Israeli firm can steal phone data in seconds • Hacker News Board

Re: Israeli firm can steal phone data in seconds

#51

Post by drvdevd » Wed, Nov 23, 2016, 7:16 PM UTC

jdironman wrote: post #29

drvdevd wrote: post #11

Earlier quoted context omitted.

Another interesting point they mention is "recovering years long deleted texts." Consider the filesystem your phone uses for volumes it's writing data to and how it (probably just) unlinks files when deleted... [edit] and I should add a 'factory reset' will probably just write a new filesystem table over the old on disk without wiping anything on most devices

What about doing a factory reset, then use the 'encrypt device' option, then doing another factory reset. Would that provide an extra measure? Unless, of course, the data in it's final state before the final factory reset is un-encrypted.

Of course it depends on the phone. Many qualcomm based Android devices seem to have had their Full Disk Encryption scheme broken at the moment [1], for example. But either way, if your disk encryption scheme doesn't fully wipe the disk before use, then any data that ever hit the disk unencrypted could still possibly be sitting there until its physical blocks are consumed (or could be in a cache somewhere). Again this also depends on the hardware, in this case the storage hardware itself. SSDs using TRIM can wipe unused, unencrypted blocks for example in some scenarios. Who knows about the particular functioning of some SD type controller in a phone or even the card's own embedded OS [2].

I would say if you have data on your smartphone you don't want recoverable at rest, take module0000's advice, then also use encryption, and then also use a multi-pass wipe tool on particluar files. Of course all of this could still not work.

For example, I'm not sure what the forensic ramifications of a seemingly more complex filesystem like APFS will be in the near future when it hits iOS.

[1] https://bits-please.blogspot.com/2016/06/extracting-qualcomm...

[2] https://www.bunniestudios.com/blog/?p=3554

Re: Israeli firm can steal phone data in seconds

#52

Post by dalbasal » Wed, Nov 23, 2016, 7:18 PM UTC

1024core wrote: post #8

"Could you do anything to deprive them from throwing a stone at someone or from driving a car and running over people? "You can't blame the car manufacturer at that point for delivering a car that was utilised to commit that kind of crime," he said. This is specious reasoning. The point of a car is not to run over people; it's to go from point A to point B. This technology, on the other hand, has only one purpose: to…

I think you're misunderstanding that quote.

He's saying (if I understand correctly, it's awkwardly phrased) that his company sells only to a small number of clients who are all regimes (meaning states). There are only a handful so he can vet them and demand commitments that the technology will only be used for good.

Plenty of other reasons to disagree. But, he is basically agreeing with you that this technology should be treated as a dangerous weapons-like thing and controlled in the way the sale of advanced weapons is controlled.

Re: Israeli firm can steal phone data in seconds

#53

Post by zw123456 » Wed, Nov 23, 2016, 7:21 PM UTC

sqeaky wrote: post #27

Does encryption defeat this? If not how are they getting the key from memory? Does encryption defeat this when the device is off? If not what flaws exist in the encryption schemes?

I was wondering the same thing. If the data on the flash ram chip is not encrypted then worse case you just de-solder it and connect it to another computer and dump the data, I think I have seen that demonstrated someplace before. But I guess if they are using the users password you can just password cracking.

Re: Israeli firm can steal phone data in seconds

#54

Post by ronreiter » Wed, Nov 23, 2016, 7:21 PM UTC

JumpCrisscross wrote: post #39

Does anyone track the quantity of U.S. tax dollars which go to such firms?

It's a profitable company. It doesn't need US money. If your government needs to hack a phone that belongs to a terrorist to protect innocent US citizens then what's the problem?

Oh, you're an antisemite. Sorry, missed that.

Re: Israeli firm can steal phone data in seconds

#55

Post by ronreiter » Wed, Nov 23, 2016, 7:22 PM UTC

sqeaky wrote: post #27

Does encryption defeat this? If not how are they getting the key from memory? Does encryption defeat this when the device is off? If not what flaws exist in the encryption schemes?

