22 ms·

I have a lot to say about Signal’s Cellebrite hack

367 points by curmudgeon22 5y ago

BoorishBears 5y ago
Most of this was better left unsaid. So many words to state the obvious that like, for example, this would be illegal? Did the coy language not tip you off to the fact they realize that? Then suddenly trying to champion Cellbrite as the reason we something as anti-privacy as backdoor mandates and encryption bans while at the same we're already seeing countries inch towards that? And then seriously, acting like because Cellbrite is being used against rioters somehow this was a bad time for Signal to point out the fact that Cellbrite is an insecure pos on top of it's dubious intended purpose?? Didn't I just go through 1000 words explaining why what Signal did won't matter anyways? - This whole thing just reads like someone who needed to go "well actually", it's not really saying anything novel or interesting, and in the pursuit of defending Cellebrite of all things, it makes some pretty dubious connections.
- mrlatinos 5y ago
  Career academics just like to hear themselves talk. The gender pronouns in the author's Twitter bio told me everything I needed to know.
WrtCdEvrydy 5y ago
I disagree with this. Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode. I would be interested in seeing this go in front of a court because Signal isn't directly targeting any specific person, and the files are fine until they are processed through a specific broken pipeline. If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. You cannot repackage vulnerabilities for police and then turn around and play coy because you're not able to keep your software up to date. In the defense attorney section, the argument shouldn't be about the PoC but the fact that the PoC shows that Cellebrite's software is outdated and could be compromised. You can specifically ask for the backup that was extracted from the mobile device to be analyzed by third party software.
- vxNsr 5y ago
  This is false, there are laws about booby traps (they’re generally illegal in all jurisdictions). If you plant mines on your property and a thief walks onto your lawn and loses a leg, he can sue you and will likely win with a competent lawyer. You don’t get to say “well you shouldn’t have been there”
  - wearywanderer 5y ago
    Traps that harm people are illegal. Traps that harm animals are legal under some circumstances (mousetraps are legal basically everywhere afaik.) But traps that harm devices rather than people or animals? Are you sure that is generally illegal?
  - knaik94 5y ago
    Laws on booby traps specify that the trap be used to cause harm to a living thing. It's not a booby trap if it wasn't meant to harm someone. So the digital booby trap isn't governed by the same laws.
    - Waterluvian 5y ago
      I agree. But that law demonstrates the concept.
  - WrtCdEvrydy 5y ago
    booby traps that cause harm are illegal, someone stealing my phone who cuts themselves on a broken piece of glass from the screen can't argue "it's a booby trap"
    - failwhaleshark 5y ago
      This is true. Also, if you add hidden buttons that alter the way a data port works to either disable or enable it, or fry a device attached to it, this isn't intentional harm caused to police equipment specifically. It is a deterrent-after-the-fact, a protection, and a personal choice to modify one's own device without targeting anyone in particular and not intentionally, unexpectedly causing bodily harm.
grendelt 5y ago
Signal announced they have the know-how to disrupt any Cellebrite-extracted files and then likely sprinkled "poison pill" files in their data. So if a Cellebrite user was to extract data from a Signal user's phone, the data would corrupt Cellebrite's data. This simply disrupts trust in Cellebrite. Nothing illegal. All Moxie is saying is "Don't want potentially corrupted data? Don't use Cellebrite." It absolutely is retribution for Cellebrite coming at Signal.
- upofadown 5y ago
  I guess this is different in the USA, but in a lot of places, spreading FUD in an attempt to harm a business could be considered defamatory. It might not even matter if what is being said is true if there is no positive social purpose to the statements.
  - marcos100 5y ago
    Is it FUD if he shows a PoC?
  - salawat 5y ago
    There is a positive social purpose to his statements. Innocents may be coerced into confessing or pleading guilty to crimes they didn't commit. Ensuring not one innocent gets steamrolled by the judicial system is a positive social purpose. Whether or not you consider it compelling enough to be worth it is another question. I unwaveringly acknowledge the positive value to what he has done. If you can't come out and prove there is nothing dirty or worthy of doubt with the tools you're using to strip someone of their freedom and liberty, you have no business using it. Period. As a society, we've compromised on a high standard for this far too long.
josephg 5y ago
Does the Cellebrite device exploit hacks in iOS? My understanding is that iOS shouldn't ever allow something plugged in over USB to read data on the device like this. I've been assuming the only reason they continue to work is that they found some unpatched vulnerabilities in iOS, and that Apple hasn't been able to obtain a cellebrite device to reverse engineer so they can fix the bugs. But if Signal got one, I'd be surprised if Apple couldn't. (Or if Signal wants to really stick it to cellebrite, they should loan their device to apple so apple can fix the security holes that cellebrite exploits.)
- lights0123 5y ago
  That's why Apple added Settings -> Face ID & Passcode -> Allow access when locked: USB Accessories. They set it off by default because they know there is some vulnerability involving USB, but they don't know what it is.
- scrose 5y ago
  The author mentions that Cellebrite is only able to extract data from the phone as if it was the equivalent of someone taking screenshots of everything while going through an already unlocked phone, just in an automated way. So my immediate guess is that they’re not really exploiting something, but who knows!
  - saagarjha 5y ago
    Doing just that in an automated fashion requires at least one iOS exploit. Cellebrite, of course, has many.
vxNsr 5y ago
I said this at the time, the things Signal was saying it might do were so clearly illegal that it was more for the naive star-struck blog reader than anything else. It got a lot of play here and Reddit bec they eat this nonsense up. But any lawyer will tell you that by disclosing this vuln in the way they did Signal only opened themselves up to lawsuits. If they do hire in house counsel the first that guy would tell this is “call Cellbrite and tell them exactly what the vuln is and how to mitigate it.”
- vlovich123 5y ago
  If that were the case, why doesn’t the same principle apply to Cellebrite? After all, they exploit vulnerabilities in lots of software to deliver their own services and there’s no indication they share their work with the vendors.
  - vxNsr 5y ago
    Because they don’t plant boobytraps in their wake. Signal isn’t saying “we’re just hacking into property we have a legal right to access” (which is what LE is doing in the US) they’re essentially saying “we’re gonna hack and damage government property and police evidence”
    - ambicapter 5y ago
      Sure, that's what the article is claiming, but I don't see how Cellebrite is "government" or "police".
      - nearbuy 5y ago
        Cellebrite, the company, wouldn't be the one getting hacked. It's the police agencies' equipment that could potentially get hacked.
  - alisonkisk 5y ago
    You're asking why lawful search and seizure is OK but obstruction of justice is not. Intent matters in the law.
pmccarren 5y ago
From my experience, most _independently_ owned cell phone retail stores (Verizon, Sprint, AT&T, etc) have several Cellebrite devices no site which are used daily to aid in device migration from old to new. As I understand it, Cellebrite devices are not exactly hard to acquire.
- kstrauser 5y ago
  They have multiple devices. The thing T-Mobile buys to help you upgrade your phone isn’t the same one the FBI buys to hack it.
knaik94 5y ago
I am a little confused on why the author makes a distinction between Cellebrite using zero-days to hack a phone to read data and Signal's hack. While the US government might have the framework to not be considered violating CFAA, what about when other governments use Cellebrite? From this point of view, Cellebrite isn't a valve that's stopping back door decryption in systems, it is the back door. Signal including these files is in a sense covering a back door. Also, is leaving a file that breaks the admissibility of previously gathered evidence considered active hacking? Am I misunderstanding something about the function of the files in Signal? I thought the only way Cellebrite's software is interacted with is if it tries to access Signal on the device. Signal isn't actively searching to hack back. It's triggered by Cellebrite's software, not Signal's. The straightforward workaround would be to delete Signal before using the Cellebrite software which I think is the real point. Signal isn't trying to protect the end user actively and can't do anything if it's not installed on a phone.
- tptacek 5y ago
  In the US, Cellebrite extractions are done under color of law; for the same reason, the police don’t get in trouble for forcing open locked doors while executing search warrants.
  - atat7024 5y ago
    > Cellebrite extractions are done under color of law Until they find they're in the wrong house. Or that a warrant is invalid.
  - sneak 5y ago
    > In the US, Cellebrite extractions are done under color of law Are you sure that is the case 100% of the time? Bars on my door keep out burglars as well as hinder police serving a warrant. Even if Signal does deploy these files (no evidence thus far that they have deployed Cellebrite exploits, as their blog post was careful not to claim that), the vast majority of them (just like deadbolts) will not be used to hinder search warrants.
- vxNsr 5y ago
Jaygles 5y ago
>My guess is that it’s pretty rare that the Cellebrite evidence is the dispositive crux of a case, meaning, but for evidence pulled from a phone using a Cellebrite device, the jury would not have voted to convict. Let's also consider cases that could have warrants that would not have been approved if the integrity of the data from a Cellebrite extraction was questionable. I could see some defense lawyers challenge the validity of warrants from this.
- alisonkisk 5y ago
  No way. "I put a file on my device whose only purpose is to obstruct justice" does not cancel probable cause for a search.
  - ambicapter 5y ago
    I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?
  - cyphar 5y ago
    The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.
