Slashdot Mirror
Leaked Files Reveal Scope of Cellebrite's Smartphone-Cracking Technology (zdnet.com)
An anonymous reader quotes a report from ZDNet: Earlier this year, we were sent a series of large, encrypted files purportedly belonging to a U.S. police department as a result of a leak at a law firm, which was insecurely synchronizing its backup systems across the internet without a password. Among the files was a series of phone dumps created by the police department with specialist equipment, which was created by Cellebrite, an Israeli firm that provides phone-cracking technology. We obtained a number of these so-called extraction reports. One of the more interesting reports by far was from an iPhone 5 running iOS 8. The phone's owner didn't use a passcode, meaning the phone was entirely unencrypted. The phone was plugged into a Cellebrite UFED device, which in this case was a dedicated computer in the police department. The police officer carried out a logical extraction, which downloads what's in the phone's memory at the time. (Motherboard has more on how Cellebrite's extraction process works.) In some cases, it also contained data the user had recently deleted. To our knowledge, there are a few sample reports out there floating on the web, but it's rare to see a real-world example of how much data can be siphoned off from a fairly modern device. We're publishing some snippets from the report, with sensitive or identifiable information redacted.
And you agreed to give it to them.
"Don't be evil" my ass.
If you have a smart phone, any complaints you make about "warrantless wiretaps" or "massive government surveillance" are complaints about getting rained on while you're drowning in the ocean.
Sure, Apple makes a public fuss sometimes, but they give data to the government all the time.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" (Benjamin Franklin)
The content is pretty much what one would except--nothing there was unexpected.
The only two things that I found interesting was the poor security practices at the law firm and the computer case in the stock photo in the Zdnet article--I'm looking for a case that has 3 to 4 external 5.25" bays, about 18" tall, and has good air flow.
the article outlines the general process of how a phone is intercepted and the software is applied, but it obviously does not go into details of how the data is found or transferred. my guess is these portable tablets cellbrite has developed contain ADB and developer tools to pull off what to a seasoned slashdotter is just a parlor trick, but to a police department is nothing short of magical CSI hacking.
as hackers ourselves we need to ask more questions. what is the inner machination of this tablet? how do we defeat it? can it defeat password encryption? how about Signals password-based authentication? Is there a means by which contact lists can be hardened and encrypted? All of these questions are crucial in the next 10 years as most law enforcement does not bother with a warrant when theyre halfway through your roadsite fishing expedition.
Good people go to bed earlier.
for all you morons who are to stupid and or lazy to
to have a back up of your own phone data and transfer it your self the machines verizon and most wireless carriers use to copy your data are made by cellbrite...
I wonder if it's possible to have an innocuous, harmless to my phone, file on my phone that does interesting things to Cellebrite