14 ms·
Cellebrite asks cops to keep its technology secret
- sneak 3y agoIt's funny to me that Apple and the FBI coordinated to spin the whole iPhone decryption thing in the media after the San Bernardino shooting as Apple vs FBI (while in reality the FBI had all the access to all the data they wanted, via iCloud, via an encryption backdoor that Apple explicitly preserved for them). https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... Now Apple no doubt would love to do some RE on these devices to identify and patch any exploits they use, and many of the local PDs that can get Cellebrite to sell them these boxes probably will abide by these terms, having previously been convinced via Apple/FBI propaganda that Apple is opposed to cooperating with law enforcement. It's a little bit funny, but I think Apple security will win out in the long run as it only takes one instance of a leak for Apple to patch a vulnerability, and they do have a lot of money (and the cooperation of the FBI/DHS et al). The text of the training quoted in the article makes it seem that Cellebrite knows they are fighting an ultimately losing battle there, as information never becomes more secret over time, only less so.
- kanbara 3y agoexcept apple now has e2ee for iCloud, and apple still doesnt want others to get into their firmware and secure enclaves
- sneak 3y agoe2ee for iCloud is opt in (ie disabled by default) so approximately 0% of iCloud users use it. Until it's on by default for new iCloud accounts and previous non-e2ee iCloud accounts get automatically upgraded to use it, the fact that it is offered is basically irrelevant. Additionally if you are using it to protect your iMessages, it's ineffective, as your iMessages are stored on Apple servers twice: once for each end of the conversation. Unless both you and the other end of your conversation have both explicitly opted in to e2ee for iCloud, a single party enabling the setting does nothing for the security of iMessage, given that approximately nobody uses the feature today.
- mr_toad 3y agoIf you’re that paranoid, maybe don’t send super sensitive information using a chat application.
- sneak 3y agoThis has nothing to do with "paranoid", or with me personally. I don't use iMessage at all. I also didn't live in Nazi Germany under the SS and Gestapo but I can still recognize and identify that police surveillance over the private communications of all (or even a significant fraction of all) members of society silently and discreetly creates a world which sucks for everyone in it, as things like new political parties or new labor unions (or any other threat to the status quo) will be detected and defeated before they ever gain popular attention or critical mass. Did we already forget OWS and the tea party? How about MLK? Please stop using defined psychological disease terms to describe people who seek basic human rights to privacy from corporations and the state. It's disrespectful to both people who suffer from paranoid delusions as well as sane people who desire human rights.
- smoldesu 3y agoThe fact that we have to call it "their firmware and secure enclaves" is a bit telling, though. The majority of consumer-facing devices today have a layer of inscrutability that we leave up to the manufacturer to implement properly. For instance, Microsoft has Bitlocker, but I couldn't confidently say that isn't backdoored either. Apple has whitepapers, but they're about as verifiable as LK-99 in-practice. Their security model entirely revolves around the Apple-issued root of trust, and if you can't trust them then you have to hit the bricks. If you don't own both ends, the end-to-end encryption shtick is a theatrical farce.
- gochi 3y agoIt can potentially be a theatrical farce, but you've only created hypothetical scenarios in your mind for why that might be the case. Even if you did "own both ends", you still have to rely on other parties to contribute the pieces that you don't watch over, unless you're going to be E2EE from scratch (again, because you can hypothetically just say "well what if the encryption scheme itself is backdoored").
- smoldesu 3y agoBoth of those conceits apply to Apple's scheme as well, though. Transparency enforces accountability, Apple themselves wouldn't be using things like OpenSSL and bash if they weren't open enough to scrutinize and modify.