    - salawat 5y ago
      Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.
smeej 5y ago
The standard in U.S. criminal courts is "beyond a reasonable doubt." All I understood Moxie's original article to be doing was sowing that seed of "reasonable doubt." Is it now reasonable, based on Moxie's article, to doubt that information obtained by a Cellebrite device from a device running Signal is reliable? If I were a juror, I would probably think so. That doesn't at all mean someone couldn't be convicted on the strength of other evidence, but if the primary evidence the prosecution relied on was Cellebrited off a phone running Signal, I'd have some trouble trusting it enough to render a guilty verdict.
- tptacek 5y ago
  Multiple legal experts have chimed in, all suggesting that this is unlikely to impact cases. People on HN might assume that the existence of a vulnerability strongly implies that it will have been exploited in every case where it is relevant, but that's not how normal people think, and in this case, the normal people are closer to the truth than the nerds are.
  - roywiggins 5y ago
    It seems to me that a malicious boobytrapped file did it is really just a subset of I was hacked, which is neither new defense nor (I assume) a particularly successful one.
  - KMag 5y ago
    But what about the vulnerability as an indicator of the general quality and reliability of the tool? Casting doubt as to the ability of the tool to generally be accurate and specifically maintain proper chain of custody documentation would seem to be a reasonable legal defense tactic. I would expect a defense lawyer to say something like "The tool so confuses its input that it can mistake message data for its own internal instructions. How certain can we be that it has properly analyzed its inputs and maintained the necessary chain-of-custody metadata, and provided adequate protections against evidence tampering? If a police officer were unable to tell the difference between his or her own thoughts and things he or she had read, we would dismiss him or her as a reliable witness."
adrr 5y ago
If what signal is doing illegal then how do tv satellite provides get away pushing malicious updates on their feeds? Before you claim that cellebrite is only used by law enforcement, signal got their hands on a device and cellebrite sells to other governments besides the US. I should legally allowed to protect my device from foreign adversary from stealing my company’s trade secrets.
- tptacek 5y ago
  They owned the devices they were hacking with their feeds. That’s why the hack worked to begin with: they controlled the code on the cards.
  - adrr 5y ago
    I’d claim they didn’t own the cards. When they send out new cards to replace the H cards, they didn’t have us send them back. They abandoned the property and no longer can claim ownership.
    - tptacek 5y ago
      Since they abandoned the cards in part by disabling them, I'm not sure the Law of the Briny Deep does a lot of lifting for you here.
      - adrr 5y ago
        Besides being abandoned when they upgraded. You actually owned the card because they came with receivers when you purchased them from brick and Mortar stores. No agreement on the purchase. You called to activate them. Satellite providers also fried the receivers as well by burning all writes on flash memory that held the firmware. So that $500 directivo receiver could get hosed during an exploit.
        tptacek 5y ago
        The cards literally had "this is the property of NDS and must be surrendered upon request" printed on them. You're reaching.
stefan_ 5y ago
Jesus, what a depressing post. We must allow the existence of shitty "backup" software because otherwise they'll just mandate backdoors? Have you already given up? How about citizens have an expectation of integrity in using their computation devices that the state may not infringe upon. The state buying these tools and using them, in what is often a constitutional gray area, is harming all of us by making our devices less secure.
- colordrops 5y ago
  For real, Stanford should be embarrassed.
  - qualudeheart 5y ago
    The post seems very unprofessionally written. It is unfortunate that they publish this trash!
cwmartin 5y ago
It looks like the linked post may have been taken down. There is a mirror here https://web.archive.org/web/20210513030656/https://cyberlaw.stanford.edu/blog/2021/05/i-have-lot-say-about-signal’s-cellebrite-hack https://web.archive.org/web/20210513030656/https://cyberlaw.....
kstrauser 5y ago
Eh, I can’t be bothered to care. Cellebrite hoards 0-days so they can use them to hack phones. They know about exploitable vulnerabilities but aren’t saying anything about them because they profit from insecurity. Thing is, just because Cellebrite knows about a thing doesn’t mean, say, China’s CCP or the Russian mafia or anyone else doesn’t also know about that thing. You and I are less safe just because Cellebrite wants to profit off of those vulnerabilities. I just can’t work up the ability to sympathize with Cellebrite. The law may have something to say about Moxie’s writing, but in my opinion he has the clear ethical upper ground in this argument.
- markus_zhang 5y ago
  Is there a way to further damage its profitability and force it to release 0-day in a legal way?
  - kstrauser 5y ago
    If/when I am appointed Lord Emperor, I would absolutely enforce the Computer Fraud and Abuse Act against the officers of such companies. Unless an audit could prove that every single one of their customers was a legitimate law enforcement organization, I’d go with the default assumption that they’re black hat hackers who happen to have a couple of legal sales. Let them prove otherwise. Note that this is one of many, many reasons it’s unlikely that I’ll ever be appointed Lord Emperor.
    - lsh123 5y ago
      The fact that Signal got their hands on a copy of the Cellebrite product makes “let them prove otherwise” disclaimer a moot point ;)
      - salawat 5y ago
        Not necessarily. That could have been an unused loaner from an anonymous law enforcement quartermaster who had a moment of conscience. Cellebrite, as I recall hearing (Or was it StingRay?) have pretty strict non-disclosure license terms; I doubt Cellebrite knowingly sold one to Moxie.
coretx 5y ago
And the Cellebrite/Signal sockpuppet/commercial continues... Can anyone please wake me up when actual (0day) code is reversed ? Because so far its all speculation, theory crafting and blah blah - in case somebody didn't notice.
kodablah 5y ago
> This blog post was plainly written in order to impress and entertain other hackers and computer people. But other hackers aren’t the real target audience; it’s lawyers and judges and the law enforcement agencies Says who? The intentional ambiguity may have had multiple audiences, quite possibly including computer people that handle the use of these products, their procurement, or their adversarial study.
Dylovell 5y ago
As an American, I see this as a right to bear arms in the modern day.
batch12 5y ago
Well now that folks know how the software works, I'm surprised nobody has set up a public repo with similar files-- especially since the exploits for a lot of these older vulnerabilities are already out there.
ambicapter 5y ago
> The timing looks kinda fash Who is this fucking clown?
dannyw 5y ago
IMO law enforcement as a whole is evil, particularly on a global lev. So anything that messes with law enforcement, as a whole, is good with me. I think it's an opinion that messing with law enforcement is _bad_.
failwhaleshark 5y ago
I worked with a guy at a startup who wrote and designed a Mac hacking system that exploited Firewire because it can read memory directly. Firewire is basically a security nightmare like several other peripheral interfaces (Wikipedia says "PCI Express, PC Card, ExpressCard, FireWire [yeap], PCI, and PCI-X") Thunderbolt 4 allegedly includes mitigations to prevent arbitrary DMA transactions and Thunderspy. https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulnerability_to_DMA_attacks https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulner... Btw, partial list of USB attacks: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/ https://www.bleepingcomputer.com/news/security/heres-a-list-... https://www.sciencedirect.com/science/article/pii/S0167404817301578 https://www.sciencedirect.com/science/article/pii/S016740481...
MrManatee 5y ago
The article says that "it should be pretty straightforward for law enforcement to disprove an accusation about the Cellebrite machine", because they can perform the same extraction with another vendor's machine and compare the results. But if some app actually decided to use this hack, then wouldn't it be likely that in addition to modifying the contents of the data dump it would also modify the on-device data? In that case it wouldn't matter if the other vendors have vulnerabilities, since the device itself was already compromised.
- batch12 5y ago
  The most interesting version of this exploit (to me) would be one that wiped the device being examined. Edit: changed disruptive to interesting. There could be many many more disruptive versions...
  - Sephr 5y ago
    Quite the 'aesthetically pleasing' side-effect for sure.
- tedunangst 5y ago
  Tell it to the jury I guess. "Yes, of course there's evidence of a crime on my phone, but actually I put it there just to trick the police."
  - MrManatee 5y ago
    Or: "If there is any evidence of a crime on my phone, it was probably planted there by a version of Cellebrite that got infected with a virus when you scanned someone else's phone with it."
    - PeterisP 5y ago
      The sentence would be true iff your replace "probably" with "possibly". But - as the original article states - that's not sufficient. The defence may try to assert that this is the case, which may cause that possibilty to be investigated in more detail, but such a statement would not automatically disqualify the evidence without something more substantial, merely asserting that such a possibility exists isn't enough. E.g. such a claim might result in a forensic analysis of that Cellebrite computer, and if the analysis indicates that it indeed got infected with a virus when scanning someone else's phone, that's likely cause all the evidence to be questioned, but again, even in that case there may be other ways than the Cellebrite logs to confirm that this evidence was indeed on your phone (the original article asserts this as well).
lettergram 5y ago
