or just flipping them off, which seems OK too.

Nah, Cellebrite will panic for a bit at the possibility of facing repercussions but ultimately not commit enough effort to change anything. Cellebrite&#x27;s counterparties, however, might not be so complacent.

Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time.Pretty sure it&#x27;s the former, since the above is a way to ensure that Cellebrite can&#x27;t just gather all implied exploit files and make sure they&#x27;ve got those specific problems all patched. This is, quite literally, an informational attempt at guerilla&#x2F;asymmetric warfare, where Signal is trying to make engaging with them too costly, while also making a few blows quite a bit above their weight level. Cellebrite now has to decide whether to keep after this adversary that both is hard to pin down, ambushes them, and has shown it can hit them really hard where it matters (credibility, and thus their pocket book).

Signal should generalise this into a library so that other app vendors can include these perfectly cromulant files

I wonder if the intention here is to deter Cellebrite from parsing Signal files? Or to pressure them into fixing their security vulnerabilities?

one could view make of an e2e encrypt app that is cause problem for polices as &quot;not a good idea&quot; but there must  be some person for to do it.

They&#x27;re already picking a fight with Cellebrite simply by existing, as Signal is antithetical to everything that Cellebrite stands for.

signal wants to pick a fight with a grey company that gets money for cracking apps? not a good idea

They are implying that future versions of Signal will drop random files on your phone that &quot;may or may not&quot; cause damage to Cellebrite systems.They are basically putting the threat out that if you use Cellebrite on Signal in the future, you might not get the data you expect, and at worst, it may corrupt the report&#x2F;evidence.This also brings into question the chain of custody, as an untrusted device being imaged can alter reports of unrelated devices.

Signal is going to start attacking third-party tools once it&#x27;s installed on your phone.It&#x27;s as though Theo decided that OpenSSH should respond to portscanners by trying to pwn the source systems.

I don&#x27;t get it, can anyone elaborate on what they are talking about there?

&gt; In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software.I wish I could see those files in action...

Not really. The same circumstances exist for almost all digital evidence. Of course, a lot of Cellebrite usage is extrajudicial already.

This is unlikely to be the case, despite the vulnerabilities that are described.The process of e-discovery is rife with risks of this sort. When you forensically collect data from a random set of devices from a party that may or may not have porn, HIPAA, GDPR, sample viruses, malware, who know what all.The short version of it even if the inhaling of this data crashes the device, there are mitigations and protections that will allow the evidence to be ultimately produced.A crash of the windows host in collection will not invalidate the case.disclosure: ex-CSO of Relativity, leading provider of e-discovery software.

Any court case where Cellebrite&#x27;s tools have been used are now in jeopardy since the defence can just say that they were hacked by someone else. There&#x27;s now reasonable doubt that Cellebrite can&#x27;t be trusted. This damages their reputation with governments too.

Sandboxing doesn&#x27;t fix the problem. The problem isn&#x27;t the same as a consumer app where you&#x27;re trying to protect the OS from being rooted. Their problem is they need to protect the integrity of the report it generates because that&#x27;s the thing that makes them money.edit:One thing they could try to do is to sandbox the parser itself to lower attack surface area... but the damage is done here and I really doubt they will win a security tit-for-tat with Signal.

This is too quick a dismissal: if they sandboxed each extraction tool they&#x27;d be more likely to be able to say that a compromised tool did not compromise the entire system or data collected by other tools. This is exactly why programs like browsers, messaging clients, etc. have moved things like media decoders into separate processes, especially since those tools can be sandboxed quite aggressively whereas a monolithic program will use a fair number of different permissions.

&gt; sandbox the entire tool.Sandboxing doesn&#x27;t really help. The problem isn&#x27;t that the tool is used to infect the rest of the system, but that the tool itself is compromised, the reports it generates are compromised, and and past reports may be compromised. Unless you&#x27;re pushing that data outside the sandbox (which is a hole in the sandbox, and while much more limited might also be an exploit vector or a way to cause problems in the data) it&#x27;s still fair game if the sandboxed tool is compromised.There&#x27;s multiple reasons to disclose it. First, because as another comment noted it attacks the credibility of the company, and credibility is very important for tools used in court.Second, because their main goal is to protect Signal, not attack Cellebrite. Making Signal a problem to attempt to gather data about will possibly make them just blacklist Signal as an app they gather for. This could be temporary, but since Signal alluded to many exploits and that they have a bunch queued up for the future, it will always be a risk for Cellebrite to attempt to gather info from Signal, so they might just continue to skip it.

I think they mention Apple in an attempt to force them to defend their copyright, else they risk losing it.I assume Apple will choose to file for copyright infringement than risk being accused of collusion and lose the copyright on that iTunes or parts of it.

does cellebrite appear in any legit court cases? from this blog post it sounds like only &quot;authoritarian&quot; regimes use it. i doubt it would appear in any legit case. it&#x27;s a shady tool. they&#x27;ll use it to gather info but will not present this info directly in court, instead use it to gather legitimate proof, if needed.

