Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

arstechnica.com

Post reply on HN
Print view View original

11–20 of 372 posts

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#11

Post by baxtr »

harambae wrote: post #7
windexh8er wrote: post #6

Earlier quoted context omitted.

Let's be very clear: this is still Google's choice. Google could build a phone that they can't be compelled to do anything to after the phone is sold to their customer, but Google alone chooses to not invest in the security of the phones they're selling to their customers. Because: what is good for the government is now equally good for Google. Do we not remember how Google immediately enabled TLS everywhere, interna…

> how enshittified Google and Apple have become I don’t know about pop-ups or whatever, but as far as mobile security Apple appears to be running the table. Last cellebrite leak showed they couldn’t do anything in BFU, and you can tell Siri to put it back in BFU without hands while being arrested.

BFU = Before First Unlock after power on or reboot.

In this state, a significant portion of the data on the device remains encrypted and inaccessible, unlike the "After First Unlock" (AFU) state, where the necessary encryption keys are available.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#12

Post by usdogu »

aussieguy1234 wrote: post #5

I've set up GrapheneOS on my Pixel with 2FA fingerprint + PIN unlock. No way will anyone be getting into it without my cooperation. My only issue was less compatibility with my local emergency services, since they can't see me on a map for some reason if I call from a GOS phone. My solution to that was a second Pixel as an emergency phone - one with the stock OS, that I'll swap sims with and take with me when hiking,…

Obligatory https://xkcd.com/538

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#13

Post by DANmode »

aussieguy1234 wrote: post #5

I've set up GrapheneOS on my Pixel with 2FA fingerprint + PIN unlock. No way will anyone be getting into it without my cooperation. My only issue was less compatibility with my local emergency services, since they can't see me on a map for some reason if I call from a GOS phone. My solution to that was a second Pixel as an emergency phone - one with the stock OS, that I'll swap sims with and take with me when hiking,…

First I’m hearing Graphene causes issues with E911 - is this a setting?

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#14

Post by Stefan-H »

usdogu wrote: post #12
aussieguy1234 wrote: post #5

I've set up GrapheneOS on my Pixel with 2FA fingerprint + PIN unlock. No way will anyone be getting into it without my cooperation. My only issue was less compatibility with my local emergency services, since they can't see me on a map for some reason if I call from a GOS phone. My solution to that was a second Pixel as an emergency phone - one with the stock OS, that I'll swap sims with and take with me when hiking,…

Obligatory https://xkcd.com/538

Cooperation under duress is still cooperation.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#15

Post by dylan604 »

bigyabai wrote: post #9
harambae wrote: post #7

Earlier quoted context omitted.

> how enshittified Google and Apple have become I don’t know about pop-ups or whatever, but as far as mobile security Apple appears to be running the table. Last cellebrite leak showed they couldn’t do anything in BFU, and you can tell Siri to put it back in BFU without hands while being arrested.

Cellebrite is like the Kmart Blue Light Special of Israeli spyware, when you compare it to Greykey and NSO Group offerings. I would not use their capabilities as the be-all end-all.

> the Kmart Blue Light Special

Hello fellow old timer. Do kids today even get this reference other than possibly just on context? My other favorite old store was a place called Gibsons where their stores signage had each upper case letter as an individual square. After it went under, more than one location became SBINGOS joints where first/last squares were no longer lit.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#16

Post by immibis »

harambae wrote: post #7
windexh8er wrote: post #6

Earlier quoted context omitted.

Let's be very clear: this is still Google's choice. Google could build a phone that they can't be compelled to do anything to after the phone is sold to their customer, but Google alone chooses to not invest in the security of the phones they're selling to their customers. Because: what is good for the government is now equally good for Google. Do we not remember how Google immediately enabled TLS everywhere, interna…

> how enshittified Google and Apple have become I don’t know about pop-ups or whatever, but as far as mobile security Apple appears to be running the table. Last cellebrite leak showed they couldn’t do anything in BFU, and you can tell Siri to put it back in BFU without hands while being arrested.

Lots more devices are safe BFU than just Apple's. It's not that complicated on a technical level - it's basically full-disk encryption.

Apple sells the illusion of security and privacy, but they're not meaningfully more secure or private except from the device's owner. Remember when they made a big deal of blocking Facebook tracking, while simultaneously adding their own intrusive tracking?

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#17

Post by GeekyBear »

bigyabai wrote: post #4
derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

Short answer: Google is a business that can be compelled by the federal government in ways that nonprofits are resistant to. Ron Wyden identified one of these weaknesses in 2023: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

No American company has a choice when the Feds want data stored on a company's server.

That doesn't stop Apple or any other company from designing devices that attempt to keep prying eyes out of the data stored on your device.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#18

Post by immibis »

fluidcruft wrote: post #8
aussieguy1234 wrote: post #5

I've set up GrapheneOS on my Pixel with 2FA fingerprint + PIN unlock. No way will anyone be getting into it without my cooperation. My only issue was less compatibility with my local emergency services, since they can't see me on a map for some reason if I call from a GOS phone. My solution to that was a second Pixel as an emergency phone - one with the stock OS, that I'll swap sims with and take with me when hiking,…

Is there anything actually preventing Samsung or another vendor from adopting GrapheneOS's security innovations?

Probably their legal obligation to comply with secret government orders (FISA, NSL etc - the government probably already said don't make unhackable phones or else) and their informal wish to remain on the regime's good side.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#19

Post by Infernal »

chaps wrote: post #10

Here's the full document without the blurriness: https://www.documentcloud.org/documents/24833831-cellebrite-... (it's been available since 2024 -- found by searching for "android os access support matrix" on documentcloud)

The point here is that the doc you linked is a year and a half old, this (if real) is much newer. Security is a constant arms race between attackers and defenders, nothing is static so updates of this nature are always welcome.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#20

Post by Squealer2642 »

chaps wrote: post #10

Here's the full document without the blurriness: https://www.documentcloud.org/documents/24833831-cellebrite-... (it's been available since 2024 -- found by searching for "android os access support matrix" on documentcloud)

This one doesn't have Pixel 9's so the image in the article has been updated a bit.
Post reply on HN