My only complaint in this otherwise entertaining and informative read was the politics... For the record, the rioters weren’t seditionists (no charges anyways), nor were most (all) fascists (they were pro constitution), nor did they intend to overthrow the government (they wanted a election fraud looked into as they believe there was a coup via ballot stuffing) - not justifying actions or agreeing FYI. Just correcting the record. And two I believe moxie said why he hacked them? Wasn’t it because they said they could get signal messages? > I also don’t like seditious fascists, and I think the people who tried to violently overthrow our democratically-elected government should be caught and held accountable. And the timing of this blog post kinda makes it look like Moxie — who is famously an anarchist — is giving the fascists ammunition in their legal cases to try to get off the hook. As said, I don’t think it’ll work, and even fascists deserve due process and not to be convicted on the basis of bug-riddled spy machines, but it’s helpful to them nonetheless.
nxpnsv 5y ago
With that argument, How is what cellbright is doing legal? Is it just that they are not responsible for actions taken by their users?
dotBen 5y ago
I wouldn't find a website where professional lawyers opine on startups and programming especially compelling. I don't find HN threads where tech folk opine on what their opinion of how the law should be interpreted to be especially compelling either. This is especially true here where I note that the author of the post folks are commenting on has an incredibly notable credentials and frankly it's somewhat ridiculous for lay-folk to be arguing with someone with such bone fides: Riana [Pfefferkorn] was the Associate Director of Surveillance and Cybersecurity at the Stanford Center for Internet and Society. Prior to joining Stanford, Riana was an associate in the Internet Strategy & Litigation group at the law firm of Wilson Sonsini Goodrich & Rosati, where she worked on litigation and counseling matters involving online privacy, Internet intermediary liability, consumer protection, copyright, trademark, and trade secrets and was actively involved in the firm's pro bono program. Before that, Riana clerked for the Honorable Bruce J. McGiverin of the U.S. District Court for the District of Puerto Rico. She also interned during law school for the Honorable Stephen Reinhardt of the U.S. Court of Appeals for the Ninth Circuit. Riana earned her law degree from the University of Washington School of Law and her undergraduate degree from Whitman College."
- BoorishBears 5y ago
  I expected the appeal to authority to be followed up with some counterpoint but no... No one needs to question the law portions of this to question the underlying premise. Saying things like "this is bad because Cellebrite is currently being used on rioters" right after you claim what Signal may or may not have done will have no effect on evidence is a flimsy argument you don't need a law degree to oppose. Ditto for implying Cellebrite should somehow be seen in a positive light because by... enabling and normalizing the invasion of privacy it... somehow preserves privacy? As if politicians aren't more likely to wave the successes of Cellebrite as exactly why backdoors should be required than the opposite? And even worse, wave the failures that naturally occur as reasons for backdoors?
- knaik94 5y ago
  Arguments and opinions should be up for discussion regardless of who the author is. No one is questioning the validity of the author's interpretation of the law itself. It sounds like you're making an appeal to authority rather than an actual point about the article. The discussion isn't about how a law is being interpreted. This blog article is about how the Signal article can be interpreted by a tech informed lay person vs a judge and the security theater surrounding it.
deleted 5y ago
[deleted]
lamontcg 5y ago
So the government should have the right to rifle through your shit and can deny you access to e2e encryption and we have to put up with Cellebrite or else they'll just start banning encryption and mandating backdoors, along with the horseshoe theory that the Anarchist is helping out all the Fash. Oh and he's not directly worried kiddie porn he just accepts that the governments will get whatever they want in the name of kiddie porn. This is how moderates get you to give up your rights, because they'll convince you that if you don't give up some of your rights, you'll wind up losing all of them, and nobody wants that to happen. It is very Good Cop / Bad Cop.
- yoaviram 5y ago
  Also, the author seems to forget that Cellebrite market is not just the US, but also many other countries, some with far less respect to human rights (not saying the us has a perfect track record on this front). Are all the journalists / activities / opposition in these countries not worth some of consideration?
- salawat 5y ago
  That isn't a moderate take at all in my opinion. That's an extreme authoritarian assuming they can bend anyone to their side. Even a moderate realizes there is a line that should not be crossed.
sneak 5y ago
Signal hasn't hacked Cellebrite, to the best of my knowledge. They just pointed out that the software is poorly constructed in a blog post. Any claims otherwise are premature. Even their claims they they might put such exploit files on Signal devices were written in such a way as to be plausibly deniable. Until and unless a Cellebrite device is known to have been exploited by such a file, we are speculating idly. (FWIW, Signal doesn't even need to deploy the files now to have tainted the evidence that comes out of any Cellebrite device. The blog post was sufficient.)
Dylan16807 5y ago
> No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. > If they’re saying what they’re hinting they’re saying, Signal basically announced that they plan to update their app to hack law enforcement computers and also tamper with and spoliate evidence in criminal cases. If you set up an anti-hack tool on your phone, you have no way to know if it's going to be the police hacking it.
- marricks 5y ago
  This seems immensely reasonable, but if this post is to be believed, our legal system values protecting intel gathering tools more than an individuals expectation of privacy. Depressing but not surprising.
  - salawat 5y ago
    I do not believe the majority of judges would buy this. At least I sure hope not.
    - Dylan16807 5y ago
      Even something that just corrupts all the data on your own phone? There are lots of tamper-resistant devices that will self-destruct.
alfiedotwtf 5y ago
If Moxie and team get taken to court, I'll happily donate to their legal fund... and I'm sure a lot of other people here will too.
johnchristopher 5y ago
Besides the technical and legal points raised it's in the last paragraphs that the most important point is raised: > The timing looks kinda fash. I also think the timing of Signal’s blog post was suboptimal. Why? Because Cellebrite devices were used in some of the criminal cases against the Capitol rioters, to extract data from their phones after they were arrested. It’s still early days in those criminal prosecutions, those cases are still ongoing, and there are hundreds of them. (I don’t know how many of them involve Cellebrite evidence.) The DOJ is already stretched extremely thin because of how damn many of these cases there are, and if even a fraction of those defendants got Cellebrited-upon, and they all decide to file a motion to examine the Cellebrite device and throw out the Cellebrite evidence, that will add further strain. > Now, don’t get me wrong, I’m no fan of the DOJ, as you may have guessed by now. But I also don’t like seditious fascists, and I think the people who tried to violently overthrow our democratically-elected government should be caught and held accountable. And the timing of this blog post kinda makes it look like Moxie — who is famously an anarchist — is giving the fascists ammunition in their legal cases to try to get off the hook. As said, I don’t think it’ll work, and even fascists deserve due process and not to be convicted on the basis of bug-riddled spy machines, but it’s helpful to them nonetheless. It's the usual knife/gun conversation again but indeed - as in the author's words - that likely won't get him anymore job with Signal.
- draw_down 5y ago
  Come on
- salawat 5y ago
  I would advise you to consider any BLM protestors as well as the Capitol protestors. You're being a bit one-sided to your countrypeople. The Law is blind, but the police are not. You can't buy into investigative techniques being employed in some cases and not others. Any type of edge will be exploited as early and as often as possible to build a case. Regardless, those optics are kind of silly to apply, as they are largely irrelevant to the legal question at hand, even if they might be relevant at higher levels of the political machine.
eyeareque 5y ago
I disagree and this was far too much writing to get your point across. Signal isn’t Facebook; they don’t have to act (or try to be) politically correct. Cellebrite deserved what they got, and if this writer understood how painful vuln reporting is they would understand why a (semi) full disclosure release works and when to use it.
asddubs 5y ago
if you're aware of the details of the situation feel free to skip ahead to part IV, and save yourself a lot of reading. the first 3 parts are mostly just summarizing what happened
hyko 5y ago
If it’s illegal to secure your own property, then something has gone badly wrong with society. Time for open resistance and support for regime change I think. Legal scholars can then engage in beard stroking around the new laws. In a democracy, the laws are not king; the people are. Time to re-learn that lesson. Cellebrite no doubt thought that hoarding vulnerabilities made them super smart, forgetting that everything they need to operate is now riddled with vulnerabilities that someone else has hoarded. Doesn’t affect their business model though, which just requires bamboozling a jury of people who think the word crypto means ‘pyramid scheme my uncle invested in’.
saagarjha 5y ago
A somewhat tangential point: I think Signal's overall response was quite poor and somewhat concerning. Putting aside the usual discussion (Cellebrite sketch, Signal secure), I think the fact that this got published is evidence that Signal does not have very good self-control; or, possibly even worse, that Moxie does not have good self-control and Signal can't stop him from making snap decisions. Doing this kind of stunt is cool when you're a sole hacker working on your own, but when you run a company that makes software for many millions of people you cannot be this cavalier. There should be someone at Signal whose job is to moderate these kinds of responses, and obviously they either do not exist or are not able to do their job, and that is deeply problematic for the company. The blog post showed that Moxie (dragging along Signal) will go scorched earth against anyone who slights him–I mean, really, does a lazy PR blog post from Cellebrite really deserve this kind of response? They're living "rent free" in your head, dude. (And, just to be fully clear, my support for Cellebrite/law enforcement in this situation is approximately zero. I just think that Signal could spend their time in better ways than going full nuclear against anyone who pisses the CEO off, which is what happened here.)
