6 ms·
I said this at the time, the things Signal was saying it might do were so clearly illegal that it was more for the naive star-struck blog reader than anything e
by vxNsr 5y ago
I said this at the time, the things Signal was saying it might do were so clearly illegal that it was more for the naive star-struck blog reader than anything else. It got a lot of play here and Reddit bec they eat this nonsense up. But any lawyer will tell you that by disclosing this vuln in the way they did Signal only opened themselves up to lawsuits.
If they do hire in house counsel the first that guy would tell this is “call Cellbrite and tell them exactly what the vuln is and how to mitigate it.”
- vlovich123 5y agoIf that were the case, why doesn’t the same principle apply to Cellebrite? After all, they exploit vulnerabilities in lots of software to deliver their own services and there’s no indication they share their work with the vendors.
- vxNsr 5y agoBecause they don’t plant boobytraps in their wake. Signal isn’t saying “we’re just hacking into property we have a legal right to access” (which is what LE is doing in the US) they’re essentially saying “we’re gonna hack and damage government property and police evidence”
- ambicapter 5y agoSure, that's what the article is claiming, but I don't see how Cellebrite is "government" or "police".
- nearbuy 5y agoCellebrite, the company, wouldn't be the one getting hacked. It's the police agencies' equipment that could potentially get hacked.
- alisonkisk 5y agoYou're asking why lawful search and seizure is OK but obstruction of justice is not. Intent matters in the law.
- sneak 5y agoYou're going to have a long way to go to claim that Signal publishing files onto hundreds or thousands of devices is obstruction of justice. The law doesn't look kindly on prior restraint.
- dTal 5y agoCellebrite isn't definitionally lawful. It's a private company that sells to other private entities that may or may not choose to use their software lawfully. I don't think they (should) get a pass just because some of their clients happen to be LEO.
- PeterisP 5y agoThe proper perspective is not to look at "exploiting Cellebrite's software" an "exploiting Signal's software" but to look at who has the lawful possession of specific devices that software is running on. It's not a crime to exploit vulnerabilities in software developed by someone else, it's a crime to exploit vulnerabilities to do things on systems owned/run by others. A LE officer with a proper warrant running Cellebrite extraction tools on your phone has full rights to execute exploits on your phone. On the other hand, the phone's owner or Signal has no right to execute exploits on that officers' computer with Cellebrite tools. They can get their own computer with Cellebrite tools (as Signal did) and exploit vulnerabilities there as much as they want (as Signal did), and not tell the vendor the details (as Signal did), that's all legal, but deploying an exploit on phones with the intent that it might get executed on someone else's machine is illegal.
- akerl_ 5y agoWho would sue them, and what would the claim be?
- vxNsr 5y agoPolice or Cellbrite for hacking and/or boobytrapping.
- akerl_ 5y agoI feel like you’re conflating “charging” and “suing” here. Cellbrite would sue, and in doing so would need to allege damages. Given that they wrote code to extract data from Signal, and Signal gave public warning that doing so might be dangerous, it seems implausible they’d be able to claim damages. “Boobytrapping” in physical space usually becomes problematic when it’s a surprise: if you hop over my fence to rob me and are injured by land mines in my yard, I’m at fault. If I have signs saying “Warning, this yard is full of dangerous objects, do not hop the fence, you may be harmed”… dramatically less so. “The police” generally don’t sue, The State charges. And for the state to charge someone with a crime, it can’t just vaguely be “hacking”, it would need to be a violation of a criminal statue. At best, this would perhaps be tampering with evidence? Because I doubt you’d find a jury willing to convict someone of a violation of, for example, the CFAA, for activity that they undertook solely within their own app, which did not initiate any activity until scanned by Celebrite’s tool
- PeterisP 5y agoIf there's an actual case where evidence on stored on a law-enforcement operated Cellebrite machine gets destroyed or corrupted, and if further forensics shows that it happened due to e.g. an aesthetically pleasing file with a specific payload being deployed on that phone, then the state is likely to charge the people involved in this particular act for tampering with evidence. And if it happens, then Moxie's original blog post would help prosecution a lot.
- akerl_ 5y agoGenerally, from what I can tell, statutes regarding “tampering with evidence” require both intent (which would likely exist here) and knowledge that the action is interfering with evidence of a crime (which seems pretty implausible). If Signal set up their phones so the user could click “I’m gonna do crimes, opt me in” and it would add the nefarious files, the risk of prosecution would seem much more likely.
- batch12 5y agoWhy is it illegal to store a file that may cause a buffer overflow in software that should not be reading my data?
- alisonkisk 5y agoBecause your "should not" is the law's "should", in a lawful search and seizure.
- PeterisP 5y agoIntent matters. It's prohibited to alter data on someone else's computer systems (CFAA), so what matters if that file was placed there with the hopes that it would overwrite someone else's Cellebrite database, and it doesn't matter if you placed it on your phone or sent it over a phishing email. And as a separate crime, it's forbidden to destroy or conceal evidence or things that would be used as evidence, no matter if that evidence is files on your phone protected by such a buffer overflow, or a gun that you throw in a river. In essence, storing such a file is illegal if the jury gets convinced that you placed such a file with the goal to have that buffer overflow to actually happen on someone else's machine.
- batch12 5y agoI would not be the person destroying evidence. If the examiner used a toolkit not riddled with flaws, the files would mean nothing. Also, if I placed the files on my device as a general deterrent-- since cellebrite's forensic software is not limited to just LE usage, it would be difficult to prove I had a specific target in mind.