Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

arstechnica.com

Post reply on HN
Print view View original

41–50 of 372 posts

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#41

Post by doodlebugging »

dylan604 wrote: post #15
bigyabai wrote: post #9

Earlier quoted context omitted.

Cellebrite is like the Kmart Blue Light Special of Israeli spyware, when you compare it to Greykey and NSO Group offerings. I would not use their capabilities as the be-all end-all.

> the Kmart Blue Light Special Hello fellow old timer. Do kids today even get this reference other than possibly just on context? My other favorite old store was a place called Gibsons where their stores signage had each upper case letter as an individual square. After it went under, more than one location became SBINGOS joints where first/last squares were no longer lit.

Another old-timer here who grew up with Gibsons. It was the only grocery store in town back in the days before WalMart invaded. Ammunition, camping gear, dry goods, garden supplies, farm and ranch supplies, blue jeans, shirts, ties, overalls, etc. They sold everything under one roof in a town of 2500.

I thought they had all been swallowed up and shut down until I moved up here to N Texas and was surprised to find a Gibsons here. It took me a while before curiosity took hold but several years later I visited the store, approx 2003-2004ish, and found they still used old-school cash registers, had no UPC scanning capability and every item had a price tag stuck to it. I think they have since moved into the more modern world locally but the store is still there and is a good source for items that you used to need to go to the town's original hardware stores to find. Some of the items on the shelves may have been in inventory here since the 1970's or 1980's. It's a bit like a time machine where you can get obsolete stuff in a pinch if it is still in stock.

I worked slapping price tags on items in KMart back in the day so I too understand the reference. Glad I'm done with that.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#42

Post by zb3 »

Another great thing about GrapheneOS (besides security) is that Google Play Services can be installed without elevated privileges and even in a separate profile which can't run in the background. This makes the phone suitable for both normal usage and for those cases where you need to use some "official" app.

It passes Play Integrity "MEETS_BASIC_INTEGRITY" but of course doesn't pass higher levels but not because it's insecure - it's because it refuses to grant GMS elevated privileges. Good news is that banking apps can whitelist GrapheneOS using standard Android attestation mechanism (and some already did).

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#43

Post by Veserv »

windexh8er wrote: post #6
bigyabai wrote: post #4

Earlier quoted context omitted.

Short answer: Google is a business that can be compelled by the federal government in ways that nonprofits are resistant to. Ron Wyden identified one of these weaknesses in 2023: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

Let's be very clear: this is still Google's choice. Google could build a phone that they can't be compelled to do anything to after the phone is sold to their customer, but Google alone chooses to not invest in the security of the phones they're selling to their customers. Because: what is good for the government is now equally good for Google. Do we not remember how Google immediately enabled TLS everywhere, interna…

Ah yes, Google could make a unhackable phone secure against state actors, they just do not feel like it.

Not at all a problem that is viewed as so impossible that the very notion of it is beyond belief to the overwhelming majority of software developers. Google can just waltz on down to the corner store and get a jug of unhackable phone software. They just do not want to.

The fact of the matter is that they are incapable of making systems consistently secure against even moderately funded professional cyber demolitions teams. This is true across the entire commercial IT industry with literal decades of evidence and proof time and time again.

Could it also be a conspiracy? Could they also have deliberate backdoors? Sure. But even without them their systems and everyone else are grossly inadequate for the current threat landscape which only continues to pull further and further ahead of their lackluster system security.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#44

Post by zb3 »

IncreasePosts wrote: post #34
derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

Is grapheheOS actually harder to hack or does cellebrite just not put a lot of effort into supporting it because the very low odds of LEs running into one in the wild?

It physically disables USB ports when locked which significantly reduces the attack surface + can be configured to automatically reboot.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#45

Post by dns_snek »

IncreasePosts wrote: post #34
derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

Is grapheheOS actually harder to hack or does cellebrite just not put a lot of effort into supporting it because the very low odds of LEs running into one in the wild?

Clearly it's harder but just how much harder is anyone's guess? Surely higher value targets would be more likely to use Graphene, so I would think that would make it just as important to invest resources into.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#46

Post by thisonetimeonly »

gleenn wrote: post #28
bitwize wrote: post #22

Earlier quoted context omitted.

The government has ways of twisting the arms of uncooperative people/organizations into providing all the backdoors they need. Everything from increased tax and regulatory scrutiny to "discovering" CSAM on executives' computers or phones. The government does what it wants because it's the government. Mere laws generally don't stand in its way for long.

I think this is a very negative idea to promote: that laws should can be subverted. Everyone should believe that laws work and when they don't we should work to fix that, not assume that it can never be fixed.

It’s the truth, however. Blinding yourself to it won’t make governments any less inclined to bend (or outright break) any laws they deem necessary to achieve their goals. We should work to fix that, no question about it, but ignorance will not by itself improve the situation in imaginable any way.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#47

Post by falleng0d »

IncreasePosts wrote: post #35
throawayonthe wrote: post #25

Earlier quoted context omitted.

https://grapheneos.org/features#duress :D

Use that and you'll get charged with destruction of evidence

if you're relying on such feature, you'll probably serve less time being charged with destruction of evidence...

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#48

Post by j1elo »

> Notably, the Pixel 10 series is moving away from physical SIM cards.

Is it? I hadn't followed news of the new Pixels.

I don't like the idea of modernizing this and going full eSIM. It will introduce a lot of new friction, somehow I don't doubt it. Just now arrived to Mexico for a quick trip and grabbed a prepaid SIM from a 7-11 in the airport. All quick and simple. I doubt things would be so seamless when not having a SIM tray in the phone. Having to go through an official process to register a new card, ID oneself, hope to not have any incompatibility with the eSIM slots in your phone (admittedly I don't know how this works)... vs. just paying MXN100 and leave the store with a ready to use number.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#49

Post by sciencejerk »

chaps wrote: post #10

Here's the full document without the blurriness: https://www.documentcloud.org/documents/24833831-cellebrite-... (it's been available since 2024 -- found by searching for "android os access support matrix" on documentcloud)

[flagged]

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#50

Post by kangs »

bigyabai wrote: post #4
derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

Short answer: Google is a business that can be compelled by the federal government in ways that nonprofits are resistant to. Ron Wyden identified one of these weaknesses in 2023: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

google even has specially signed fw that let you root the device and unlock anything that doesn't rely on the passcode. secureboot passing and all. i can't imagine that the nsa doesnt have them. after that you just gotta crack the usually very simple passcode. wouldny be surprised if thats what cellrite has lol.
Post reply on HN