- DoctorNick 5y ago
  It is incredibly disingenuous to frame this as a personal "slight". This is a real security threat to the users of Signal, not some vendetta. Celebrite sells their tech to oppressive regimes and they use this against their opponents, who likely use Signal to communicate.
  - saagarjha 5y ago
    Cellebrite has been operating with their present capabilities for several years. I can see few reasons why Signal would choose to publish a blog post such as this now, if not for the fact that a couple months ago Cellebrite write a blog post that specifically mentioned their ability to extract data from Signal (which, to be clear, was not a specific vulnerability in Signal). This prompted a very pointed response from Signal, which you can read here: https://signal.org/blog/cellebrite-and-clickbait/ https://signal.org/blog/cellebrite-and-clickbait/. The timing makes it pretty obvious that Signal/Moxie took this personally (to say nothing of the general atmosphere when that blog post was written) and then took a few months acquiring a UFED and exploiting it, the results of which we're seeing now.
readonthegoapp 5y ago
as best i can tell, this person wrote too many words to say: 1. cellebrite is ultimately good because it allows governments to spy on, harass, imprison, terrorize, torture, and murder its citizens, esp its journalist citizens, and 2. moxie used the wrong tone in his blog post. something tells me this person doesn't think of themself as a typical government hack, which is presumably the only reason this blog post would be interesting enough to HN to show up here? also interesting that this person thinks that cellebrite only sells their tech to 'authoritarian' governments. which ones are those?
- saagarjha 5y ago
  The post quite literally lists these out: > But Cellebrite has lots of customers besides U.S. law enforcement agencies. And some of them aren’t so nice. As Signal’s blog post notes, “Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere.”
gnicholas 5y ago
> Plus, admittedly I haven’t actually looked into this at all, but it seems like it could get Signal kicked out of the Apple and Google app stores, if the companies interpret this as a violation of their app store rules against malware. This is an interesting question, since Apple/Google are actually on the same side as Signal on this one (vis a vis Cellebrite). If Signal is being vague/coy enough about what they're doing, will the app stores overlook the possible bad behavior on the grounds that "the enemy of my enemy is my friend"?
supergirl 5y ago
> No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. > Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA I'm not sure if that will hold in court. You can argue that the Signal app has built in hacking defenses. A more common case would be that Signal app detects that it is being hacked by Celebrite and self destructs (i.e. deletes all data) -- that's what an iphone does, if you make too many passcode attempts. In this case Signal jokes that it might counter hack even, but since it's a defense to being hacked in the first place, it shouldn't illegal.
- PeterisP 5y ago
  "might counter hack even, but since it's a defense to being hacked in the first place, it shouldn't illegal. " Perhaps it shouldn't be illegal, but as of now it very definitely is illegal. There are no 'self-defence' clauses in current computer security laws, and any "counter-hack" is exactly as illegal as an equivalent "direct-hack", it literally does not matter if you did it as a defense.
mcny 5y ago
I am not a fancy legal expert so I only have two things to say: 1. Abolish the CFAA. All of it. It is unsalvageable. Nothing good has ever come from it. 2. I will never listen to Stanford and anyone associated with Stanford about ethics. You profit from parent trolls. You have zero moral high ground.
ultrastable 5y ago
slightly bizarre to see the author explain that Cellebrite have major contracts w/ US law enforcement & ICE then go on to say "but they have bad clients too!" & I don't like the Capitol rioters either, but I don't see how you can evince a belief in due process & the "rule of law" then criticise someone for potentially providing exculpatory evidence to a group of defendants you dislike. you can't have it both ways. and the implication that someone being an anarchist makes them more likely to want to help out fascists is odd, to say the least
daniellarusso 5y ago
Where is the ‘software bill of materials’ the US president’s executive order requires of government software vendors, like Cellebrite? Is this applicable?
notsureaboutpg 5y ago
>But a lot of vendors in this industry, the industry of selling surveillance technologies to governments, sell not only to the U.S. and other countries that respect the rule of law, but also to repressive governments that persecute their own people, where the definition of “criminal” might just mean being gay or criticizing the government. And then I suddenly don't care what this person has to say. The US persecutes its own people and many others around the world. The US is extraditing Assange for criticizing them. The US still operates Guantanamo Bay contrary to its own "laws". The US still invaded both Iraq and Afghanistan (the former based on lies they circulated through the media about how Saddam Hussein had "ties" to Al Qaeda). The US has a kill list of its own citizens which no citizen can appeal once their name is put on there (even if it's a mix up since many people have the same name). The US sends over $3 billion to Israel yearly, and also much money to Saudi Arabia yearly so both countries can oppress their people, butcher innocents, and flatten press buildings. So spare me the handwriting about "those evil governments that criminalize being gay" because the US is far worse than that and even supports many of those governments.
pogue 5y ago
Anybody got any of that payload software that you could install on your phone to corrupt Cellebrite's data?
black_puppydog 5y ago
> “I’ll show you mine if you show me yours.” That is not generally how vulnerability disclosure works My understanding was that people will responsibly disclose information to protect the public. Signal disclosing these vulnerabilities would have mostly protected Cellebrite, who have made it abundantly clear that the good of the general population is none of their concern and who's business model is based on keeping everyone insecure for their own profit. Now that is how responsible disclosure doesn't work.
Kim_Bruning 5y ago
Placing aesthetic files needn't be illegal; see eg: https://en.wikipedia.org/wiki/Intelligent_banknote_neutralisation_system#Legislation_and_regulations https://en.wikipedia.org/wiki/Intelligent_banknote_neutralis... for a similar situation with banks, banknotes, and -presumably aesthetic- dye packs. This is pretty similar. Only hostile breach attempts are thwarted. It may need precedent or legislation to be fully legal, however. I would hope for EU-wide legislation to that effect in short order.
- PeterisP 5y ago
  It's not pretty similar to banknote neutralisation. First, the thwarted breach most likely isn't "hostile" - we'd assume that the law enforcement people running the Cellebrite tool are running it on a device in their lawful possession; and second, unlike in the money case, it's quite explicitly a crime to try to thwart their attempts, obstruction of justice is pretty much a universal concept.
  - salawat 5y ago
    >First, the thwarted breach most likely isn't "hostile" - we'd assume that the law enforcement people running the Cellebrite tool are running it on a device in their lawful possession; and second, unlike in the money case, it's quite explicitly a crime to try to thwart their attempts, obstruction of justice is pretty much a universal concept. Uh huh. Tell that to the Uiyghurs currently lawfully detained in reeducation camps and being systematically genocided. Tell that to any person wrongfully imprisoned because a prosecutor wanted a slam dunk instead of making damn sure that the facts line up. Tell that to those of Jewish lineage, or who were on the wrong side of the legal/political edifice in Germany between the years of 1940 and 1945. The same for those of German or Japanese descent in the United States, those of Native American descent since before the United States was formally a thing, or those dissidents that crossed the ocean to get away from the legal reality that shaped their time. There is an American cultural value that places that which is ultimately the moral right over that which is legal. I cannot for the life of me figure out how it seems to have gotten so wantomly diluted over the years, but I'm tired of hearing the argument that what is right is somehow constrained by what is legal. It's the other way around, consequently in flux, resulting in a moral imperative to exploit an inflexible legal system with as much care, due vigilance, and as much scrutiny on all sides (prosecutorial/law enforcement conduct, criminal activity by those unapprehended, the treatment and rehabilitation of those that were apprehended, and the public's overall safety from the other three) as possible if the values of Liberty and Freedom mean anything at all.
hjek 5y ago
> But Cellebrite has lots of customers besides U.S. law enforcement agencies. And some of them aren’t so nice. > But a lot of vendors [...] sell not only to the U.S. and other countries that respect the rule of law, They lost me at the presumption that USA respects the (international) rule of law and has nice law enforcement.
barnabee 5y ago
Regardless of the legal position, I would be very happy if every device I owned would attack, corrupt, disable, etc. any system or software that attempts to use the device or access its contents without my authorisation.
gego 5y ago
I do not have to help a third party possibly incriminate myself in all legislations signal is used. I might also be charged with protecting information by constitution, law or international statute (e.g. as a health or legal professional), something that border officials often like to ignore, actually possibly even incriminating themselves in third countries and the us I am also not responsible if a tool a third party provides is defect by choice and this defect causes damage - especially if the defect is already known and we'll documented through responsible disclosure (thx signal). If I then warn them (in a general way) and they plug in anyway... might be an interesting case, but should be well prepared, best with the help of a third countries lawyer's association as a test case ;)