The public disclosure about the Apple DLLs could potentially be used to drag Apple into any legal case between somebody versus Cellebrite. The disclosure needs to be public versus private or under seal or whatever to absolve the Cellebrite counterparty of any liability from reverse engineering. Suddenly Apple is now in potential collusion with Cellebrite. Or maybe not. This public disclosure makes the threat of Discovery a bit less toothless.IANAL but I could imagine Cellebrite has existing or pending litigation where this disclosure upsets their position.

It seems to be a retaliatory measure against this:&gt; When Cellebrite announced that they added Signal support to their software, all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal.Your case is valid about potential judiciary impact, but it would require for Signal to monitor cases involving Cellebrite and step forward to help the defense while unprompted to do so. Furthermore, Cellebrite clients seems to include entities that do not care so much about a fair trial.

I bet Sun Tzu would also extol the value of allowing your weekend to remain complacent. This disclosure may make them harden up.

Whether Cellebrite is secure or not has really not much impact on Signal. Shore up Cellebrite&#x27;s security, don&#x27;t, either way, pretty much same threat to users. But calling them out like this could force them to placate their customers by spending money on software security --- something they apparently haven&#x27;t been doing --- and inflicting costs on your adversary is good praxis.

Signal may have had countermeasures in place long before the blog post, as well.

For one thing, it could otherwise waste a lot of time for the poor white hat hacker who tries to figure out why this oddly formatted file suddenly exists in the app data.And it doesn&#x27;t destroy the credibility of the tool to silently mess with its data. People have to know it&#x27;s happening.

&gt; Privacy can be hard. While i 100% defend everybody has the right to privacy, i can also see the need for the capability to break it. Maybe the answer for this is a very tight regulation around the uses of this kind of hardware&#x2F;software, but that regulation would have to keep up with the pace of technologyi&#x27;ve always wondered if there could be a cryptographic solution to this. issuing decryption keys to governments seems rife for abuse, but some sort of multi-party situation where governmental and non-governmental entities have to cooperate (with actual multiparty key material) to perform a decryption authorized by warrants- with said non-governmental agencies acting as a check on usage of those warrants, their frequency and the eventual publication of their usage could be an interesting approach.personally i think strong encryption should be a requirement for digital evidence, but even that can be forged.strange times we live in.

Probably disclosure is the best option.Silently tamper with the data might cross a legal line. doing this might put at risk current or past cases where there is a legitimate reason to use this sort of tool.Privacy can be hard. While i 100% defend everybody has the right to privacy, i can also see the need for the capability to break it. Maybe the answer for this is a very tight regulation around the uses of this kind of hardware&#x2F;software, but that regulation would have to keep up with the pace of technology

So I wonder, why disclose this?This will just prompt Cellebrite to improve its security process and sandbox the entire tool.If they wanted to destroy the credibility of the tool, using the vulnerabilities to silently tamper with the collected data or even leaking it online would be a much better option and hit them without any warning, not only jeopardizing those cases but forever casting doubt on not just Cellebrite but their competitor tools.

Indeed, how convenient. If it truly did fall off the truck right while he is on a walk then there is the possibility that is a rubber duckie attack. This is basically the equivalent of leaving a USB flash drive lying around. I hope the author took the necessary precautions when reverse engineering the device. Companies like cellebrite have deep connections to certain three letter communities that staging this sort of attacks trivial.

I am happy to see the bag survived its most untimely truck tumble while remaining a e s t h e t i c a l l y - - - p l e a s i n g.

Yup. Those things have way to &quot;fell from a truck&quot;. Another win for the &quot;fell from a truck&quot; gang ;)

I found that funny too. It sounds to me like a good way to end up with the device to analyze without being constrained by a contract or EULA prohibiting it.

All that trouble becaused a bag conveniently &quot;fell from a truck&quot;. All in all I&#x27;m really happy for all this.

You wouldn&#x27;t imply that Signal had framed you. You would imply that someone else had framed you using the same vulnerabilities as Signal has now indicated exists. i.e. You can&#x27;t trust Cellebrite because it&#x27;s now known to be trivial to subvert their software. It&#x27;s also difficult for Cellebrite to prove that there aren&#x27;t remaining vulnerabilities in their software since Signal didn&#x27;t disclose the problems they found and won&#x27;t do so unless Cellebrite discloses the exploits they claim to be using in Signal.

I really seriously doubt that anyone would ever advance the idea that Signal had deliberately framed them by creating false data on their phone. I don&#x27;t see this as much more than pointing out that Cellebrite has vulnerabilities, just like the ones they exploit.

Knowing that at least one row of data in a database might have been modified randomly means you can&#x27;t fully trust any one line in the database completely.It reminds me of the story of <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Annie_Dookhan" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Annie_Dookhan</a>

&gt; It attacks Cellebrite&#x27;s ability to operate by casting doubt on the reports generated by the product that their customers may wish to use in court.Fortunately, parallel construction means you never really have to throw out bad evidence as long as you can find some good evidence too!

Fitting name.Black-bag the opposition politican, and then black-bag her phone.

A little different from brown bag, in which the non-traceable payment travels under the table.

