Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cellebrite claims it can unlock any iPhone, many new Android phones for police

wired.com

Post reply on HN
Print view View original

21–30 of 90 posts

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#21

Post by est31 »

mullingitover wrote: post #16

Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license. Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in cour…

There are copyright exceptions for security researchers. Apple can block access to their network services, but I doubt they can do legal action, at least not based on copyright laws. Of course in this particular instance it sucks, but in general, such exceptions are very valuable as they allow researchers to find out about vulnerabilities and warn the public without being impeded by the manufacturer.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#22

Post by dingaling »

That is terrifying given how the phone is the single key to many people's digital identity and their finances.

And that's what scared me into changing my relationship with my phone. I try to treat it as an ephemeral, disposable data terminal in which I have minimal trust.

Every few weeks I back it up to the LAN and purge it. If I lose it I revoke its login certificates so that it can't access the mail and chat servers, and block the PAYG SIM.

Yet more and more services want me to regard it as a secure token endowd with ultimate trust. The latest is one of my banks ( Halifax ) which demands that I install their app to authorise any online payment.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#23

Post by jMyles »

Illniyar wrote: post #10
jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

>First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? That's one way to look at it. Another is that they provide law enforcement the ability to c…

One way or another, they are facilitating (in fact profiting from) one human to forcibly access a sensitive device belonging to another human, with the consent of the latter.

The sex offender spectre doesn't change that.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#24

Post by jMyles »

hueving wrote: post #12
jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

Are you seriously shocked that there are people out there that would be willing to assist law enforcement? It's not like they are advertising this service for anyone to drop by with any arbitrary phone to unlock. They are no worse than locksmiths advertising the ability to crack safes.

> Are you seriously shocked that there are people out there that would be willing to assist law enforcement?

No, as I said, it's the flaunting it that surprises me.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#25

Post by pvg »

mullingitover wrote: post #16

Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license. Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in cour…

The research is mostly in Apple's interest - someone does free work for them. If 'security and privacy' are features you are selling to consumers, 'we sue everyone who fiddles around' is much less convincing messaging than 'we try to make the most secure device we can and if it's compromised, we fix it'.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#26

Post by jMyles »

earenndil wrote: post #18

Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decryption attempts. They probably have a way around the rate-limit. Meaning: if you use an alphanumeric password, you're fine.

I can't immediately find the methodology by which a pattern is converted to a pin.

For example, what's the degree of entropy for a non-trivial 6x6 pattern? (And why is my search fu not availing me of the answer to this question? :-) )

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#27

Post by f1refly »

jMyles wrote: post #26
earenndil wrote: post #18

Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decryption attempts. They probably have a way around the rate-limit. Meaning: if you use an alphanumeric password, you're fine.

I can't immediately find the methodology by which a pattern is converted to a pin. For example, what's the degree of entropy for a non-trivial 6x6 pattern? (And why is my search fu not availing me of the answer to this question? :-) )

Check out the "specific pattern decrypt note" section from the twrp faq

https://twrp.me/faq/openrecoveryscript.html

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#28

Post by gloflo »

earenndil wrote: post #19

This is almost certainly a way to brute-force passwords without the rate limit which is enforced by default. The only reason passwords can be brute-forced is that they're numeric and have few digits. If you use an alphanumeric passcode with at least 8-10 digits, you're fine.

What makes you so certain of that?

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#29

Post by 3xblah »

mullingitover wrote: post #16

Interesting that this company is able to do this without threat of being sued into a smoking crater by Apple. They'd have to use Apple's software to build their product, and to do that they'd be bound by the license agreement. Apple could forbid the research in the license. Oracle created the DeWitt Clause that forbids researchers from publishinging benchmarks for their products, and this apparently stands up in cour…

"Oracle created the DeWitt Clause that forbids researchers from publishing benchmarks for their products, and this apparently stands up in court."

Was this "DeWitt Clause" ever challenged specifically in a trial? If yes, can you give us some details, e.g., date, the name of the opposing party, the venue, etc.?

If it has never been challenged specifically, and gone through litigation all the way to a trial, can we honestly say "it stands up in court"?

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#30

Post by thoughtfunction »

speedplane wrote: post #14
hueving wrote: post #12

Earlier quoted context omitted.

Are you seriously shocked that there are people out there that would be willing to assist law enforcement? It's not like they are advertising this service for anyone to drop by with any arbitrary phone to unlock. They are no worse than locksmiths advertising the ability to crack safes.

> Are you seriously shocked that there are people out there that would be willing to assist law enforcement? ... They are no worse than locksmiths advertising the ability to crack safes. It's more like a locksmith advertising the ability to break anyone's safe that contains details on every place you've ever been, purchase you've ever made, and person you've ever communicated with. Phones are far more ubiquitous and…

Well for #1 & #2, they don't need your phone for that, just subpoenas to the relevant companies. And most people are not international globe trotters where the extra stuff outside of the country would be of much use.

#3 is the real treasure trove.

Post reply on HN