3 ms·

claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite

by ycomnews2021 5y ago

claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in custody). Or 12/23/2019 at 2:00PM (before you bought the phone). If the dates on the data in Cellebrite can't be aligned to the dates of the actual events AND the last modification of the device was AFTER you last had control of it, nothing can be trusted from it.

btilly 5y ago
No, that is not the problem. The problem is that a report about a phone scanned on 2020-02-01 can be altered by a phone scanned on 2020-05-01 to say that there was porn when there wasn't. Oh, and that scan left a running program which will cause 5% of the phones scanned after that to randomly also claim porn that is not on the device. Therefore if a single phone with Signal was scanned at the kiosk, NOTHING from that kiosk can be trusted.
- ycomnews2021 5y ago
  This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action. If the USER could select the action, for research purposes, that might a different story.
  - btilly 5y ago
    Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did. If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".
    - myself248 5y ago
      Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it. Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.
      - _kbh_ 5y ago
        The vulnerabilities allow for code execution in the context of the Cellebrite application via the parsing of a video file. It doesn’t matter what the application was designed to do, you can now make it do anything you want just by getting it to scan a phone with a malicious video on it.
      - ycomnews2021 5y ago
        Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content. In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.

btilly 5y ago

No, that is not the problem. The problem is that a report about a phone scanned on 2020-02-01 can be altered by a phone scanned on 2020-05-01 to say that there was porn when there wasn't. Oh, and that scan left a running program which will cause 5% of the phones scanned after that to randomly also claim porn that is not on the device. Therefore if a single phone with Signal was scanned at the kiosk, NOTHING from that kiosk can be trusted.

ycomnews2021 5y ago
This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action. If the USER could select the action, for research purposes, that might a different story.
- btilly 5y ago
  Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did. If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".
  - myself248 5y ago
    Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it. Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.
    - _kbh_ 5y ago
      The vulnerabilities allow for code execution in the context of the Cellebrite application via the parsing of a video file. It doesn’t matter what the application was designed to do, you can now make it do anything you want just by getting it to scan a phone with a malicious video on it.
    - ycomnews2021 5y ago
      Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content. In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.