Cellebrite acquired BlackBag Technologies recently. BlackBag emerged from Apple&#x27;s security team.

They don&#x27;t have to read that.The defense lawyers have to read it, and the people in law enforcement need to read the cases where judges throw out Cellebrite evidence based on that.

They won&#x27;t be moot when defense lawyers bring them up.

They, and the people who support them, do. Moreover, not all of their users are involved in ethically questionable activity. Many of them are scrupulously following due process to thwart people doing really bad things.

Good. They will then collect useless data that a lawyer will destroy in court.

Sadly I suspect the people in law enforcement who make purchasing decisions never read the Signal blog, and therefore all these points will be moot.

It was brazen enough to pop an iTunes GUI a few years back.

I&#x27;ve seen this reaction a few times. Can you say more? Presumably Signal users value privacy, and the implication is that when hacking tools used to violate that privacy are applied to a device running Signal, it may try to interfere and prevent the extraction to some degree. This seems like an ideal feature for a private messenger.In contrast, it would strike me as strange if a Signal user switched to another messenger that allowed the data extraction because they were uncomfortable with Signal blocking it.

&gt; It makes a thinly-veiled threat that any random Signal user&#x27;s data may actively attempt to exploit their software in the future and demonstrates that it&#x27;s trivial to do so.That does not make me feel good about Signal.

Yes, but the copy shipped is signed by Apple.  
i.e. they did not compile their own copy.

MobileDevice.framework isn&#x27;t open source.

IANAL, and I don&#x27;t speak for Apple, but as far as I can tell, the part about Apple is nonsense.CoreFoundation is open source: <a href="https:&#x2F;&#x2F;github.com&#x2F;opensource-apple&#x2F;CF" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opensource-apple&#x2F;CF</a>libdispatch is open source: <a href="https:&#x2F;&#x2F;apple.github.io&#x2F;swift-corelibs-libdispatch&#x2F;post&#x2F;libdispatch-is-open-source&#x2F;" rel="nofollow">https:&#x2F;&#x2F;apple.github.io&#x2F;swift-corelibs-libdispatch&#x2F;post&#x2F;libd...</a>ASL is open source: <a href="https:&#x2F;&#x2F;opensource.apple.com&#x2F;source&#x2F;syslog&#x2F;syslog-349.1.1&#x2F;libsystem_asl.tproj&#x2F;src&#x2F;asl.c.auto.html" rel="nofollow">https:&#x2F;&#x2F;opensource.apple.com&#x2F;source&#x2F;syslog&#x2F;syslog-349.1.1&#x2F;li...</a>The objective C runtime is open source: <a href="https:&#x2F;&#x2F;github.com&#x2F;opensource-apple&#x2F;objc4&#x2F;blob&#x2F;master&#x2F;APPLE_LICENSE" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opensource-apple&#x2F;objc4&#x2F;blob&#x2F;master&#x2F;APPLE_...</a>icu, pthread, zlib, and libxml did not even originate at Apple.

There&#x27;s a difference between attacking their privacy (which is fair and should be done regularly if users&#x27; privacy is at stake) and claiming access to secure data that is wholly untrue.

Add one more: Anyone publicly attacking Signal&#x27;s privacy in the future is painting a very large target on their forehead.

This is truly a hacker’s retort.It attacks Cellebrite&#x27;s ability to operate by casting doubt on the reports generated by the product that their customers may wish to use in court.It places them in legal peril from Apple, and removes any cover Apple would have to not take legal action. (I assume someone at Apple knew they were shipping their DLLs?)It makes a thinly-veiled threat that any random Signal user&#x27;s data may actively attempt to exploit their software in the future and demonstrates that it&#x27;s trivial to do so.edited to add a bonus one:Publish some data about what they are doing to help create a roadmap for any other app that doesn&#x27;t want their data to be scanned.

The digital equivalent of &quot;stop hitting yourself&quot;. Notwithstanding their crypto issue, this gives me renewed confidence in Signal&#x27;s team.

I read nothing about an attack of any method or type at all.If Cellebrite decides to punch a spiky rock they could have just not done that in the first place.

They didn&#x27;t actually say anything of the sort.  They may have implied some stuff.  Anything they did imply wouldn&#x27;t be an active attack though, it would be a passive one, triggered only if Cellebrite tried to gather data from the Signal app on phones.  Not gathering info from a phone, or not gathering Signal data from a phone, would both be ways Cellebrite could avoid this potential passive attack.

They literally said the unit fell off a truck. Funny...Correctly me if I am wrong, but did they really say they were going to be doing active attacks against Cellebrite units? Also funny... but they probably are not actually going to be doing that.

Have you tried going out for a walk and looking for trucks with small packages falling off?