- kanbara 3y agosure, all clouds are other people’s computers; laypeople just want things to work and don’t really care about whose root of trust they use. living in a world where you run everything yourself sounds good in practice but then you can’t communicate with anyone else. i’d like for the firmware to be open source and for the cloud to be federated, but it’s a pipe dream and i’m busy so i just gotta trust apple in the end
- zirgs 3y agoIf Bitlocker had a backdoor it would have leaked by now. I don't believe that they could keep an "alphabet boys only" backdoor secret for that long. How would that backdoor even look like? A some sort of master key that can decrypt every Bitlocker encrypted drive? Imagine if something like THAT got leaked. Who would have access to that key? Microsoft themselves? NSA? FBI? What about the UK, Australia or other US allies? Do their alphabet boys also get access to this? Do small town cops also get access? And I'm pretty sure lots of security researchers have tried to find vulnerabilities of Bitlocker. If there was something fishy going on - they would have noticed.
- saagarjha 3y agoCellebrite keeps the good stuff on their premises. You send the phone to them and they crack it for you.
- bombcar 3y agoSo all apple needs to do is enable a gps that destroys the Secure Enclave if it detects that it is on a cellebrite campus.
- saagarjha 3y agoI’m sure Cellebrite never buys new real estate.
- flangola7 3y agoYou don't believe Apple would find out about them? They could know before the lease is signed.
- saagarjha 3y agoWhere would they put the code to do this? How would it function if Cellebrite put devices in a Faraday cage before transport?
- minitoar 3y agoIndeed you can’t rely on GPS. But…the absence of GPS for more than a few hours is pretty weird. An automatic reboot and maybe nuke could be appropriate for some users. I guess then the faraday cage also needs a fake gps signal to defeat this.
- flangola7 3y agoApple also has their tracking network. Airtags + every Apple device
- dcastonguay 3y agoIIRC that's not how any of it went down. The authorities wanted access to the device itself and were asking for a "good guys only" backdoor into the device to obtain anything that might not have been in the iCloud backup; Apple refused to do this and that is where the controversy / news story came from. Apple was very open about the fact that law enforcement would have access to the iCloud backup, which is even mentioned in the article you provided. And there was no "backdoor explicitly preserved" for the FBI, the iCloud backup was just not e2ee. This was also (somewhat) common knowledge at the time and what was often suggested was to do backups through iTunes because there was still an option available to encrypt the backup.
- gloyoyo 3y agoDid they say magic twice... Throw that shit out the window.
- kstrauser 3y agoI’d think defense attorneys would be all over that. “We’re suppose to take some ‘hacking company’’s word for it that they’re doing everything forensically correctly, and the prosecution expects us to just trust them?” Were I such an attorney, I’d campaign to taint the reputation of Cellebrite and make the evidence it generates completely untrustworthy.
- solarpunk 3y agoAll the ammunition you need for the last part is right here: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
- saagarjha 3y agoThis is quite frankly a farce of a PR stunt. “Oops we hacked the UFED we stole” is not going to fly in any reasonable court. There are proper ways to get evidence thrown out and trying to use the most petty way possible since it sells well is not it.
- yyyk 3y agoIt's way dumber than a PR stunt. Plenty of Signal users live in totalitarian dictatorships, where the law doesn't care if you're actually guilty. Even in democracies you can't always rely on the courts. "We're planting incriminating evidence on your phone" should lead to mass uninstall of Signal. Except nobody really believes they did that. Signal would be banned from all App Stores, and moxie would go to jail on so many charges. It's one of those nerd law ideas where 'you can't 100% prove it' is the golden defence except it isn't really - the law can call a bluff, especially when millions of users and multiple app stores already did. It says reasonable doubt, not any doubt.
- buzer 3y agoSomewhat similar thing does happens often with DNA evidence. Prosecution submits evidence where report was generated in proprietary software and company's employee testifies that the result is correct & tell the chance of false positive is 1 in 10 billion. Defense asks for access to source code to validate the claims and company says they are trade secrets & judge decides to not grant access and does not dismiss the evidence.
