Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

signal.org

Post reply on HN
Print view View original

221–230 of 352 posts

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#221

Post by exikyut »

thricegr8 wrote: post #183
tGr5lGf7 wrote: post #179

Cellebrite doesn't even have a bug bounty programme or contact to report their bugs. Last year I've managed to gain partial access to one of their systems and it took me weeks emailing their internal email addresses to finally fix the bug. They were total ass about it. Now I've got complete access to their entire database and I don't know what do. Can HN advise?

Post is here and let folks take a look.

Really REALLY bad idea - this is one of law enforcement's larger pet gadgets and companies, so the GP would not only have a particularly enthusiastic mob coming after them, said mob's pitchforks would have automatic cannon launchers and EMPs and push-button-activated nunchucks and all kinds of other crazy things that aren't legal for standard-issue pitchforks.

So if the database is fingerprintable to the GP specifically in any way, they're very very dead. And the random username doesn't even count here; they probably didn't post from Tor, so their real IP is connected to this post.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#223

Post by lostcolony »

neodymiumphish wrote: post #210
maccam912 wrote: post #90

Earlier quoted context omitted.

Knowing that at least one row of data in a database might have been modified randomly means you can't fully trust any one line in the database completely. It reminds me of the story of https://en.wikipedia.org/wiki/Annie_Dookhan

Sure, but the data on the phone will lead you to evidence in the real world, which will be meaningful proof that can be used in court.

You either will have to come up with a plausible (literally, 'warranted') way to have gotten that data in the real world without relying on the data on the phone as the reason you went looking, or it will likely be thrown out due to it being "Fruit of the poisonous tree".

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#224

Post by swyx »

my TL;DR (but its a damn good read and funny too)

- Cellebrite helps oppressive regimes read your messages

- Signal keeps your messages private

- Cellebrite announces "Signal support"

- Signal finds 9 years of vulnerabilities in Cellebrite

- Signal permanently pwns Cellebrite

You come at the king, you'd best not miss.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#225

Post by [deleted] »

phyzome wrote: post #199
twright0 wrote: post #158

Earlier quoted context omitted.

The end of the post is extremely specifically and carefully not describing a framework for rolling out files to exploit these vulnerabilities; those files as described do nothing, and serve only aesthetic purposes. While it's easy to read that as a wink that they are exploiting the vulnerabilities they found while maintaining plausible deniability that they aren't, it's equally possible it's the other way around: the…

The optimal thing for them to do would be to build the framework and ship partially corrupted JPEGs that don't actually do anything nasty to Cellebrite. Cellebrite can verify that the machinery is there (not a totally idle threat) but no one can prove that Signal has actually done anything illegal. Cellebrite then wastes a bunch of times gathering and analyzing the files without actually learning anything from it. Th…

[deleted]

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#226

Post by vorpalhex »

tGr5lGf7 wrote: post #179

Cellebrite doesn't even have a bug bounty programme or contact to report their bugs. Last year I've managed to gain partial access to one of their systems and it took me weeks emailing their internal email addresses to finally fix the bug. They were total ass about it. Now I've got complete access to their entire database and I don't know what do. Can HN advise?

Well definitely don't share it with DDOS secrets, news outlets or any other major company that would potentially report on it. That would be very bad press for Cellebrite, and if they connected it to you they could be very annoying - though again, they would need pretty good evidence connecting it to you and things like TOR and proper privacy practices would make that very difficult. So definitely don't do that, or use something like tails to post it to multiple SecureDrop outlets.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#227

Post by hunter-gatherer »

kstrauser wrote: post #220
neodymiumphish wrote: post #208

Earlier quoted context omitted.

Eh, this goes two ways. Cellebrite is rarely going to result in the only meaningful evidence that proves a single element of the offense. Instead, it is often used to further an investigation in order to find evidence that is more damning and of a higher evidentiary value. Fortunately for law enforcement, the integrity of the Cellebrite-obtained data is all that important if it leads to further evidence that is more…

I don’t think that’s true. There’s a legal idea of “fruit of the poisonous tree”[0] that basically says you can’t use bad evidence, either in court or as an excuse to collect more, valid evidence. The defense attorney would say “if it hadn’t been for that completely untrustworthy Cellebrite evidence, the police wouldn’t have been able to get that search warrant they used to find the gun at his house, so we want that…

A defense team would need to show that the report had indeed been spoiled with such an exploit as demonstrated by the Signal team. Just because the possibility exists doesn't mean it happened. If there is a significant evidence report from a cellebrite pull, it almost always means that it either successfully unlocked the device or acquired a full physical image or both.

A report doesn't have to be generated by PA. A forensic examiner is free to use other methods to examine the binary. So long as the examiner can explain all the actions and any artifacts that would be left behind.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#228

Post by tediousdemise »

To be fair, this vulnerability disclosure is worthless, because it wasn’t actually disclosed—the true vulnerability is purported to be in the file that Signal uses to execute arbitrary code, of which the details are not shared. We are relying on pure trust that the video demonstration of the purported vulnerability is not a forgery.

Additionally, I see from the video that the purported vulnerability is present in UFED version 7.40.0.229. There is nothing stopping Cellebrite from patching this purported vulnerability, and shipping trustworthy versions of UFED going forward.

If there is a concern that the purported vulnerability still exists, the burden of proof will be with the person claiming the vulnerability exists, for each new version of UFED. Cellebrite doesn’t even need to implement actual code, but merely increment the UFED version number. It will be an endless cat and mouse game driven by baseless claims from both sides.

Since this vulnerability has not been reproduced by third parties, it could be equally likely that Signal is using a psyop rather than exploiting a genuine vulnerability. In either scenario, it casts doubt on Cellebrite; the damage is done by convincing you, the reader.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#229

Post by sneak »

tediousdemise wrote: post #228

To be fair, this vulnerability disclosure is worthless, because it wasn’t actually disclosed—the true vulnerability is purported to be in the file that Signal uses to execute arbitrary code, of which the details are not shared. We are relying on pure trust that the video demonstration of the purported vulnerability is not a forgery. Additionally, I see from the video that the purported vulnerability is present in UFE…

Many vulnerabilities are disclosed without simultaneous disclosure of the PoC. That doesn't make it worthless.

Also, not disclosing specifics is reasonable here, given that the vendor is themselves known for using, hoarding, and selling access to 0days.

There is no obligation for a researcher to share their research with such a corrupt vendor.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#230

Post by sneak »

lostcolony wrote: post #223
neodymiumphish wrote: post #210

Earlier quoted context omitted.

Sure, but the data on the phone will lead you to evidence in the real world, which will be meaningful proof that can be used in court.

You either will have to come up with a plausible (literally, 'warranted') way to have gotten that data in the real world without relying on the data on the phone as the reason you went looking, or it will likely be thrown out due to it being "Fruit of the poisonous tree".

That's precisely what parallel construction is: a lie told by investigators to the court to sidestep the poison tree, bolstered by real evidence specifically gathered to lie outside of the branches of same.

It's a method that crooked law enforcement uses to deceive courts. It's so common as to have its own name now.

Post reply on HN