I own a Cellebrite, and yeah you are right. The Cellebrite box is nothing other than a phone backup tool. The nice thing it does is implement every backup sync protocol for every version of every mobile OS so you don&#x27;t have to spend a whole day trying different combinations of iTunes and such.The &quot;Physical Analyzer&quot; is just a forensics tool. There are dozens of competitors out there that will take a phone and surface the things that might be interesting in a court case or law enforcement investigation.The product Signal didn&#x27;t talk about - which I think is the one they are upset about - is Cellebrite Premium. That is their service where law enforcement can send locked or damaged devices to their lab and get back a an image to load into PE. However in 99% of cases devices are either accessed because they are running old software with public vulnerabilities, or using the magic phrase &quot;would you mind unlocking your phone so we can clear this matter up?&quot;

doesn&#x27;t an itunes backup contain all the app data?

Now if only I could use legitimate tools to access my own Signal data on an iOS device.

I bet the tool was bought from a supplier but Signal team can&#x27;t disclose it because source protection.

It&#x27;s like &quot;a little bird told me&quot;.

they actually put it a photo of it on the street too

oh ok thats a new one for me obviously, but the street photo got me. lol

&quot;fell off the back of a truck&quot; is an idiom [1]. It&#x27;s not meant literally.[1] <a href="https:&#x2F;&#x2F;www.phrases.org.uk&#x2F;meanings&#x2F;fell-off-the-back-of-a-truck.html" rel="nofollow">https:&#x2F;&#x2F;www.phrases.org.uk&#x2F;meanings&#x2F;fell-off-the-back-of-a-t...</a>

thank you for clarifying, english is not my main language and that was taken at face value. The going on a walk and picture was too good

“Fell off the back of a truck” is slang for “obtained through illicit means.” It comes from the excuse that criminals used to give when caught with stolen property: I didn’t steal it, it just fell off a truck.

i find it remarkably unbelievable someone would put a cellebrite bag in the back of a truck given the price alone.. and the timing too. sure

the cellebrite ambassador we talked to (as private company) basically bragged they were the ones that unlocked the San Bernadirno iPhone. I&#x27;m sure towards government officials and Law Enforcement they brag even more.

They are more advanced typically than just extracting data from a phone. Not sure to which extent they advertise it brazenly though. Fairly certain they blog about it a lot

AFAIK there are various “levels” of Cellebrite’s products, from “I’m a phone shop and I want something help me make a phone backup so I can restore it” all the way to “tools to break into locked iPhones”.

&gt; One way to think about Cellebrite’s products is that if someone is physically holding your unlocked device in their hands, they could open whatever apps they would like and take screenshots of everything in them to save and go over later. Cellebrite essentially automates that process for someone holding your device in their hands.Aren&#x27;t Cellebrite products&#x2F;services more advanced than that? I mean don&#x27;t they use publicly unknown zerodays to extract data from locked phones?

&quot;I was recently out for a walk when I saw a small package fall off a truck ahead of me.&quot;... I I laughed :)))

I have a new found perspective for the malware&#x2F;spyware industry after watching The Dissident.I am SO IMPRESSED with this middle finger from the Signal team.<a href="https:&#x2F;&#x2F;www.imdb.com&#x2F;title&#x2F;tt11382384&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.imdb.com&#x2F;title&#x2F;tt11382384&#x2F;</a>

I hope Cellbrite users like the rhythm and lyrics of Never gonna give you up.

By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me.Nailed it!

They&#x27;re alluding to the fact that they can randomly pop Cellebrite installations by planting anti-Cellebrite malware on their users phones.

Any idea what this means? It is at the bottom of the article:&quot;In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software.[...]&quot;

&gt; As just one example (unrelated to what follows), their software bundles FFmpeg DLLs that were built in 2012 and have not been updated since then.This purported vulnerability does not rely on FFmpeg, hence the disclaimer.

This is something I have personally looked at as an owner of a UFED touch device (1st gen). By default your software runs in a non-priviledged account but who&#x27;s to say one of files isn&#x27;t just straight up being read by FFMPEG and adding or removing evidence from the final report.The official Cellebrite policy has always been &quot;don&#x27;t worry, if you get stuck, we can send you an expert to testify to the reliability of the scientific evidence due to previous cases&quot; but what happens when the pyramid of previous cases fall apart? Do you suddenly own a paperweight?I&#x27;ve also published papers (with NIST&#x27;s help) on using consumer grade hardware for forensics and why testing your tools across a wide variety of scenarios is critical.

Maybe the one thing worse than boasting that you&#x27;re putting malware in your product is boasting about it and not doing it.

The client code is open source, so it should be pretty easy to tell if they actually do it.

Signal isn&#x27;t going to actually do it, they know how that would end, they&#x27;re just playing the FUD game in the other direction. Which I am 100% on board with.

Secure messaging apps aren&#x27;t very thick on the ground. I don&#x27;t have to agree with Signal on every issue, I just want them to ease off the 4-Loko.

Signal has a strong ideology. If you don’t want to be a part of that then don’t use the app.

The problem with being boring while attacking powerful institutions (like LEOs or nation states) is that it only works as long as you&#x27;re small enough to stay below their radar. After a certain point, the material reality will sink in that you&#x27;re a threat, and they&#x27;re going to take action against you regardless of how you carry yourself. It&#x27;s totally possible, given that we&#x27;re starting to hear more and more accounts of powerful people using Signal, that we&#x27;re approaching that tipping point, and a more gloves-off approach might be necessary.That being said, I agree with you 100% on the cryptocurrency payments issue and think that was a misstep on their part.