367 points by curmudgeon22 5y ago

Most of this was better left unsaid. So many words to state the obvious that like, for example, this would be illegal? Did the coy language not tip you off to the fact they realize that? Then suddenly trying to champion Cellbrite as the reason we something as anti-privacy as backdoor mandates and encryption bans while at the same we're already seeing countries inch towards that? And then seriously, acting like because Cellbrite is being used against rioters somehow this was a bad time for Signal to point out the fact that Cellbrite is an insecure pos on top of it's dubious intended purpose?? Didn't I just go through 1000 words explaining why what Signal did won't matter anyways? - This whole thing just reads like someone who needed to go "well actually", it's not really saying anything novel or interesting, and in the pursuit of defending Cellebrite of all things, it makes some pretty dubious connections.

mrlatinos 5y ago
Career academics just like to hear themselves talk. The gender pronouns in the author's Twitter bio told me everything I needed to know.

WrtCdEvrydy 5y ago

I disagree with this. Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode. I would be interested in seeing this go in front of a court because Signal isn't directly targeting any specific person, and the files are fine until they are processed through a specific broken pipeline. If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. You cannot repackage vulnerabilities for police and then turn around and play coy because you're not able to keep your software up to date. In the defense attorney section, the argument shouldn't be about the PoC but the fact that the PoC shows that Cellebrite's software is outdated and could be compromised. You can specifically ask for the backup that was extracted from the mobile device to be analyzed by third party software.

vxNsr 5y ago
This is false, there are laws about booby traps (they’re generally illegal in all jurisdictions). If you plant mines on your property and a thief walks onto your lawn and loses a leg, he can sue you and will likely win with a competent lawyer. You don’t get to say “well you shouldn’t have been there”
- wearywanderer 5y ago
  Traps that harm people are illegal. Traps that harm animals are legal under some circumstances (mousetraps are legal basically everywhere afaik.) But traps that harm devices rather than people or animals? Are you sure that is generally illegal?
- knaik94 5y ago
  Laws on booby traps specify that the trap be used to cause harm to a living thing. It's not a booby trap if it wasn't meant to harm someone. So the digital booby trap isn't governed by the same laws.
  - Waterluvian 5y ago
    I agree. But that law demonstrates the concept.
- WrtCdEvrydy 5y ago
  booby traps that cause harm are illegal, someone stealing my phone who cuts themselves on a broken piece of glass from the screen can't argue "it's a booby trap"
  - failwhaleshark 5y ago
    This is true. Also, if you add hidden buttons that alter the way a data port works to either disable or enable it, or fry a device attached to it, this isn't intentional harm caused to police equipment specifically. It is a deterrent-after-the-fact, a protection, and a personal choice to modify one's own device without targeting anyone in particular and not intentionally, unexpectedly causing bodily harm.

grendelt 5y ago

Signal announced they have the know-how to disrupt any Cellebrite-extracted files and then likely sprinkled "poison pill" files in their data. So if a Cellebrite user was to extract data from a Signal user's phone, the data would corrupt Cellebrite's data. This simply disrupts trust in Cellebrite. Nothing illegal. All Moxie is saying is "Don't want potentially corrupted data? Don't use Cellebrite." It absolutely is retribution for Cellebrite coming at Signal.

upofadown 5y ago
I guess this is different in the USA, but in a lot of places, spreading FUD in an attempt to harm a business could be considered defamatory. It might not even matter if what is being said is true if there is no positive social purpose to the statements.
- marcos100 5y ago
  Is it FUD if he shows a PoC?
- salawat 5y ago
  There is a positive social purpose to his statements. Innocents may be coerced into confessing or pleading guilty to crimes they didn't commit. Ensuring not one innocent gets steamrolled by the judicial system is a positive social purpose. Whether or not you consider it compelling enough to be worth it is another question. I unwaveringly acknowledge the positive value to what he has done. If you can't come out and prove there is nothing dirty or worthy of doubt with the tools you're using to strip someone of their freedom and liberty, you have no business using it. Period. As a society, we've compromised on a high standard for this far too long.

josephg 5y ago

Does the Cellebrite device exploit hacks in iOS? My understanding is that iOS shouldn't ever allow something plugged in over USB to read data on the device like this. I've been assuming the only reason they continue to work is that they found some unpatched vulnerabilities in iOS, and that Apple hasn't been able to obtain a cellebrite device to reverse engineer so they can fix the bugs. But if Signal got one, I'd be surprised if Apple couldn't. (Or if Signal wants to really stick it to cellebrite, they should loan their device to apple so apple can fix the security holes that cellebrite exploits.)

lights0123 5y ago
That's why Apple added Settings -> Face ID & Passcode -> Allow access when locked: USB Accessories. They set it off by default because they know there is some vulnerability involving USB, but they don't know what it is.
scrose 5y ago
The author mentions that Cellebrite is only able to extract data from the phone as if it was the equivalent of someone taking screenshots of everything while going through an already unlocked phone, just in an automated way. So my immediate guess is that they’re not really exploiting something, but who knows!
- saagarjha 5y ago
  Doing just that in an automated fashion requires at least one iOS exploit. Cellebrite, of course, has many.

vxNsr 5y ago

I said this at the time, the things Signal was saying it might do were so clearly illegal that it was more for the naive star-struck blog reader than anything else. It got a lot of play here and Reddit bec they eat this nonsense up. But any lawyer will tell you that by disclosing this vuln in the way they did Signal only opened themselves up to lawsuits. If they do hire in house counsel the first that guy would tell this is “call Cellbrite and tell them exactly what the vuln is and how to mitigate it.”

vlovich123 5y ago
If that were the case, why doesn’t the same principle apply to Cellebrite? After all, they exploit vulnerabilities in lots of software to deliver their own services and there’s no indication they share their work with the vendors.
- vxNsr 5y ago
  Because they don’t plant boobytraps in their wake. Signal isn’t saying “we’re just hacking into property we have a legal right to access” (which is what LE is doing in the US) they’re essentially saying “we’re gonna hack and damage government property and police evidence”
  - ambicapter 5y ago
    Sure, that's what the article is claiming, but I don't see how Cellebrite is "government" or "police".
    - nearbuy 5y ago
      Cellebrite, the company, wouldn't be the one getting hacked. It's the police agencies' equipment that could potentially get hacked.
- alisonkisk 5y ago
  You're asking why lawful search and seizure is OK but obstruction of justice is not. Intent matters in the law.

pmccarren 5y ago

From my experience, most _independently_ owned cell phone retail stores (Verizon, Sprint, AT&T, etc) have several Cellebrite devices no site which are used daily to aid in device migration from old to new. As I understand it, Cellebrite devices are not exactly hard to acquire.

kstrauser 5y ago
They have multiple devices. The thing T-Mobile buys to help you upgrade your phone isn’t the same one the FBI buys to hack it.

knaik94 5y ago

I am a little confused on why the author makes a distinction between Cellebrite using zero-days to hack a phone to read data and Signal's hack. While the US government might have the framework to not be considered violating CFAA, what about when other governments use Cellebrite? From this point of view, Cellebrite isn't a valve that's stopping back door decryption in systems, it is the back door. Signal including these files is in a sense covering a back door. Also, is leaving a file that breaks the admissibility of previously gathered evidence considered active hacking? Am I misunderstanding something about the function of the files in Signal? I thought the only way Cellebrite's software is interacted with is if it tries to access Signal on the device. Signal isn't actively searching to hack back. It's triggered by Cellebrite's software, not Signal's. The straightforward workaround would be to delete Signal before using the Cellebrite software which I think is the real point. Signal isn't trying to protect the end user actively and can't do anything if it's not installed on a phone.

tptacek 5y ago
In the US, Cellebrite extractions are done under color of law; for the same reason, the police don’t get in trouble for forcing open locked doors while executing search warrants.
- atat7024 5y ago
  > Cellebrite extractions are done under color of law Until they find they're in the wrong house. Or that a warrant is invalid.
- sneak 5y ago
  > In the US, Cellebrite extractions are done under color of law Are you sure that is the case 100% of the time? Bars on my door keep out burglars as well as hinder police serving a warrant. Even if Signal does deploy these files (no evidence thus far that they have deployed Cellebrite exploits, as their blog post was careful not to claim that), the vast majority of them (just like deadbolts) will not be used to hinder search warrants.
vxNsr 5y ago

Jaygles 5y ago

>My guess is that it’s pretty rare that the Cellebrite evidence is the dispositive crux of a case, meaning, but for evidence pulled from a phone using a Cellebrite device, the jury would not have voted to convict. Let's also consider cases that could have warrants that would not have been approved if the integrity of the data from a Cellebrite extraction was questionable. I could see some defense lawyers challenge the validity of warrants from this.

alisonkisk 5y ago
No way. "I put a file on my device whose only purpose is to obstruct justice" does not cancel probable cause for a search.
- ambicapter 5y ago
  I love the conflation between Cellebrite, private Israeli business, with "Justice", I presume around the world?
- cyphar 5y ago
  The issue is that the Celebrite device may have scanned someone else's device that contained a malicious file, meaning that any forensic evidence collected for your device is questionable. But IMHO (IANAL) this won't actually have an impact -- the defense would need to have some evidence that the particular Celebrite machine was hacked and that this had an impact on the data taken from that particular device. "It could've been hacked" is purely speculative and isn't nearly enough to get evidence thrown out. I mean, courts routinely accept phone screenshots as evidence -- "it could be a fake screenshot" is much more likely thing to happen, and yet you'd still need to provide evidence that the screenshot might be fake. Not to mention that the bar for warrants is even lower -- you only need "probable cause" in the US.
  - salawat 5y ago
    Reasonable doubt. The defense doesn't need to prove anything except that the prosecution hasn't done their job of assuring they've chased down everything they have to. The prosecution, if relying on Cellebrite, can no longer just say "we dumped the contents of the phone" without picking up the additional investigative burden of proving their chain of custody was not maliciously tampered with successfully. That means source code audits, admitting knowledge of the tool into the public record, or doing cross checks with another tool that isn't known to be vulnerable to an undisclosed exploit, which only holds out til the same type of thing happens to the other tool.