- mike_d 3y agoYou go to court with facts, not a compelling story of how you acquired the facts. If the defense believes the facts are not correct they can challenge the method of collection, at which point the expert witnesses are called to describe to the court how collection is performed. Not that any of this matters anyway. Cellebrite doesn't let you extract from modern phones anymore. You send it to a lab and get back an image you dump into physical analyzer. The actual exploitation of the phones is done by them so they don't have to worry about leaks.
- kstrauser 3y ago> You go to court with facts, not a compelling story of how you acquired the facts. That’s not correct. Check out parallel construction[0] to see the lengths cops will go to in order to make it look like they have a plausible process to have acquired evidence. [0]https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
- mike_d 3y agoThere are plenty of indictments you can read on the internet. It is rare for one to state how evidence was collected unless it is material to the facts of the case. The defense can question or challenge the methods, but that is not a material part of the prosecutions case. As for parallel construction, Herring v. US opened it up as a legitimate investigative process.
- saagarjha 3y agoNo it didn’t. It only allowed it in case of a good-faith mistake, which is very different from intentionally using a Cellebrite to capture evidence illegally.
- runnerup 3y agoCellebrite’s internal processes would still be subject to discovery. Defendants have a right to show that the extraction process was flawed otherwise it could lead to wrongful convictions. Secret / Magic / black box processes can’t generate admissible evidence in criminal proceedings in the US.
- deleted 3y ago[deleted]
- sanex 3y agoWe used to have those in every Verizon store for transferring contacts and whatnot for people to their new phones. I used it for a cop one time and he said oh you're using a cellebrite huh? Those things are pretty incredible aren't they. I had no idea at the time that this was all a big deal. I actually thought they were cumbersome to use and slow. Transferring photos off an old flip phone could take hours, we refused to do it on smart phones once we started getting them. You also couldn't do anything if the phone was locked and on Android you had to enable USB debugging which is now hidden in settings.
- 7174n6 3y agoThe vast majority of these exams are done under the authority of a search warrant issued by a valid court. The police have the authority to access the data on the device...their method of doing it is not really relevant. One of the reasons that companies like Cellebrite of Greyshift are so secretive with their exploits is because as soon as Apple or Google get a grasp of how they are bypassing security mechanisms, they push an update to block it. It's a constant cat and mouse game.
- edrxty 3y agoRegardless of how the legal establishment views it, the access method definitely matters for the data to be unmodified. Things like file system metadata can be effected.
- amelius 3y agoApple also likes to keep it hush hush.
- DueDilligence 3y ago[dead]
- alance 3y agoStill an interesting read: https://signal.org/blog/cellebrite-vulnerabilities/ https://signal.org/blog/cellebrite-vulnerabilities/
- hoofedear 3y agoThis was amazing and made me even more happy to use Signal. Incredible read
- rapsey 3y agoIf you think Cellebrite can't extract all your Signal messages you are very much mistaken.
- viktorcode 3y agoIf the messages are encrypted locally (an option on iOS), and Celebrite fails to brute force your login code, then yes, they cannot extract Signal messages.
- abwizz 3y ago"bypassing" the screenlock is a selling point on the product page, thou
- viktorcode 3y agoLogin code is used to encrypt this data, so merely "bypassing" wouldn't help. It needs to be brute forced.
- abwizz 3y agoif i can try all the combinations i have indeed bypassed the need to know the correct one
- Obscurity4340 3y ago
- _def 3y ago:D I could imagine that they buy 0days for their products to work - and the more get revealed, the less the profits are
- saagarjha 3y agoThey develop them in-house.
- AgentOrange1234 3y agoCan FOIA requests expose this stuff?
- sweetjuly 3y agoFOIA has an explicit exemption for trade secrets which would harm the competitiveness or business interests of a company. Zero days, obviously fall quite clearly under that since Cellebrite spends a huge amount of money on R&D to find and develop exploits.