I think there&#x27;s a chance the two topics you mention might be connected. The loud backlash to the cryptocurrency scheme took many by surprise and seeded doubt about Moxie&#x27;s ideological commitment. This post might be seen as an attempt to recover some street cred.

I agree and find it more than irksome -- it really makes me want to stop using Signal and stop recommending it to anyone; moreso even than the recent scamcoin integration.The reason I want e2e encryption is because I want control of my devices, control of my information, control of what&#x27;s going on. It&#x27;s not Moxie&#x27;s phone to drop random files on to, regardless of purpose. It&#x27;s my phone, and I consider programs that are doing things that I&#x27;m not aware of malware.(Admittedly, Android is rife with stuff I don&#x27;t want going on, so it&#x27;s not really my phone, it&#x27;s Google&#x27;s and Motorola&#x27;s and a bunch of other entities who have their tentacles in it, but still...)Maybe the last paragraph is a joke, and they have no intention of randomly placing files on unwitting client machines. It&#x27;s open source, so I could compile the client myself and make sure it&#x27;s not doing anything funny. What a pain though. At that point, so much trust is lost in the organization and codebase that really I need to find some other messaging protocol &#x2F; app &#x2F; network.

This is pretty irksome. I get how satisfying it must feel, but the one thing I want as a Signal proponent is for the app to be boring and reliable. That means make it easy to use enough to be mainstream, squash bugs, and do all the lovely security work you do.That does not mean adding stuff like untraceable cryptocurrency payments or very publicly tweaking the noses of law enforcement, and bragging about how you&#x27;re putting exploits in your app to hack them.This isn&#x27;t 1993 and the last thing we need is more pretexts to ban E2E encrypted apps in the countries where they&#x27;re needed the most. I think this trades a moment&#x27;s satisfaction for a very bad long-term outcome.

Well, if you read the whole blog post, it certainly seems like they&#x27;re actually doing it.

1. Any app could do it.2. Signal stirred FUD in a blog post. That&#x27;s a very different thing from actually doing it.

As a Signal user and moxie fan I love that post, but I worry that it places Signal in legal peril from Apple.My fear, and prediction, is that the authorities will frame this as an even more egregious attack on law enforcement and that interfering with investigations is a crime (I&#x27;m not a lawyer, but I play one in hacker news comments, and that sounds like a crime). They&#x27;ll lean on the app stores and the app stores will lean on or remove Signal.

There was a vulnerability in this technique that was fixed in iOS 11: <a href="https:&#x2F;&#x2F;labs.f-secure.com&#x2F;advisories&#x2F;apple-ios-host-pairing-bypass&#x2F;" rel="nofollow">https:&#x2F;&#x2F;labs.f-secure.com&#x2F;advisories&#x2F;apple-ios-host-pairing-...</a>. If someone found another vulnerability and shared it with Cellebrite, then it doesn&#x27;t work. If they haven&#x27;t, then it still does.

This still works as written. Just test it yourself with a Mac and Apple Configurator.

Do we (reasonably) know if this still works?

&gt; unlocked phoneWell, mostly yes, that&#x27;s considering Cellebrite doesn&#x27;t have 0-days or other exploits which can send a SMS to the device or similar things. Using Cellebrite&#x27;s software you can also send silent SMS, so it&#x27;s not far off either.A german Cellebrite ambassador showed me and colleagues the mentioned tools of the blog post and told us he participates at Law Enforcement raids. At 6 in the morning they raid the houses of the suspects, detain them and immediately ask for PINs and passwords. He said that surprisingly often it works and no further decryption tries have to be performed.

&gt; if I were compelled via court order to give my passcodeIn the US that won&#x27;t work if unlocking the device requires a password or pin. In practice, you can&#x27;t be compelled to provide that unless you openly admit that you know it. (Even then, the 5th amendment might afford you some protection.) YMMV, IANAL, etc.

All of these are based on the assumption that the attacker has physical access to the unlocked phone, right?I&#x27;m trying to understand the risk profile here.I guess I see the value for, e.g., a border crossing, where they can inconvenience you and ask you to unlock your phone, but instead of flicking through your messages briefly, they authorize a pairing and quickly backup your entire disk content. You expected a quick perusal by a human, but unknowingly gave them a lot more. If you&#x27;ve blocked pairing, they can&#x27;t get nearly as much data as quickly.But if you&#x27;re being investigated for committing a crime, everything we think we know about device unlocking is still true, right? They&#x27;d need me to unlock it before it&#x27;d trust a new device to pair to, and they&#x27;d need a court order to get me to unlock it for them. Five quick taps of the power button and biometric unlocks are off--now they need my passcode.Perhaps there&#x27;s still value, even in that case, in that if I were compelled via court order to give my passcode, they still can&#x27;t quickly &#x2F; easily dump the disk contents from a device pairing. Although I imagine if you have the passcode there&#x27;s probably many other ways of accomplishing the same result.

Are there similar features for Android devices? A database of Cellebrite-resistant phones, perhaps?

