Israeli firm can steal phone data in seconds • Hacker News Board

Re: Israeli firm can steal phone data in seconds

#11

Post by drvdevd » Wed, Nov 23, 2016, 4:16 PM UTC

module0000 wrote: post #7

It goes without saying - don't make this easy for them(or anyone). Use a strong alphanumeric password on your mobile devices. It's annoying and inconvenient until it saves your ass - there is still no "fast" way to crack a password like "My 42nd spaceship had 4 hearts of gold.", but it's not that difficult for your brain to remember. Fingerprint unlock can save you some of the PITA of typing it - just be sure you pow…

Another interesting point they mention is "recovering years long deleted texts." Consider the filesystem your phone uses for volumes it's writing data to and how it (probably just) unlinks files when deleted... [edit] and I should add a 'factory reset' will probably just write a new filesystem table over the old on disk without wiping anything on most devices

Re: Israeli firm can steal phone data in seconds

#12

Post by SG- » Wed, Nov 23, 2016, 4:17 PM UTC

Confused why they didn't demo it breaking a modern iPhone instead of a random Android device.

Re: Israeli firm can steal phone data in seconds

#13

Post by deutronium » Wed, Nov 23, 2016, 4:32 PM UTC

Regarding the iPhone 5c, the attack from Sergei Skorobogatov is very interesting.

"The bumpy road towards iPhone 5c NAND mirroring" - https://arxiv.org/abs/1609.04327

And the video:

https://www.youtube.com/watch?v=tM66GWrwbsY

Re: Israeli firm can steal phone data in seconds

#14

Post by iNerdier » Wed, Nov 23, 2016, 4:35 PM UTC

module0000 wrote: post #7

It goes without saying - don't make this easy for them(or anyone). Use a strong alphanumeric password on your mobile devices. It's annoying and inconvenient until it saves your ass - there is still no "fast" way to crack a password like "My 42nd spaceship had 4 hearts of gold.", but it's not that difficult for your brain to remember. Fingerprint unlock can save you some of the PITA of typing it - just be sure you pow…

It's not that hard to remember, but some sites (my last encounter was paypal) still insist on truncating passwords to a certain length. It's not much fun having to remember "My 42nd spacesh".

Re: Israeli firm can steal phone data in seconds

#15

Post by brianwawok » Wed, Nov 23, 2016, 4:35 PM UTC

alimbada wrote: post #10

They [the government] ask people to login to their email accounts and unlock their phones at the border. They really don't even need any technology to steal data. Intimidation works for them already.

Then we just need a phone inside a phone right? Provide them with a fake password that shows no data, has 1 kids game app, and gives you plausible deniability. If coded correctly would be no way to prove if there is or is not a second deeper encrypted device.

Re: Israeli firm can steal phone data in seconds

#16

Post by tdkl » Wed, Nov 23, 2016, 4:39 PM UTC

45h34jh53k4j wrote: post #5

It will be interesting if Apple went after Cellebrite under the DMCA anti-circumvention clauses. I would laugh if their product became illegal in the United States.

Probably not, it's an Israeli firm.

Re: Israeli firm can steal phone data in seconds

#17

Post by libeclipse » Wed, Nov 23, 2016, 4:41 PM UTC

1024core wrote: post #8

"Could you do anything to deprive them from throwing a stone at someone or from driving a car and running over people? "You can't blame the car manufacturer at that point for delivering a car that was utilised to commit that kind of crime," he said. This is specious reasoning. The point of a car is not to run over people; it's to go from point A to point B. This technology, on the other hand, has only one purpose: to…

A classic example of attacking the straw man.

Re: Israeli firm can steal phone data in seconds

#18

Post by libeclipse » Wed, Nov 23, 2016, 4:42 PM UTC

I wonder if they can crack devices that haven't been booted. Many of the newer smartphones encrypt data and require a password on boot.

Re: Israeli firm can steal phone data in seconds

#19

Post by stephengillie » Wed, Nov 23, 2016, 4:42 PM UTC

iNerdier wrote: post #14

module0000 wrote: post #7

It goes without saying - don't make this easy for them(or anyone). Use a strong alphanumeric password on your mobile devices. It's annoying and inconvenient until it saves your ass - there is still no "fast" way to crack a password like "My 42nd spaceship had 4 hearts of gold.", but it's not that difficult for your brain to remember. Fingerprint unlock can save you some of the PITA of typing it - just be sure you pow…

It's not that hard to remember, but some sites (my last encounter was paypal) still insist on truncating passwords to a certain length. It's not much fun having to remember "My 42nd spacesh".

Paypal and other websites are not mobile devices. Using a high-entropy random password is still a best practice with those, and many of us recommend a (database or deterministic) password manager.

Re: Israeli firm can steal phone data in seconds

#20

Post by wang_li » Wed, Nov 23, 2016, 4:44 PM UTC

brianwawok wrote: post #15

alimbada wrote: post #10

They [the government] ask people to login to their email accounts and unlock their phones at the border. They really don't even need any technology to steal data. Intimidation works for them already.

Then we just need a phone inside a phone right? Provide them with a fake password that shows no data, has 1 kids game app, and gives you plausible deniability. If coded correctly would be no way to prove if there is or is not a second deeper encrypted device.

Backup your phone. Wipe your phone. Cross the border. Restore your phone.