- deleted 3y ago[deleted]
- tristanb 3y agoI just served on a jury for a that made extensive use of Cellbrite, Greykey and cell tower triangulation. It was crazy how routine this is on law enforcement, and how much they got from an iPhone. (Everything). Case has now completed but it completed because of that evidence.
- noduerme 3y agoPlease tell us more! This is likely the best way for that information to come out.
- throwaway17_17 3y agoWhat information are you looking for? I didn’t know there was such a lack of information on what law enforcement agencies get from Cellebrite. I can only speak to my personal and professional (non-LEO) experience, but I’ll give it a shot.
- bagels 3y agoWhich phone model/version? Did they need anything from other owner? From apple? Physical access? USB? Brute force bypass? Anything you can describe about the capabilities and techniques people would be interested in knowing.
- abwizz 3y agoi rekon that if the case is big enough, the'll get access to the cloud backups. the UFED product page states that it can bypass device locks, this sounds like physical access and would only require the device to be confiscated.
- d__a__n__g 3y ago[flagged]
- qbasic_forever 3y ago
- tamimio 3y agoHow the court will even accept that with a broken chain of custody?! That being said, for iPhone users, make sure to pair lock your device so that any cannot be cloned for later investigations https://arkadiyt.com/2019/10/07/pair-locking-your-iphone-with-configurator-2/ https://arkadiyt.com/2019/10/07/pair-locking-your-iphone-wit...
- saagarjha 3y agoOf course, a vulnerability would allow for bypass of such a thing.
- Obscurity4340 3y agoCouldn't this all be accomplished as well by simply setting an encrypted backup password and making sure you have an alphanumeric with symbols password for maximum entropy? Its my understanding that Cellebrite (maybe not their super secret version) is really just a fancy iTunes backup machine and that it requires no fewer conditions than whatever is required to backup your phone manually at home...
- deleted 3y ago[deleted]
- kazinator 3y ago> “And anyone testifying about those products under oath must not hide important information that could help exonerate a criminal defendant solely to protect the business interests of some company,” What? To exonerate means not to find someone a criminal. It specifically has the nuance of finding someone not guilty due to careful consideration of the facts of the case. Someone who gets off on some technicality has not been exonerated.
- jwilk 3y agoArchived copy without GDPR nag screen: https://web.archive.org/web/20230819193912/https://techcrunch.com/2023/08/19/cellebrite-asks-cops-to-keep-its-phone-hacking-tech-hush-hush/ https://web.archive.org/web/20230819193912/https://techcrunc...
- no_time 3y agoIt's interesting how the guys behind commercializing the Tegra X1 exploit (Nintendo Switch) were nailed to a cross, yet the people commercializing these exploits are given a green light at every step of the process... Copyright and corporate secrets apparently trump personal privacy and secret keeping in our world.
- Shawnj2 3y agoUnfortunately Cellebrite probably isn’t violating the DMCA here.
- _sojh 3y agoSo they are asking for security through obscurity and actually thinking that is going to last. The article mentions a training video that demos the product, yet didn’t include it as far as I can tell. Why is that not being published? I don’t want a transcription of a company telling cops to protect their property, I want to see what this company is able to access when they illegally access my property. Pretty sure if I access a computer system that I’m not authorized to, aka, hacking, I just committed a federal offense, yet a company is legally selling the ability to do that very thing, at scale, to law enforcement and telling them to keep it a secret. Last I checked, a law was a law, and it applied to everybody, not just us common folk. Also, “certainly mention premium” is rich. So don’t disclose the illegal hacking internals, but do give a shout-out and free marketing for our premium product, so others in gov and law enforcement will see what you got from them and go signup. Shit, do they have a referral bonus to? Get on the stand and mention premium and the referral code WHOWATCHESTHEWATCHERS for 60% off your first month. What the fuck? How are these companies allowed to do this? Oh right, because their customers are the ones who would normally be arresting them, so it’s fine to break the law.
- pomatius 3y agoPropietary garbage shouldn't be used for these kinds of public affair stuff