3 ms·
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence w
by ycomnews2021 5y ago
The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where the evidence was collected, until when its presented to the court, no one modified it.
But these type of vulnerabilities present a problem, in that reading the device could/would modify timestaps of the data captured. The solution is to not use Cellebrite, there are lots of forensic analysis tools. To be effective Signal would need to exploit the major vendors equally.
- qwertox 5y ago> To be effective Signal would need to exploit the major vendors equally. Maybe they could, and that would be the problem. Cellebrite's case now raises the issue of what will happen to those decisions where Cellebrite's products were used. This can void those court decisions retroactively, which could also happen to any major vendor in the next couple of years. In any case, I doubt that this will make them stop using their products.
- _wldu 5y agoMost forensic analysts use write blockers when capturing an image of a device to ensure data integrity (no tampering). If Cellebrite altered something during extraction, investigation, etc. it would be easy to go back to the original image (collected with the aid of a write blocker) or the device itself to show that discrepancy. Edit - For the uninitiated: https://www.geeksforgeeks.org/write-blockers-an-introduction/ https://www.geeksforgeeks.org/write-blockers-an-introduction...
- ycomnews2021 5y agoThe modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited. You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.
- _wldu 5y agoExactly, but it could be easily proven that the data was tampered with as you still have the original/clean image and the device itself. So if they are altering data, it can be shown.
- ycomnews2021 5y agoI'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is built around the tainted data they could argue that everything from that source (system/lab/department) should be thrown out and that the experts who collected it can't be trusted anymore due to incompetence. Sounds like a prosecutors worst nightmare.
- _wldu 5y agoRight and if they have a file or group of files that are central to the case, all the accused has to do is say, "those were not on my phone" and then the 'experts' go back and look at the read-only image to verify. If the phone could have been altered to add data before a forensic image was acquired in a way that looks like it was via normal use (reasonable timestamps, browser logs, etc.) then we'd have a real problem. Cellebrite potentially being used to do this as it reads the image is not that problem.
- sjy 5y agoThis doesn’t apply to mobile devices, since it’s not feasible to remove the internal storage device and take a bit-perfect image of it using another computer. You need to plug the device into a Cellebrite kiosk, trust Cellebrite to send read-only commands over the USB interface, and trust the device firmware not to write data when it receives those commands.
- WrtCdEvrydy 5y ago> trust Cellebrite to send read-only commands over the USB interface, and trust the device firmware not to write data when it receives those commands. So most of these suites really just automate the backup extraction process and the automated analysis piece. In the real world, you don't interface down at the USB interface other than just to kick off a backup (think an iTunes or adb backup) of the device and just grab it via USB then extract it on your computer and analyze it.
- WrtCdEvrydy 5y agoA point of contention as someone who uses write blockers and forensic tools... write blockers protect the connection of dumb storage to a computer but a phone is not a dumb storage device (it's not a SATA drive), it's actually a full device which manages it's own storage. For mobile forensics, it's actually done through the built-in backup systems included in each of the major OS providers (Android/iOS). This is a back and forth that has been ongoing since we began moving away from Hard Disks, as SSDs tend to manage their own internal state so an image of "an SSD" can change even if the underlying media hasn't changed as the SSD cell balancing can actually shift around deleted data or delay to clear certain cells.
- ycomnews2021 5y agoThese are great points. Thanks!
- WrtCdEvrydy 5y agoWell, I'm a forensics researcher, so thank you. If you'd like to know about the current issues around mobile device acquisition, you can check this out (https://ieeexplore.ieee.org/document/9116458 https://ieeexplore.ieee.org/document/9116458) which contains the last paper I wrote on the latest issues on iOS and Android acquisitions. Although I'd love to blame the big bad Cellebrite and the big bad police departments for junk science, computer forensics is quick to dismiss scientifically unsound items so I would expect a response from Cellebrite soon.
- outworlder 5y ago> To be effective Signal would need to exploit the major vendors equally. I bet they could. Any industry that's shrouded in secrecy tend not to have the sort of incentives that would ensure better security practices.