A reminder that you can pair lock your iPhone to prevent analysis by Cellebrite or similar tools: <a href="https:&#x2F;&#x2F;arkadiyt.com&#x2F;2019&#x2F;10&#x2F;07&#x2F;pair-locking-your-iphone-with-configurator-2&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arkadiyt.com&#x2F;2019&#x2F;10&#x2F;07&#x2F;pair-locking-your-iphone-wit...</a>

Sending a cease and desist to Cellebrite for shipping their DLLs in their product I imagine.Obviously there may be some backchannel, but that is probably how it would go if you assume Apple and Cellebrite have no relationship.

&gt;&quot;Required&quot; to comment? By whom and for what reason?By stockowners who might not like their valuable IP used in this way or by this company without permission?

&gt; Apple may be legally required to at the very least, comment on this situation.&quot;Required&quot; to comment? By whom and for what reason?

Don&#x27;t confuse the thing where a company has to defend its trademarks to keep them with copyrights (which do not require active defense to maintain).This, if Apple does pursue it, is a copyright matter, not trademark.

Truly a jaw dropping blog post, as the top comment currently states, Apple may be legally required to at the very least, comment on this situation.

Apple uses Cellebrite devices in their stores to transfer data from devices, I believe.

I am reasonably confident that Apple is a Cellebrite customer. Their security team certainly has access to forensic tools from other vendors. That team also spawned BlackBag Technologies, which is now part of Cellebrite.

If it&#x27;s true that you can grab a Cellebrite hardware piece without too much difficulty (Ebay, etc - and note I&#x27;m not speaking from expertise so someone please fact check me), I&#x27;d find it hard to believe Apple wouldn&#x27;t have done this kind of inspection themselves and&#x2F;or noticed those DLLs being shipped.Curious if there&#x27;ll be a response of sorts.

Based on the post, it sounds like there&#x27;s some data parsing going on (possibly to present the data in a user-friendly way?), and the parsing step uses outdated versions of software (such as ffmpeg) which have well-documented vulnerabilities in them.

Cellebrite claims,&quot;Lawfully access locked devices with ease
Bypass pattern, password or PIN locks and overcome encryption challenges quickly on popular Android and iOS devices&quot;<a href="https:&#x2F;&#x2F;www.cellebrite.com&#x2F;en&#x2F;ufed&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cellebrite.com&#x2F;en&#x2F;ufed&#x2F;</a>

they could use vulnerabilities to extract more data. probably it&#x27;s common to do some obfuscation of data which celebrite might have reverse engineered.

&gt; is Cellebrite capable of copying locked devices, or more to the point - has vulnerabilities to unlock devices without knowing the access PIN?Yes, they even brag about it in their marketing materials: <a href="https:&#x2F;&#x2F;www.cellebrite.com&#x2F;en&#x2F;a-practical-guide-to-checkm8&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cellebrite.com&#x2F;en&#x2F;a-practical-guide-to-checkm8&#x2F;</a>That&#x27;s a public vunerability, it&#x27;s anyone&#x27;s guess how many nonpublic ones they&#x27;re using.

&gt;If UFED just copies data from unlocked phones, why would they be using vulnerabilities to do so?I think what he meant to say was that if Cellebrite is used on your locked phone it could be the equivalent of a person having your unlocked phone in their hands where they can do whatever they want. Only cellbrite doesn&#x27;t do look at random things, it grabs everything.Cellebrite devices are also frequently used by phone carriers to image your old phone and transfer the data to your newly purchased phone, to give you a clearer idea of what they can do.

I don&#x27;t understand the seeming incongruity between these two statements:On the one hand:&gt; One way to think about Cellebrite’s products is that if someone is physically holding your unlocked device in their hands, they could open whatever apps they would like and take screenshots of everything in them to save and go over later. Cellebrite essentially automates that process for someone holding your device in their hands.But on the other hand:&gt; We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future.If UFED just copies data from unlocked phones, why would they be using vulnerabilities to do so?I guess my question is, is Cellebrite capable of copying locked devices, or more to the point - has vulnerabilities to unlock devices without knowing the access PIN?

<a href="https:&#x2F;&#x2F;www.iowajustice.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.iowajustice.com&#x2F;</a> is amazing at UFED defense.

The video made my inner child feel truly vindicated with my choice of username.

Wow, that video made my day. This bit is key:&gt; &quot;For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.&quot;They&#x27;ve may have just got a lot evidence collected using Cellebrite from phones with (or without) Signal installed on them thrown out of court.I don&#x27;t recall the details, but there was an absolute unsubstantiated speculative and surely fictional rumor of at least one entirely theoretical zero-day non-gif formatted image file that exploited a similar class of vulnerability in what was probably not a market leading tool used tangentially for the same purposes, floating around well over a decade ago as well.I for one am very glad that these hypothetical issues have almost surely been fixed.

&gt;By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite.That&#x27;s just hilarious! Nice way of saying we got our hands onto one of these boxes, but we don&#x27;t want to reveal how. It fell of a truck.

