since before the protestant reformation, when the printing press liberated information that had been previously monopolized by the church. we're returning to a high trust society out of necessity because of economic forces that incentivize information asymmetry.
    • _jal 5y ago
      Pretty sure the difference of opinion between the last two comments comes down to differing understandings of the word 'trust', and very different time scales.
    • giantg2 5y ago
      Government is increasingly transparent compared to past history. You can see that in things like right to know, freedom of information, etc. There are still information issues in both discovery and presentation. The public trust is still very low. https://www.pewresearch.org/politics/2020/09/14/americans-views-of-government-low-trust-but-some-positive-performance-ratings/ https://www.pewresearch.org/politics/2020/09/14/americans-vi...
    • gnarbarian 5y ago
      I love that you are considering things on that scope but there are still many high trust areas in the US. Small towns that are culturally and ethnically homogenous with fewer transients are almost always high trust. It's pointless to steal someone's car in a town of 30 families. everyone would know exactly where it went. You also know exactly who you are doing harm to so your sense of sympathy kicks in making you less likely to do it. These tight knit low population towns seem to naturally create a high-trust honor culture. Small towns have a higher level of social integration so wronging someone creates repercussions that flow back to the perpetrator through every one of their social bonds.
• deleted 5y ago
  [deleted]
• simion314 5y ago
  From my understanding, police could scan phone A, if phone A had the malicious code then the scanner is infected, now when scanning phone B the results are invalid, it could always show a "All OK" message or it could plant evidence. There was a news on the first page a few days ago where many postal workers were put in jail because of a software bug - so we know for sure if a computer says X the "experts" will confirm it. The first thing this Celerbrite dudes need to do is to guarantee that the device gets a full reset before each use. We as society we need to force our police and government to use only open source software, otherwise we don't know what backdoors or shit this guys put in, we could evaluate the code and see if we are wrongfully convicted by a shitty algorithm and transparency would also prevent (hopefully) people selling some open source software with a logo and a python script for milions.
  • JumpCrisscross 5y ago
    > if phone A had the malicious code then the scanner is infected, now when scanning phone B the results are invalid I think it was more insidious. Police scans phone A and stores a log. Police scan phone B with said code on it, which infects the scanner. This code not only tampers with the logs for phone B, but goes back and tampers with the logs for phone A. There is thus no log that one can definitively say represents the true state of any scanned phone at the time it was scanned.
• ycomnews2021 5y ago
  Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents. The crazy thing about this attack, is the person making the copy may never know until its presented in court and challenged. Then everything from the folder has to be thrown out.
  • nucleardog 5y ago
    > Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents. Turns out that's actually a real thing... https://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning https://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres...
• outworlder 5y ago
  > Is this really different from the police taking a physical file folder and adding or removing pieces of paper? I wish we would stop trying to come up with analogies to computing concepts. But since you insist: this is like the file folder came from Harry Potter and could be possessed by an evil spirit that could change the contents without your knowledge.
  • Isthatablackgsd 5y ago
    We can't stop using analogies. It helps us to bridge the information and use it as a reference to get a better understanding of it. Analogies help those people are not familiar with the jargon or the field of study. You may be an expert in the computing concept, but the rest of us are not an expert in that field. Analogies is where it helps to understand it better. So the answer is no, we can't stop using analogies.
• betterunix2 5y ago
  Actually, we do not fully trust the police to handle evidence, which is why evidence bags with tamper-evident seals are supposed to be used, along with chain-of-custody records. There have been problems in the past with evidence tampering and sometimes it results in large numbers of cases being retried or verdicts being overturned because the invalidated evidence was so central to the prosecutor's case that a retrial would not be worth it. The problem here is that the "tampering" may not even involve the people handling the evidence, which allows a defense attorney to cast plenty of doubt on the evidence without having to challenge police procedures at all (after all, it could be that the evidence was corrupted by some random third party that has nothing to do with the case -- so why should the jury pay any attention to it?).
• bena 5y ago
  The problem is that in this case, is that the act of collecting that piece of paper can cause other pieces of paper to appear or disappear not only in this file, but in every file in the building and you won't know if it happened or not. At that point, you cannot trust any of the files in the building. It's not a matter of operator error. This exploit works during normal operation of the software in question, it depends on the software being operated in a typical fashion. It's not a choice of the person running the software. The only choice is to stop running the software. It also calls into question all evidence ever collected by this program because we can't know if some other company already figured this out or not.
• m463 5y ago
  It is more like opening a folder to look for evidence and encountering a spring-loaded creme pie that hits you in the face and knocks the contents and all the folders in the room onto the floor in one big mixed-up pile.
• chris37879 5y ago
  Sorta. Here's what's actually going on, sticking to your folder analogy: This would be more like if, upon an officer reading the paper, some arcane force caused them to die, or change what was on the paper, or add or remove some papers. Or _literally anything else in the cops scope of power_. Because that's what this does, it lets the data on a suspect's device potentially cause the software to run arbitrary code with elevated permissions, practically, you could use this to craft a packet of data that, when read by Cellebrite's software, simply shuts off the machine, or kills the Celebrite software, or, worse, connects to the internet and downloads some other payload to do something else. Cause there's no way these machines aren't connected to the internet at some point since the software validates its license that way.