smeej 5y ago

The standard in U.S. criminal courts is "beyond a reasonable doubt." All I understood Moxie's original article to be doing was sowing that seed of "reasonable doubt." Is it now reasonable, based on Moxie's article, to doubt that information obtained by a Cellebrite device from a device running Signal is reliable? If I were a juror, I would probably think so. That doesn't at all mean someone couldn't be convicted on the strength of other evidence, but if the primary evidence the prosecution relied on was Cellebrited off a phone running Signal, I'd have some trouble trusting it enough to render a guilty verdict.

tptacek 5y ago
Multiple legal experts have chimed in, all suggesting that this is unlikely to impact cases. People on HN might assume that the existence of a vulnerability strongly implies that it will have been exploited in every case where it is relevant, but that's not how normal people think, and in this case, the normal people are closer to the truth than the nerds are.
- roywiggins 5y ago
  It seems to me that a malicious boobytrapped file did it is really just a subset of I was hacked, which is neither new defense nor (I assume) a particularly successful one.
- KMag 5y ago
  But what about the vulnerability as an indicator of the general quality and reliability of the tool? Casting doubt as to the ability of the tool to generally be accurate and specifically maintain proper chain of custody documentation would seem to be a reasonable legal defense tactic. I would expect a defense lawyer to say something like "The tool so confuses its input that it can mistake message data for its own internal instructions. How certain can we be that it has properly analyzed its inputs and maintained the necessary chain-of-custody metadata, and provided adequate protections against evidence tampering? If a police officer were unable to tell the difference between his or her own thoughts and things he or she had read, we would dismiss him or her as a reliable witness."

adrr 5y ago

If what signal is doing illegal then how do tv satellite provides get away pushing malicious updates on their feeds? Before you claim that cellebrite is only used by law enforcement, signal got their hands on a device and cellebrite sells to other governments besides the US. I should legally allowed to protect my device from foreign adversary from stealing my company’s trade secrets.

tptacek 5y ago
They owned the devices they were hacking with their feeds. That’s why the hack worked to begin with: they controlled the code on the cards.
- adrr 5y ago
  I’d claim they didn’t own the cards. When they send out new cards to replace the H cards, they didn’t have us send them back. They abandoned the property and no longer can claim ownership.
  - tptacek 5y ago
    Since they abandoned the cards in part by disabling them, I'm not sure the Law of the Briny Deep does a lot of lifting for you here.
    - adrr 5y ago
      Besides being abandoned when they upgraded. You actually owned the card because they came with receivers when you purchased them from brick and Mortar stores. No agreement on the purchase. You called to activate them. Satellite providers also fried the receivers as well by burning all writes on flash memory that held the firmware. So that $500 directivo receiver could get hosed during an exploit.
      - tptacek 5y ago
        The cards literally had "this is the property of NDS and must be surrendered upon request" printed on them. You're reaching.

stefan_ 5y ago

Jesus, what a depressing post. We must allow the existence of shitty "backup" software because otherwise they'll just mandate backdoors? Have you already given up? How about citizens have an expectation of integrity in using their computation devices that the state may not infringe upon. The state buying these tools and using them, in what is often a constitutional gray area, is harming all of us by making our devices less secure.

colordrops 5y ago
For real, Stanford should be embarrassed.
- qualudeheart 5y ago
  The post seems very unprofessionally written. It is unfortunate that they publish this trash!

cwmartin 5y ago

It looks like the linked post may have been taken down. There is a mirror here https://web.archive.org/web/20210513030656/https://cyberlaw.stanford.edu/blog/2021/05/i-have-lot-say-about-signal’s-cellebrite-hack https://web.archive.org/web/20210513030656/https://cyberlaw.....

kstrauser 5y ago

Eh, I can’t be bothered to care. Cellebrite hoards 0-days so they can use them to hack phones. They know about exploitable vulnerabilities but aren’t saying anything about them because they profit from insecurity. Thing is, just because Cellebrite knows about a thing doesn’t mean, say, China’s CCP or the Russian mafia or anyone else doesn’t also know about that thing. You and I are less safe just because Cellebrite wants to profit off of those vulnerabilities. I just can’t work up the ability to sympathize with Cellebrite. The law may have something to say about Moxie’s writing, but in my opinion he has the clear ethical upper ground in this argument.

markus_zhang 5y ago
Is there a way to further damage its profitability and force it to release 0-day in a legal way?
- kstrauser 5y ago
  If/when I am appointed Lord Emperor, I would absolutely enforce the Computer Fraud and Abuse Act against the officers of such companies. Unless an audit could prove that every single one of their customers was a legitimate law enforcement organization, I’d go with the default assumption that they’re black hat hackers who happen to have a couple of legal sales. Let them prove otherwise. Note that this is one of many, many reasons it’s unlikely that I’ll ever be appointed Lord Emperor.
  - lsh123 5y ago
    The fact that Signal got their hands on a copy of the Cellebrite product makes “let them prove otherwise” disclaimer a moot point ;)
    - salawat 5y ago
      Not necessarily. That could have been an unused loaner from an anonymous law enforcement quartermaster who had a moment of conscience. Cellebrite, as I recall hearing (Or was it StingRay?) have pretty strict non-disclosure license terms; I doubt Cellebrite knowingly sold one to Moxie.

coretx 5y ago

And the Cellebrite/Signal sockpuppet/commercial continues... Can anyone please wake me up when actual (0day) code is reversed ? Because so far its all speculation, theory crafting and blah blah - in case somebody didn't notice.

kodablah 5y ago

> This blog post was plainly written in order to impress and entertain other hackers and computer people. But other hackers aren’t the real target audience; it’s lawyers and judges and the law enforcement agencies Says who? The intentional ambiguity may have had multiple audiences, quite possibly including computer people that handle the use of these products, their procurement, or their adversarial study.

Dylovell 5y ago

As an American, I see this as a right to bear arms in the modern day.

batch12 5y ago

Well now that folks know how the software works, I'm surprised nobody has set up a public repo with similar files-- especially since the exploits for a lot of these older vulnerabilities are already out there.

ambicapter 5y ago

> The timing looks kinda fash Who is this fucking clown?

dannyw 5y ago

IMO law enforcement as a whole is evil, particularly on a global lev. So anything that messes with law enforcement, as a whole, is good with me. I think it's an opinion that messing with law enforcement is _bad_.

failwhaleshark 5y ago

I worked with a guy at a startup who wrote and designed a Mac hacking system that exploited Firewire because it can read memory directly. Firewire is basically a security nightmare like several other peripheral interfaces (Wikipedia says "PCI Express, PC Card, ExpressCard, FireWire [yeap], PCI, and PCI-X") Thunderbolt 4 allegedly includes mitigations to prevent arbitrary DMA transactions and Thunderspy. https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulnerability_to_DMA_attacks https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulner... Btw, partial list of USB attacks: https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/ https://www.bleepingcomputer.com/news/security/heres-a-list-... https://www.sciencedirect.com/science/article/pii/S0167404817301578 https://www.sciencedirect.com/science/article/pii/S016740481...

