Cellebrite claims it can unlock any iPhone, many new Android phones for police
1–10 of 90 posts
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#2The stamp is pretty awesome. Now all USPS employees are using liteblue portal to get all the benefits. Login to it from https://ncseculogin.website/liteblue-login-liteblue-usps-gov...
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#3First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple?
Annnyway, more importantly: are there any details about how their claims are even possible? I guess that somehow, in every case of both iOS and Android, the symmetric key with which the data directory is encrypted is somehow gleanable?
It's a bit puzzling, because it seems that something as simple as 15-year old LUKS (eg, using dm-crypt) is sufficient for this purpose... right?
I mean, this company isn't claiming it can perform the same attack on an off-the-shelf laptop that has FDE with dm-crypt, right?
What's the difference? Why are phones such a security nightmare? At least in terms of encryption at rest on a cold device, isn't this a solved problem?
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#4Still bums me out there's not an active market like this but for jailbreaking iPhones.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#5It would be interesting to know what kind of bugs they are exploiting for this. Are they attacks over USB, bugs in the lock screen, or in the radio hardware.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#6First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…
>isn't this a solved problem?
It’s only a solved problem if you’re using high entropy passwords (6 digit pins are not). Otherwise you’re relying on some sort of anti-hammering/auto erase to make up for it.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#7Still bums me out there's not an active market like this but for jailbreaking iPhones.
Jailbreakers aren’t willing to fork over millions of dollars and don’t have a monopoly on violence.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#8It is much more likely imo, that they have zero day exploits for something that does not require the phone to be unlocked, eg wireless, 3g/4g, bluetooth, or via the lightning connector.
If they are not doing that one of the only other options i can see is if they can clone the phone and perform a offline brute force against the pin code but my understanding is that the secure enclave is meant to prevent attacks like that.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#9It is much more likely imo, that they have zero day exploits for something that does not require the phone to be unlocked, eg wireless, 3g/4g, bluetooth, or via the lightning connector. If they are not doing that one of the only other options i can see is if they can clone the phone and perform a offline brute force against the pin code but my understanding is that the secure enclave is meant to prevent attacks like…
How would an exploit in wireless, 3g/4g, etc lead to a full compromise of the device? These components don’t have full access to the device to begin with, and definitely don’t have access to the disk encryption keys.
And yeah, you can’t clone an iPhone and get anything usable. The pin is entangled with a secret that never leaves the Secure Enclave, so an offline attack would be an attack on the full encryption key, not on the pin.
Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police
#10First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…
>First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple?
That's one way to look at it. Another is that they provide law enforcement the ability to catch and trial criminals (for instance sex offenders) who are using the phone manufacturer's naivete to hide their nefarious deeds.
It depends on your point of view.