Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

signal.org

Post reply on HN
Print view View original

51–60 of 352 posts

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#51

Post by tptacek »

Nextgrid wrote: post #6

So I wonder, why disclose this? This will just prompt Cellebrite to improve its security process and sandbox the entire tool. If they wanted to destroy the credibility of the tool, using the vulnerabilities to silently tamper with the collected data or even leaking it online would be a much better option and hit them without any warning, not only jeopardizing those cases but forever casting doubt on not just Cellebri…

Whether Cellebrite is secure or not has really not much impact on Signal. Shore up Cellebrite's security, don't, either way, pretty much same threat to users. But calling them out like this could force them to placate their customers by spending money on software security --- something they apparently haven't been doing --- and inflicting costs on your adversary is good praxis.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#52

Post by idlewords »

This is pretty irksome. I get how satisfying it must feel, but the one thing I want as a Signal proponent is for the app to be boring and reliable. That means make it easy to use enough to be mainstream, squash bugs, and do all the lovely security work you do.

That does not mean adding stuff like untraceable cryptocurrency payments or very publicly tweaking the noses of law enforcement, and bragging about how you're putting exploits in your app to hack them.

This isn't 1993 and the last thing we need is more pretexts to ban E2E encrypted apps in the countries where they're needed the most. I think this trades a moment's satisfaction for a very bad long-term outcome.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#53

Post by godelski »

tptacek wrote: post #37
godelski wrote: post #10

Earlier quoted context omitted.

Any court case where Cellebrite's tools have been used are now in jeopardy since the defence can just say that they were hacked by someone else. There's now reasonable doubt that Cellebrite can't be trusted. This damages their reputation with governments too.

Not really. The same circumstances exist for almost all digital evidence. Of course, a lot of Cellebrite usage is extrajudicial already.

If you're failing some basic security it isn't going to give much confidence.

But also users don't know now if their systems will explode if they try to gather Signal (or other app) data.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#54

Post by colmmacc »

As a Signal user and moxie fan I love that post, but I worry that it places Signal in legal peril from Apple.

My fear, and prediction, is that the authorities will frame this as an even more egregious attack on law enforcement and that interfering with investigations is a crime (I'm not a lawyer, but I play one in hacker news comments, and that sounds like a crime). They'll lean on the app stores and the app stores will lean on or remove Signal.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#55

Post by mike_d »

gruez wrote: post #23
amluto wrote: post #9

Now if only I could use legitimate tools to access my own Signal data on an iOS device.

doesn't an itunes backup contain all the app data?

I own a Cellebrite, and yeah you are right. The Cellebrite box is nothing other than a phone backup tool. The nice thing it does is implement every backup sync protocol for every version of every mobile OS so you don't have to spend a whole day trying different combinations of iTunes and such.

The "Physical Analyzer" is just a forensics tool. There are dozens of competitors out there that will take a phone and surface the things that might be interesting in a court case or law enforcement investigation.

The product Signal didn't talk about - which I think is the one they are upset about - is Cellebrite Premium. That is their service where law enforcement can send locked or damaged devices to their lab and get back a an image to load into PE. However in 99% of cases devices are either accessed because they are running old software with public vulnerabilities, or using the magic phrase "would you mind unlocking your phone so we can clear this matter up?"

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#56

Post by kevinmchugh »

Zarathust wrote: post #44
kbenson wrote: post #22

Earlier quoted context omitted.

Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. Pretty sure it's the former, since the above is a way to ensure that Cellebrite can't just gather all implied expl…

This indeed looks like a FUD statement, implying that they can have an infinite amount of potential vulnerabilities. Realistically though, writing parsers that do not yield control of your whole device is not that complex. The people exploiting iOS zero days can certainly do it.

It's not that hard but neither is shipping patched versions of ffmpeg. This company will have some catching up to do.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#57

Post by faitswulff »

Nextgrid wrote: post #6

So I wonder, why disclose this? This will just prompt Cellebrite to improve its security process and sandbox the entire tool. If they wanted to destroy the credibility of the tool, using the vulnerabilities to silently tamper with the collected data or even leaking it online would be a much better option and hit them without any warning, not only jeopardizing those cases but forever casting doubt on not just Cellebri…

Signal may have had countermeasures in place long before the blog post, as well.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#58

Post by jjoonathan »

idlewords wrote: post #52

This is pretty irksome. I get how satisfying it must feel, but the one thing I want as a Signal proponent is for the app to be boring and reliable. That means make it easy to use enough to be mainstream, squash bugs, and do all the lovely security work you do. That does not mean adding stuff like untraceable cryptocurrency payments or very publicly tweaking the noses of law enforcement, and bragging about how you're…

Signal isn't going to actually do it, they know how that would end, they're just playing the FUD game in the other direction. Which I am 100% on board with.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#59

Post by spoonjim »

idlewords wrote: post #52

This is pretty irksome. I get how satisfying it must feel, but the one thing I want as a Signal proponent is for the app to be boring and reliable. That means make it easy to use enough to be mainstream, squash bugs, and do all the lovely security work you do. That does not mean adding stuff like untraceable cryptocurrency payments or very publicly tweaking the noses of law enforcement, and bragging about how you're…

Signal has a strong ideology. If you don’t want to be a part of that then don’t use the app.

Re: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer

#60

Post by idlewords »

jjoonathan wrote: post #58
idlewords wrote: post #52

This is pretty irksome. I get how satisfying it must feel, but the one thing I want as a Signal proponent is for the app to be boring and reliable. That means make it easy to use enough to be mainstream, squash bugs, and do all the lovely security work you do. That does not mean adding stuff like untraceable cryptocurrency payments or very publicly tweaking the noses of law enforcement, and bragging about how you're…

Signal isn't going to actually do it, they know how that would end, they're just playing the FUD game in the other direction. Which I am 100% on board with.

Maybe the one thing worse than boasting that you're putting malware in your product is boasting about it and not doing it.
Post reply on HN