This rocks so hard. Also the Prodigy soundtrack! Takes me back.

Really REALLY bad idea - this is one of law enforcement&#x27;s larger pet gadgets and companies, so the GP would not only have a particularly enthusiastic mob coming after them, said mob&#x27;s pitchforks would have automatic cannon launchers and EMPs and push-button-activated nunchucks and all kinds of other crazy things that aren&#x27;t legal for standard-issue pitchforks.So if the database is fingerprintable to the GP specifically in any way, they&#x27;re very very dead. And the random username doesn&#x27;t even count here; they probably didn&#x27;t post from Tor, so their real IP is connected to this post.

Well definitely don&#x27;t share it with DDOS secrets, news outlets or any other major company that would potentially report on it. That would be very bad press for Cellebrite, and if they connected it to you they could be very annoying - though again, they would need pretty good evidence connecting it to you and things like TOR and proper privacy practices would make that very difficult. So definitely don&#x27;t do that, or use something like tails to post it to multiple SecureDrop outlets.

Cellebrite doesn&#x27;t even have a bug bounty programme or contact to report their bugs.Last year I&#x27;ve managed to gain partial access to one of their systems and it took me weeks emailing their internal email addresses to finally fix the bug. They were total ass about it.Now I&#x27;ve got complete access to their entire database and I don&#x27;t know what do. Can HN advise?

&gt;Since almost all of Cellebrite’s code exists to parse untrusted input that could be formatted in an unexpected way to exploit memory corruption or other vulnerabilities in the parsing software, one might expect Cellebrite to have been extremely cautious.&gt;Looking at both UFED and Physical Analyzer, though, we were surprised to find that very little care seems to have been given to Cellebrite’s own software security.People keep saying this. It has never changed since the 90s. There is no bar to become a &quot;software engineer&quot;.

Sorry, please go ahead and downvote my comment so its not cluttering up :)

Its a loquacious take on “fell off the back of a truck”.

“Fell off the back of a truck” is usually a metaphor for either stolen or otherwise acquired in a way they don’t want to explain.

&gt; By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite. Inside, we found the latest versions of the Cellebrite software, a hardware dongle designed to prevent piracy (tells you something about their customers I guess!), and a bizarrely large number of cable adapters.Does anyone find a package dropping off a truck and first take a picture of it, pick it up and go home to open it?Even if someone picks up the package, usually taking a picture of it doesn&#x27;t come to their mind. It&#x27;s an unsual bit in the story. Unless, they went back and put the bag on the road to show that it was found just for the sake of &quot;recreating the story&quot; purposes.How does something like a small briefcase just &quot;fall from a truck&quot;? By what mechanism? Briefcase would be stored inside the cabin.If you&#x27;re the author, can you explain my suspicion?

my TL;DR (but its a damn good read and funny too)- Cellebrite helps oppressive regimes read your messages- Signal keeps your messages private- Cellebrite announces &quot;Signal support&quot;- Signal finds 9 years of vulnerabilities in Cellebrite- Signal permanently pwns CellebriteYou come at the king, you&#x27;d best not miss.

I agree that the vendor is detestable, but we must decouple that sentiment from the idea that this blog post compromises Cellebrite’s product or credibility in any way.As it stands, the vulnerability is not reproducible by anyone other than Signal. Reproducibility is key in the scientific method and in the court of law.

Many vulnerabilities are disclosed without simultaneous disclosure of the PoC. That doesn&#x27;t make it worthless.Also, not disclosing specifics is reasonable here, given that the vendor is themselves known for using, hoarding, and selling access to 0days.There is no obligation for a researcher to share their research with such a corrupt vendor.

The post seems to provide a straight-forward map to at least one vulnerability. If they have FFMPEG DDLs that have not been updated since 2012 and they are used on files found on the file system, you just need to find a relevant vulnerability and craft an appropriate media file. These vulnerabilities are well-known and well-documented. It just doesn&#x27;t point to the specific DLL &amp; CVE, but otherwise seems like it would be relatively easy to figure out.

To be fair, this vulnerability disclosure is worthless, because it wasn’t actually disclosed—the true vulnerability is purported to be in the file that Signal uses to execute arbitrary code, of which the details are not shared. We are relying on pure trust that the video demonstration of the purported vulnerability is not a forgery.Additionally, I see from the video that the purported vulnerability is present in UFED version 7.40.0.229. There is nothing stopping Cellebrite from patching this purported vulnerability, and shipping trustworthy versions of UFED going forward.If there is a concern that the purported vulnerability still exists, the burden of proof will be with the person claiming the vulnerability exists, for each new version of UFED. Cellebrite doesn’t even need to implement actual code, but merely increment the UFED version number. It will be an endless cat and mouse game driven by baseless claims from both sides.Since this vulnerability has not been reproduced by third parties, it could be equally likely that Signal is using a psyop rather than exploiting a genuine vulnerability. In either scenario, it casts doubt on Cellebrite; the damage is done by convincing you, the reader.

ah. Those must also be modules that fell from the truck.... (these companies clearly have trucks like sieves) I have no doubt that already, cellebrite are on the phone ordering more secure, err  &#x27;trucks&#x27;

Cellebrite&#x27;s initial response[1] includes this gem&quot;We have strict licensing policies that govern how customers are permitted to use our technology and do not sell to countries under sanction by the US, Israel or the broader international community.&quot;And these policies are obviously quite effective at preventing such uses.[1] <a href="https:&#x2F;&#x2F;www.theregister.com&#x2F;2021&#x2F;04&#x2F;21&#x2F;signal_cellebrite&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.theregister.com&#x2F;2021&#x2F;04&#x2F;21&#x2F;signal_cellebrite&#x2F;</a>

I&#x27;d also like to get really excited about this. Can someone ELI5?