Encryption could help but eventually exploits can beat anything.

Re: Israeli firm can steal phone data in seconds

#56

Post by dogma1138 » Wed, Nov 23, 2016, 7:28 PM UTC

tdkl wrote: post #16

45h34jh53k4j wrote: post #5

It will be interesting if Apple went after Cellebrite under the DMCA anti-circumvention clauses. I would laugh if their product became illegal in the United States.

Probably not, it's an Israeli firm.

Israel has a trade agreement with the US so DMCA is at the least partially enforced, most trade agreements have a bilateral enforcement of trademark and copyright protection laws.

Israel is also a member of the WTO so there is that avenue also.

Re: Israeli firm can steal phone data in seconds

#57

Post by drvdevd » Wed, Nov 23, 2016, 7:44 PM UTC

jdironman wrote: post #29

drvdevd wrote: post #11

Earlier quoted context omitted.

Another interesting point they mention is "recovering years long deleted texts." Consider the filesystem your phone uses for volumes it's writing data to and how it (probably just) unlinks files when deleted... [edit] and I should add a 'factory reset' will probably just write a new filesystem table over the old on disk without wiping anything on most devices

What about doing a factory reset, then use the 'encrypt device' option, then doing another factory reset. Would that provide an extra measure? Unless, of course, the data in it's final state before the final factory reset is un-encrypted.

Actually, after re-reading your scheme it doesn't sound too bad either... the main problem would seem to be then if the encryption was fundamentally broken (ie: if the encrypted bits are recoverable after the second factory reset and could then be decrypted)

Re: Israeli firm can steal phone data in seconds

#58

Post by verbify » Wed, Nov 23, 2016, 7:45 PM UTC

1024core wrote: post #8

"Could you do anything to deprive them from throwing a stone at someone or from driving a car and running over people? "You can't blame the car manufacturer at that point for delivering a car that was utilised to commit that kind of crime," he said. This is specious reasoning. The point of a car is not to run over people; it's to go from point A to point B. This technology, on the other hand, has only one purpose: to…

There can be good reasons to break into cellphones, just like there can be good reasons to have a lock pick.

Our problems stem from overfunded and underregulated intelligence agencies, not from the tools they use.

Re: Israeli firm can steal phone data in seconds

#59

Post by r00fus » Wed, Nov 23, 2016, 7:56 PM UTC

mschuster91 wrote: post #50

r00fus wrote: post #36

Earlier quoted context omitted.

Any sales to US firms could be curtailed or punished. Just like security itself - the goal is to provide enough barriers so predators go looking elsewhere for easier prey.

> Any sales to US firms could be curtailed or punished. That doesn't really restrict the NSA, CIA, FBI or any other agency/PD from buying their services. After all, that's what "black budgets" are for.

Most of these firms use private contractors to do the dirty work. Unless contractors can bypass legal oversight, they'll be constrained as well.

Re: Israeli firm can steal phone data in seconds

#60

Post by eridius » Wed, Nov 23, 2016, 7:58 PM UTC

drvdevd wrote: post #11

module0000 wrote: post #7

It goes without saying - don't make this easy for them(or anyone). Use a strong alphanumeric password on your mobile devices. It's annoying and inconvenient until it saves your ass - there is still no "fast" way to crack a password like "My 42nd spaceship had 4 hearts of gold.", but it's not that difficult for your brain to remember. Fingerprint unlock can save you some of the PITA of typing it - just be sure you pow…

Another interesting point they mention is "recovering years long deleted texts." Consider the filesystem your phone uses for volumes it's writing data to and how it (probably just) unlinks files when deleted... [edit] and I should add a 'factory reset' will probably just write a new filesystem table over the old on disk without wiping anything on most devices

On devices with full-disk encryption (such as iPhones made in the past few years), a "factory reset" is equivalent to scrambling the entire disk. This is because it securely erases the keys that were used for all the data on the disk, and without the keys, all that data is effectively random garbage.