MrManatee 5y ago

The article says that "it should be pretty straightforward for law enforcement to disprove an accusation about the Cellebrite machine", because they can perform the same extraction with another vendor's machine and compare the results. But if some app actually decided to use this hack, then wouldn't it be likely that in addition to modifying the contents of the data dump it would also modify the on-device data? In that case it wouldn't matter if the other vendors have vulnerabilities, since the device itself was already compromised.

batch12 5y ago
The most interesting version of this exploit (to me) would be one that wiped the device being examined. Edit: changed disruptive to interesting. There could be many many more disruptive versions...
- Sephr 5y ago
  Quite the 'aesthetically pleasing' side-effect for sure.
tedunangst 5y ago
Tell it to the jury I guess. "Yes, of course there's evidence of a crime on my phone, but actually I put it there just to trick the police."
- MrManatee 5y ago
  Or: "If there is any evidence of a crime on my phone, it was probably planted there by a version of Cellebrite that got infected with a virus when you scanned someone else's phone with it."
  - PeterisP 5y ago
    The sentence would be true iff your replace "probably" with "possibly". But - as the original article states - that's not sufficient. The defence may try to assert that this is the case, which may cause that possibilty to be investigated in more detail, but such a statement would not automatically disqualify the evidence without something more substantial, merely asserting that such a possibility exists isn't enough. E.g. such a claim might result in a forensic analysis of that Cellebrite computer, and if the analysis indicates that it indeed got infected with a virus when scanning someone else's phone, that's likely cause all the evidence to be questioned, but again, even in that case there may be other ways than the Cellebrite logs to confirm that this evidence was indeed on your phone (the original article asserts this as well).

lettergram 5y ago

My only complaint in this otherwise entertaining and informative read was the politics... For the record, the rioters weren’t seditionists (no charges anyways), nor were most (all) fascists (they were pro constitution), nor did they intend to overthrow the government (they wanted a election fraud looked into as they believe there was a coup via ballot stuffing) - not justifying actions or agreeing FYI. Just correcting the record. And two I believe moxie said why he hacked them? Wasn’t it because they said they could get signal messages? > I also don’t like seditious fascists, and I think the people who tried to violently overthrow our democratically-elected government should be caught and held accountable. And the timing of this blog post kinda makes it look like Moxie — who is famously an anarchist — is giving the fascists ammunition in their legal cases to try to get off the hook. As said, I don’t think it’ll work, and even fascists deserve due process and not to be convicted on the basis of bug-riddled spy machines, but it’s helpful to them nonetheless.

nxpnsv 5y ago

With that argument, How is what cellbright is doing legal? Is it just that they are not responsible for actions taken by their users?

dotBen 5y ago

I wouldn't find a website where professional lawyers opine on startups and programming especially compelling. I don't find HN threads where tech folk opine on what their opinion of how the law should be interpreted to be especially compelling either. This is especially true here where I note that the author of the post folks are commenting on has an incredibly notable credentials and frankly it's somewhat ridiculous for lay-folk to be arguing with someone with such bone fides: Riana [Pfefferkorn] was the Associate Director of Surveillance and Cybersecurity at the Stanford Center for Internet and Society. Prior to joining Stanford, Riana was an associate in the Internet Strategy & Litigation group at the law firm of Wilson Sonsini Goodrich & Rosati, where she worked on litigation and counseling matters involving online privacy, Internet intermediary liability, consumer protection, copyright, trademark, and trade secrets and was actively involved in the firm's pro bono program. Before that, Riana clerked for the Honorable Bruce J. McGiverin of the U.S. District Court for the District of Puerto Rico. She also interned during law school for the Honorable Stephen Reinhardt of the U.S. Court of Appeals for the Ninth Circuit. Riana earned her law degree from the University of Washington School of Law and her undergraduate degree from Whitman College."

BoorishBears 5y ago
I expected the appeal to authority to be followed up with some counterpoint but no... No one needs to question the law portions of this to question the underlying premise. Saying things like "this is bad because Cellebrite is currently being used on rioters" right after you claim what Signal may or may not have done will have no effect on evidence is a flimsy argument you don't need a law degree to oppose. Ditto for implying Cellebrite should somehow be seen in a positive light because by... enabling and normalizing the invasion of privacy it... somehow preserves privacy? As if politicians aren't more likely to wave the successes of Cellebrite as exactly why backdoors should be required than the opposite? And even worse, wave the failures that naturally occur as reasons for backdoors?
knaik94 5y ago
Arguments and opinions should be up for discussion regardless of who the author is. No one is questioning the validity of the author's interpretation of the law itself. It sounds like you're making an appeal to authority rather than an actual point about the article. The discussion isn't about how a law is being interpreted. This blog article is about how the Signal article can be interpreted by a tech informed lay person vs a judge and the security theater surrounding it.

deleted 5y ago

[deleted]

lamontcg 5y ago

So the government should have the right to rifle through your shit and can deny you access to e2e encryption and we have to put up with Cellebrite or else they'll just start banning encryption and mandating backdoors, along with the horseshoe theory that the Anarchist is helping out all the Fash. Oh and he's not directly worried kiddie porn he just accepts that the governments will get whatever they want in the name of kiddie porn. This is how moderates get you to give up your rights, because they'll convince you that if you don't give up some of your rights, you'll wind up losing all of them, and nobody wants that to happen. It is very Good Cop / Bad Cop.

yoaviram 5y ago
Also, the author seems to forget that Cellebrite market is not just the US, but also many other countries, some with far less respect to human rights (not saying the us has a perfect track record on this front). Are all the journalists / activities / opposition in these countries not worth some of consideration?
salawat 5y ago
That isn't a moderate take at all in my opinion. That's an extreme authoritarian assuming they can bend anyone to their side. Even a moderate realizes there is a line that should not be crossed.

sneak 5y ago

Signal hasn't hacked Cellebrite, to the best of my knowledge. They just pointed out that the software is poorly constructed in a blog post. Any claims otherwise are premature. Even their claims they they might put such exploit files on Signal devices were written in such a way as to be plausibly deniable. Until and unless a Cellebrite device is known to have been exploited by such a file, we are speculating idly. (FWIW, Signal doesn't even need to deploy the files now to have tainted the evidence that comes out of any Cellebrite device. The blog post was sufficient.)

Dylan16807 5y ago

> No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. > If they’re saying what they’re hinting they’re saying, Signal basically announced that they plan to update their app to hack law enforcement computers and also tamper with and spoliate evidence in criminal cases. If you set up an anti-hack tool on your phone, you have no way to know if it's going to be the police hacking it.

marricks 5y ago
This seems immensely reasonable, but if this post is to be believed, our legal system values protecting intel gathering tools more than an individuals expectation of privacy. Depressing but not surprising.
- salawat 5y ago
  I do not believe the majority of judges would buy this. At least I sure hope not.
  - Dylan16807 5y ago
    Even something that just corrupts all the data on your own phone? There are lots of tamper-resistant devices that will self-destruct.

alfiedotwtf 5y ago

If Moxie and team get taken to court, I'll happily donate to their legal fund... and I'm sure a lot of other people here will too.

johnchristopher 5y ago

Besides the technical and legal points raised it's in the last paragraphs that the most important point is raised: > The timing looks kinda fash. I also think the timing of Signal’s blog post was suboptimal. Why? Because Cellebrite devices were used in some of the criminal cases against the Capitol rioters, to extract data from their phones after they were arrested. It’s still early days in those criminal prosecutions, those cases are still ongoing, and there are hundreds of them. (I don’t know how many of them involve Cellebrite evidence.) The DOJ is already stretched extremely thin because of how damn many of these cases there are, and if even a fraction of those defendants got Cellebrited-upon, and they all decide to file a motion to examine the Cellebrite device and throw out the Cellebrite evidence, that will add further strain. > Now, don’t get me wrong, I’m no fan of the DOJ, as you may have guessed by now. But I also don’t like seditious fascists, and I think the people who tried to violently overthrow our democratically-elected government should be caught and held accountable. And the timing of this blog post kinda makes it look like Moxie — who is famously an anarchist — is giving the fascists ammunition in their legal cases to try to get off the hook. As said, I don’t think it’ll work, and even fascists deserve due process and not to be convicted on the basis of bug-riddled spy machines, but it’s helpful to them nonetheless. It's the usual knife/gun conversation again but indeed - as in the author's words - that likely won't get him anymore job with Signal.

draw_down 5y ago
Come on
salawat 5y ago
I would advise you to consider any BLM protestors as well as the Capitol protestors. You're being a bit one-sided to your countrypeople. The Law is blind, but the police are not. You can't buy into investigative techniques being employed in some cases and not others. Any type of edge will be exploited as early and as often as possible to build a case. Regardless, those optics are kind of silly to apply, as they are largely irrelevant to the legal question at hand, even if they might be relevant at higher levels of the political machine.

eyeareque 5y ago

I disagree and this was far too much writing to get your point across. Signal isn’t Facebook; they don’t have to act (or try to be) politically correct. Cellebrite deserved what they got, and if this writer understood how painful vuln reporting is they would understand why a (semi) full disclosure release works and when to use it.

asddubs 5y ago

if you're aware of the details of the situation feel free to skip ahead to part IV, and save yourself a lot of reading. the first 3 parts are mostly just summarizing what happened

hyko 5y ago

If it’s illegal to secure your own property, then something has gone badly wrong with society. Time for open resistance and support for regime change I think. Legal scholars can then engage in beard stroking around the new laws. In a democracy, the laws are not king; the people are. Time to re-learn that lesson. Cellebrite no doubt thought that hoarding vulnerabilities made them super smart, forgetting that everything they need to operate is now riddled with vulnerabilities that someone else has hoarded. Doesn’t affect their business model though, which just requires bamboozling a jury of people who think the word crypto means ‘pyramid scheme my uncle invested in’.

saagarjha 5y ago

A somewhat tangential point: I think Signal's overall response was quite poor and somewhat concerning. Putting aside the usual discussion (Cellebrite sketch, Signal secure), I think the fact that this got published is evidence that Signal does not have very good self-control; or, possibly even worse, that Moxie does not have good self-control and Signal can't stop him from making snap decisions. Doing this kind of stunt is cool when you're a sole hacker working on your own, but when you run a company that makes software for many millions of people you cannot be this cavalier. There should be someone at Signal whose job is to moderate these kinds of responses, and obviously they either do not exist or are not able to do their job, and that is deeply problematic for the company. The blog post showed that Moxie (dragging along Signal) will go scorched earth against anyone who slights him–I mean, really, does a lazy PR blog post from Cellebrite really deserve this kind of response? They're living "rent free" in your head, dude. (And, just to be fully clear, my support for Cellebrite/law enforcement in this situation is approximately zero. I just think that Signal could spend their time in better ways than going full nuclear against anyone who pisses the CEO off, which is what happened here.)