This isn&#x27;t the first time moxie0 found something important on a street, is it?

I wonder if they will. That would show it their &quot;our customers privacy is the most important thing for us&quot;-stance is something which they seriously mean.

Yup, Signal just handed Apple&#x27;s lawyers a loaded gun. Who knew I&#x27;d be enjoying Signal and Apple tag-teaming Cellebrite.

&gt; Also of interest, the installer for Physical Analyzer contains two bundled MSI installer packages named AppleApplicationsSupport64.msi and AppleMobileDeviceSupport6464.msi. These two MSI packages are digitally signed by Apple and appear to have been extracted from the Windows installer for iTunes version 12.9.0.167.Couldn&#x27;t Apple now sue Cellebrite?

Signal is almost like anti-virus software against Cellebrite.

I attended a conference back in the early 00&#x27;s, where a member of GHCQ presented. He spoke about assisting on 911, obtaining forensic evidence from hard drives and the lengths that his team had to go to, to make sure that no files where changed while creating a clone of the drives. He stated that they can not just turn on a computer when they have seized it, as there would be about 800 files altered before Windows had even booted to the login screen. This, he stated, would destroy the chain of evidence.
He might have been full of shit though.

You wish. All they need to do is track which files they modify and not touch the other ones. I doubt it would be fruitful to explore that angle in court

How do Cellebrite maintain &quot;Chain of custody&quot;? If they need to modify (hack) the device to get access. I was of the understanding, that if any file is modified then &quot;chain of custody&quot; is no longer in good standing, and therefore cannot be used as evidence.

The dll wil be flagged as malware in major av&#x27;s if they revoked it

The digital signature is not needed to run the software.

&quot;These two MSI packages are digitally signed by Apple&quot;Couldn&#x27;t Apple simply revoke the signature?

This is a really great piece. I have two observations.1) &quot;..saw a small package fall off a truck ahead of me...&quot;2) The very last paragraph is just great!

While this report is entertaining to read, I have to wonder about possible downstream repercussions of the implications within the last paragraph; if you&#x27;re in police custody or worse and your Signal app contains some &#x27;aesthetically pleasing files&#x27; that interfere with the authoritarian software, it&#x27;s likely going to be your ass on the line for all sorts of charges.Don&#x27;t get me wrong, the implication is enough to discredit Cellebrite, but my initial thoughts are that either this bluff gets called, or there&#x27;s a non-zero risk of someone landing in even hotter water down the line for using Signal. Of course, this assumes that you&#x27;re not already neck-deep for having encrypted data and upholding your right to privacy.

Something about this smells a little off.If Moxie can get his hands on these devices and hack them, why can&#x27;t Apple or Google, with all their resources, seem to be capable of REing them to fix the mobile device bugs they currently exploit?Tinfoil hat perspective suggests they don&#x27;t want to.

Signal have just added files to compromise Cellebrite to their default installation !&quot;In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage.These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software.Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding.We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files.&quot;

&gt; Since almost all of Cellebrite’s code exists to parse untrusted input that could be formatted in an unexpected way to exploit memory corruption or other vulnerabilities in the parsing software, one might expect Cellebrite to have been extremely cautious. [...]Yeah, but they probably figured they&#x27;re not being attacked. But now? Now they&#x27;ll have to figure they are.

Crossing the streams, the US Postal Inspectors Service (which hosts iCOP, detailed in a recent Yahoo story) are a Cellebrite customer:<a href="https:&#x2F;&#x2F;www.uspis.gov&#x2F;wp-content&#x2F;uploads&#x2F;2020&#x2F;02&#x2F;FY-2019-annual-report-508-web.pdf" rel="nofollow">https:&#x2F;&#x2F;www.uspis.gov&#x2F;wp-content&#x2F;uploads&#x2F;2020&#x2F;02&#x2F;FY-2019-ann...</a> (p. 35)See: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26892180" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26892180</a> <a href="https:&#x2F;&#x2F;news.yahoo.com&#x2F;the-postal-service-is-running-a-running-a-covert-operations-program-that-monitors-americans-social-media-posts-160022919.html" rel="nofollow">https:&#x2F;&#x2F;news.yahoo.com&#x2F;the-postal-service-is-running-a-runni...</a>

&gt;We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future.Mwahahahaha. Tell us how you hack our app and everyone else&#x27;s, and we&#x27;ll tell you how we hacked yours.The middle finger is strong with this one.

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer