9 ms·
Trump shooter used Android phone from Samsung; cracked by Cellebrite in 40 min
- talldayo 2y ago[flagged]
- Horffupolde 2y agoThat’s like sarcastic sarcasm which cancel themselves.
- talldayo 2y agoWell, here in the Land of the Free it might be illegal for me to tolerate discrimination against them based on shared ancestry. So my only option is to show my outspoken appreciation for such a talented group of nationally-localized individuals that specialize in exporting surveillance software. Great job!
- jrockway 2y agoThat's interesting. Back when I used Android a decade ago I thought you had to enter a passcode for LUKS or something, to decrypt all the user data. Maybe I am misremembering?
- 15155 2y agoThis is a company whose entire business model is derived from hoarding vulnerabilities. I'm guessing this was a brute force attack or side channel attack of some kind, in concert with a packaged zero-day.
- throwawayokwud 2y agoFrom a tour I got in a forensics lab a while back, injecting a bootloader to bruteforce PINs was one of the options available at least. Had rows of phones punching numbers just waiting for the screen to turn green
- 15155 2y agoThe actual injection of this program is what would generally require a high-value exploit on most devices.
- hereme888 2y agoSo the TLDR is that a beta version of Cellbrite unlocked the phone, and it can't yet unlock iOS 17.x or later. But we don't know what version of Android his phone had, or what "newer Samsung model" means. There's nothing surprising about state actors being able to quickly unlock the phone of a [failed] presidential assassin.
- tantalor 2y agoNo, we expect phone locking to work, even against state actors. The news here is that some Samsung model has an otherwise unknown exploit. If they can crack his phone they can crack your phone.
- tivert 2y ago> No, we expect phone locking to work, even against state actors But that's an unreasonable expectation because software is universally such garbage. Some is just less garbage than others. State actors have the resources to find the holes in anything that isn't utterly perfect.
- jeroenhd 2y ago> If they can crack his phone they can crack your phone. And not just them, anyone with access (legal or otherwise) to these tools can.
- np- 2y agoIt’s a bit of a futile strategy though, kind of like trying to build a wall thick enough that a state actor can’t bust through. That is impossible because the state has access to nuclear weapons, gigantic drills, thousands of intelligent people whose sole mission in life is to break down that wall, nearly infinite budget, etc. The only strategy that might work is to make it expensive or unviable to crack every single device. But in the case of something like this, an assassination attempt, then it’s a given that all stops are going to be pulled to crack it.
- a0123 2y ago
- SEJeff 2y agoI suspected that they used Cellebrite for this three days ago: https://x.com/SEJeff/status/1813079033430876433 https://x.com/SEJeff/status/1813079033430876433 As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN. Also, do not enable the biometrics such as FaceID. I'm very much of this opinion[1] that biometrics are usernames, not passwords. [1] https://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...
- dmix 2y agoAnd turn your phone power off before committing a crime… The first thing the police will do is connect it to power battery packs
- millzlane 2y agoDon't even bring your phone with you. You need to use old school methods to avoid tracking.
- azinman2 2y ago[flagged]
- JKCalhoun 2y agoI've been using this technique for some time now and it has been working really well.
- dylan604 2y agoHere's a list of people that have strong disagree[0]. What about those that have been falsely identified by facial recognition software? Just because you think you've committed no crime doesn't mean the authorities have the same thought. [0] https://en.wikipedia.org/wiki/List_of_wrongful_convictions_in_the_United_States https://en.wikipedia.org/wiki/List_of_wrongful_convictions_i...
- nope1000 2y agoMaybe a morbid question but could they theoretically unlock the phone with the fingerprint of his corpse or do those sensors require current (like a touchscreen does)? I'm asking because I heard in the US law enforcement can force you to unlock your device with biometrics but I wonder if that only works if the subject is alive.
- delecti 2y agoSeems the answer is yes, but only if you do the unlock very quickly after death. The reason seems to be what you suspected, that the fingerprint sensors require capacitance which is only maintained while we're alive. https://www.livescience.com/62393-dead-fingerprint-unlock-phone.html https://www.livescience.com/62393-dead-fingerprint-unlock-ph...
- spywaregorilla 2y agoSurely we can juice up a dead thumb to make it work, though, right?
- nordsieck 2y ago> Surely we can juice up a dead thumb to make it work, though, right? At that point, it's probably easier to just clone the fingerprint and drape it over a purpose built prosthetic.
- spywaregorilla 2y agoIs that easy? Sounds not too difficult
- nordsieck 2y ago> Is that easy? Looks pretty easy to me https://www.youtube.com/watch?v=tj2Ty7WkGqk https://www.youtube.com/watch?v=tj2Ty7WkGqk
- 2y ago
- jeroenhd 2y agoI can't find who's the source on this. The best I can find is "people familiar with the investigation", but both the FBI and Cellebrite refused to comment on the story. This article quotes Bloomberg, which seems to be a copy of the Washington Post's article without all of the fluff. I'm not surprised, there was a recent report that showed that Cellebrite can unlock any phone except for recent iOS and GrapheneOS. I'm just confused who "the people" that are being quoted everywhere are supposed to be.
- kevinmchugh 2y agoIt's an anonymous source. Someone who knows something and isn't supposed to say it, so figure someone at the FBI or Cellebrite most likely. Anonymous sourcing is a fraught practice, but often a necessary one if a journalist doesn't want to be restricted by what an organization will officially allow. You have to evaluate the publication, the journalist, and whatever details are available to decide if you want to trust them. The better publications will have policies on when anonymous sources can be used and may have those policies or an explainer of same available to readers. Eg here's Wapo's write-up on it: https://www.washingtonpost.com/policies-and-standards/#sources https://www.washingtonpost.com/policies-and-standards/#sourc...
- adolph 2y agoIts a claim that won't be confirmed and even if verified might be a lie to hide some better tech or just inane CYA. As an example, there is still nonpublic Kennedy material. Why would this event be any different?
- instagib 2y agohttps://www.404media.co/leaked-docs-show-what-phones-cellebrite-can-and-cant-unlock/ https://www.404media.co/leaked-docs-show-what-phones-cellebr... They have a few charts listed. There’s still the several other companies with support documents that haven’t leaked.
- deleted 2y ago[deleted]
- rc_mob 2y agoAm I the only one who has nothing important on my phone and also don't lock it at all. Can't even get emails on my phone. I can however post comments on hacker news. FBI can have this comment for its data.
- trallnag 2y agoThen why do you have a phone?
- OutOfHere 2y agoSome basic phone security practices: 1. Set a sufficiently strong alphanumeric password for your lock screen. 2. Remember to reboot your phone weekly to reset any non-root malware. 3. Disable multimedia in the SMS messaging app as it's a vector for Pegasus style malware. 4. If using Signal, go to Settings, Privacy, Phone number, and set everything to Nobody. This again blocks messages from unknown users that could be a vector for Pegasus style malware. I wish there was a system-wide permission to audit and/or disable screenshots, but there isn't.