DoctorNick 5y ago
It is incredibly disingenuous to frame this as a personal "slight". This is a real security threat to the users of Signal, not some vendetta. Celebrite sells their tech to oppressive regimes and they use this against their opponents, who likely use Signal to communicate.
- saagarjha 5y ago
  Cellebrite has been operating with their present capabilities for several years. I can see few reasons why Signal would choose to publish a blog post such as this now, if not for the fact that a couple months ago Cellebrite write a blog post that specifically mentioned their ability to extract data from Signal (which, to be clear, was not a specific vulnerability in Signal). This prompted a very pointed response from Signal, which you can read here: https://signal.org/blog/cellebrite-and-clickbait/ https://signal.org/blog/cellebrite-and-clickbait/. The timing makes it pretty obvious that Signal/Moxie took this personally (to say nothing of the general atmosphere when that blog post was written) and then took a few months acquiring a UFED and exploiting it, the results of which we're seeing now.

readonthegoapp 5y ago

as best i can tell, this person wrote too many words to say: 1. cellebrite is ultimately good because it allows governments to spy on, harass, imprison, terrorize, torture, and murder its citizens, esp its journalist citizens, and 2. moxie used the wrong tone in his blog post. something tells me this person doesn't think of themself as a typical government hack, which is presumably the only reason this blog post would be interesting enough to HN to show up here? also interesting that this person thinks that cellebrite only sells their tech to 'authoritarian' governments. which ones are those?

saagarjha 5y ago
The post quite literally lists these out: > But Cellebrite has lots of customers besides U.S. law enforcement agencies. And some of them aren’t so nice. As Signal’s blog post notes, “Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere.”

gnicholas 5y ago

> Plus, admittedly I haven’t actually looked into this at all, but it seems like it could get Signal kicked out of the Apple and Google app stores, if the companies interpret this as a violation of their app store rules against malware. This is an interesting question, since Apple/Google are actually on the same side as Signal on this one (vis a vis Cellebrite). If Signal is being vague/coy enough about what they're doing, will the app stores overlook the possible bad behavior on the grounds that "the enemy of my enemy is my friend"?

supergirl 5y ago

> No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. > Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA I'm not sure if that will hold in court. You can argue that the Signal app has built in hacking defenses. A more common case would be that Signal app detects that it is being hacked by Celebrite and self destructs (i.e. deletes all data) -- that's what an iphone does, if you make too many passcode attempts. In this case Signal jokes that it might counter hack even, but since it's a defense to being hacked in the first place, it shouldn't illegal.

PeterisP 5y ago
"might counter hack even, but since it's a defense to being hacked in the first place, it shouldn't illegal. " Perhaps it shouldn't be illegal, but as of now it very definitely is illegal. There are no 'self-defence' clauses in current computer security laws, and any "counter-hack" is exactly as illegal as an equivalent "direct-hack", it literally does not matter if you did it as a defense.

mcny 5y ago

I am not a fancy legal expert so I only have two things to say: 1. Abolish the CFAA. All of it. It is unsalvageable. Nothing good has ever come from it. 2. I will never listen to Stanford and anyone associated with Stanford about ethics. You profit from parent trolls. You have zero moral high ground.

ultrastable 5y ago

slightly bizarre to see the author explain that Cellebrite have major contracts w/ US law enforcement & ICE then go on to say "but they have bad clients too!" & I don't like the Capitol rioters either, but I don't see how you can evince a belief in due process & the "rule of law" then criticise someone for potentially providing exculpatory evidence to a group of defendants you dislike. you can't have it both ways. and the implication that someone being an anarchist makes them more likely to want to help out fascists is odd, to say the least

daniellarusso 5y ago

Where is the ‘software bill of materials’ the US president’s executive order requires of government software vendors, like Cellebrite? Is this applicable?

notsureaboutpg 5y ago

>But a lot of vendors in this industry, the industry of selling surveillance technologies to governments, sell not only to the U.S. and other countries that respect the rule of law, but also to repressive governments that persecute their own people, where the definition of “criminal” might just mean being gay or criticizing the government. And then I suddenly don't care what this person has to say. The US persecutes its own people and many others around the world. The US is extraditing Assange for criticizing them. The US still operates Guantanamo Bay contrary to its own "laws". The US still invaded both Iraq and Afghanistan (the former based on lies they circulated through the media about how Saddam Hussein had "ties" to Al Qaeda). The US has a kill list of its own citizens which no citizen can appeal once their name is put on there (even if it's a mix up since many people have the same name). The US sends over $3 billion to Israel yearly, and also much money to Saudi Arabia yearly so both countries can oppress their people, butcher innocents, and flatten press buildings. So spare me the handwriting about "those evil governments that criminalize being gay" because the US is far worse than that and even supports many of those governments.

pogue 5y ago

Anybody got any of that payload software that you could install on your phone to corrupt Cellebrite's data?

black_puppydog 5y ago

> “I’ll show you mine if you show me yours.” That is not generally how vulnerability disclosure works My understanding was that people will responsibly disclose information to protect the public. Signal disclosing these vulnerabilities would have mostly protected Cellebrite, who have made it abundantly clear that the good of the general population is none of their concern and who's business model is based on keeping everyone insecure for their own profit. Now that is how responsible disclosure doesn't work.

Kim_Bruning 5y ago

Placing aesthetic files needn't be illegal; see eg: https://en.wikipedia.org/wiki/Intelligent_banknote_neutralisation_system#Legislation_and_regulations https://en.wikipedia.org/wiki/Intelligent_banknote_neutralis... for a similar situation with banks, banknotes, and -presumably aesthetic- dye packs. This is pretty similar. Only hostile breach attempts are thwarted. It may need precedent or legislation to be fully legal, however. I would hope for EU-wide legislation to that effect in short order.

PeterisP 5y ago
It's not pretty similar to banknote neutralisation. First, the thwarted breach most likely isn't "hostile" - we'd assume that the law enforcement people running the Cellebrite tool are running it on a device in their lawful possession; and second, unlike in the money case, it's quite explicitly a crime to try to thwart their attempts, obstruction of justice is pretty much a universal concept.
- salawat 5y ago
  >First, the thwarted breach most likely isn't "hostile" - we'd assume that the law enforcement people running the Cellebrite tool are running it on a device in their lawful possession; and second, unlike in the money case, it's quite explicitly a crime to try to thwart their attempts, obstruction of justice is pretty much a universal concept. Uh huh. Tell that to the Uiyghurs currently lawfully detained in reeducation camps and being systematically genocided. Tell that to any person wrongfully imprisoned because a prosecutor wanted a slam dunk instead of making damn sure that the facts line up. Tell that to those of Jewish lineage, or who were on the wrong side of the legal/political edifice in Germany between the years of 1940 and 1945. The same for those of German or Japanese descent in the United States, those of Native American descent since before the United States was formally a thing, or those dissidents that crossed the ocean to get away from the legal reality that shaped their time. There is an American cultural value that places that which is ultimately the moral right over that which is legal. I cannot for the life of me figure out how it seems to have gotten so wantomly diluted over the years, but I'm tired of hearing the argument that what is right is somehow constrained by what is legal. It's the other way around, consequently in flux, resulting in a moral imperative to exploit an inflexible legal system with as much care, due vigilance, and as much scrutiny on all sides (prosecutorial/law enforcement conduct, criminal activity by those unapprehended, the treatment and rehabilitation of those that were apprehended, and the public's overall safety from the other three) as possible if the values of Liberty and Freedom mean anything at all.

hjek 5y ago

> But Cellebrite has lots of customers besides U.S. law enforcement agencies. And some of them aren’t so nice. > But a lot of vendors [...] sell not only to the U.S. and other countries that respect the rule of law, They lost me at the presumption that USA respects the (international) rule of law and has nice law enforcement.

barnabee 5y ago

Regardless of the legal position, I would be very happy if every device I owned would attack, corrupt, disable, etc. any system or software that attempts to use the device or access its contents without my authorisation.

gego 5y ago

I do not have to help a third party possibly incriminate myself in all legislations signal is used. I might also be charged with protecting information by constitution, law or international statute (e.g. as a health or legal professional), something that border officials often like to ignore, actually possibly even incriminating themselves in third countries and the us I am also not responsible if a tool a third party provides is defect by choice and this defect causes damage - especially if the defect is already known and we'll documented through responsible disclosure (thx signal). If I then warn them (in a general way) and they plug in anyway... might be an interesting case, but should be well prepared, best with the help of a third countries lawyer's association as a test case ;)