Hacker Steals 900 GB of Cellebrite Data (vice.com)

← Back to Stories (view on slashdot.org)

Hacker Steals 900 GB of Cellebrite Data (vice.com)

Posted by msmash on Thursday January 12, 2017 @06:00AM from the hackers-hacked dept.

An anonymous reader shares a Motherboard report: Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite's products. The breach is the latest chapter in a growing trend of hackers taking matters into their own hands, and stealing information from companies that specialize in surveillance or hacking technologies. Cellebrite is an Israeli company whose main product, a typically laptop-sized device called the Universal Forensic Extraction Device (UFED), can rip data from thousands of different models of mobile phones. That data can include SMS messages, emails, call logs, and much more, as long as the UFED user is in physical possession of the phone.

69 comments

Min score:

Reason:

Sort:

Good by Anonymous Coward · 2017-01-12 06:03 · Score: 0

Bad people suck.
1. Re:Good by Oswald+McWeany · 2017-01-12 06:05 · Score: 5, Funny
  
  Bad people suck.
  Good people swallow.
  
  --
  "That's the way to do it" - Punch
2. Re:Good by fbobraga · 2017-01-12 06:10 · Score: -1, Troll
  
  Bad people suck.
  
  Good people swallow.
  Other people spits
3. Re: Good by Anonymous Coward · 2017-01-12 06:28 · Score: -1
  
  Open borders for Israel.
4. Re: Good by Anonymous Coward · 2017-01-12 08:19 · Score: 0
  
  Anti-semite!
5. Re:Good by grep+-v+'.*'+* · 2017-01-12 08:51 · Score: 2
  
  Bad people suck.
  Good people swallow.
  Sorry?? I thought good people just got screwed. I didn't realize they were actively involved in the process.
  
  --
  If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
Sweet. by zenlessyank · 2017-01-12 06:05 · Score: 1

2 sets of rules works for no one.
Seriously? by Anonymous Coward · 2017-01-12 06:06 · Score: 0

Why in holy hell do these companies continue to keep mission critical systems connected to the internet?
1. Re:Seriously? by mlts · 2017-01-12 06:10 · Score: 5, Insightful
  
  Because security has no ROI...
2. Re:Seriously? by Anonymous Coward · 2017-01-12 06:10 · Score: 0
  
  Nobody makes floppies anymore. How the hell do you think files could be moved around without floppies or the world wide web? It's either or.
3. Re: Seriously? by Anonymous Coward · 2017-01-12 06:10 · Score: 0
  
  Haven't you heard? The cloud is a wonderful thing!
4. Re: Seriously? by Anonymous Coward · 2017-01-12 06:20 · Score: 0
  
  It's too bad nobody invented a storage device that connects via USB.
5. Re:Seriously? by taustin · 2017-01-12 06:37 · Score: 1
  
  They don't necessarily. They only have to put their database server on a network that's connected to the internet, and lose control of something else on the network. That's why computers than handle classified information cannot be connected to a network that is capable, at the hardware level, of connecting to the internet. If the wiring's there, it's not secure.
6. Re:Seriously? by postbigbang · 2017-01-12 06:56 · Score: 1
  
  Everyone thinks they're immune, even when they use crypto. Then people leave the certs laying around in someone's browser cache, and it's all plain text again.
  No one is immune, not me, not you. Rename your dbs to .mp4. Do weird things, low-hanging-fruit things. People stoked up on coffee just swear and move on. Their parsers fail, and their attention span gets wiped.
  Don't believe me? Go to CCC and see how many people are wired.
  
  --
  ---- Teach Peace. It's Cheaper Than War.
7. Re: Seriously? by Anonymous Coward · 2017-01-12 07:25 · Score: 0
  
  Are you insane?! USB?
  Do you want Stuxnet? Because that's how you get Stuxnet.
8. Re:Seriously? by zlives · 2017-01-12 07:28 · Score: 1
  
  is this because a breach has no consequnce?
  i am sure there is atleast one example out there that showed some real consequences of a breach?!! (real==money)
9. Re:Seriously? by SeaFox · 2017-01-12 07:30 · Score: 2
  
  Because security has no ROI...
  You forgot the "until customers start going to your competitors because of your shitty security" part.
  You can ask any cloud service provider about that.
10. Re:Seriously? by RuffMasterD · 2017-01-12 23:03 · Score: 1
  
  Consequences only appear after a breach happens, and nobody thinks a breach will ever happen to them. That only happens to incompetent companies. Anyway, if you prevent a breach from happening, then no breach ever occurs, and the cost of preventing such a breach was money wasted as far as management cares. Better spend that money on bonuses. You do want a bonus this year, don't you?
  
  --
  Human Rights, Article 12: Freedom from Interference with Privacy, Family, Home and Correspondence
Two questions by Locke2005 · 2017-01-12 06:10 · Score: -1

1) What's a "cellebrite"? 2) When are slashdot editors going to start using spellcheck to compensate for their dyslexia?

--
I've abandoned my search for truth; now I'm just looking for some useful delusions.
1. Re: Two questions by cyber-vandal · 2017-01-12 06:13 · Score: 2
  
  You could read the summary at least.
2. Re:Two questions by fbobraga · 2017-01-12 06:14 · Score: 1
  
  Please, read at least a good part of the summary before posting: it's talking about a company, not people
3. Re:Two questions by The-Ixian · 2017-01-12 06:20 · Score: 4, Informative
  
  Cellebrite was the company that "resolved" the issue for the FBI when they wanted access to a locked iPhone and Apple wouldn't help them by circumventing their own software.
  So, enter Cellebrite and their cracking software to the rescue. The FBI then withdrew their request to Apple.
  The whole thing was covered ad nauseam and, in my opinion, was largely a publicity stunt by Apple to showcase how secure their device is.
  
  --
  My eyes reflect the stars and a smile lights up my face.
4. Re:Two questions by Anonymous Coward · 2017-01-12 06:28 · Score: 0
  
  One question, how long until pedantry kills you? I'll take your answer in seconds.
5. Re: Two questions by Anonymous Coward · 2017-01-12 06:38 · Score: 2, Insightful
  
  No, it was a publicity stunt by the FBI to hide the fact that they have had the ability to get into people's iPhones all along.
6. Re:Two questions by Anonymous Coward · 2017-01-12 06:42 · Score: 0
  
  If you don't know who Cellebrite is, why are you here?
  Your cracker jack box "geek" card has been revoked.
7. Re: Two questions by cfalcon · 2017-01-12 06:45 · Score: 5, Insightful
  
  I think it was a political stunt to try to soft-ban encryption solutions, by overtly forcing a very prominent privacy oriented company into unlocking their own crypto by pushing in a backdoored update. The end result would be that any company that didn't have a backdoor ready to go for any device or OS that it touched would look like it was standing in opposition to law enforcement, and that this would be considered a legal risk, and therefore, no one would continue making encryption easier and/or more reliable.
8. Re:Two questions by Anonymous Coward · 2017-01-12 06:52 · Score: 1
  
  "a publicity stunt by Apple to showcase how secure their device is"
  If they were trying to showcase their security they failed in spectacular fashion. Apples refusal to obey a court order was nothing more than a marketing ploy aimed at convincing the proles that they actually give a shit about privacy.
  And going after or harassing an Israeli company is really not the smartest thing to do if you don't want to spend an inordinate amount of time trying to hide from their reprisal if they deem the offense against them requires a response. Israel is the only country on the planet who never asks for permission before they kick the shit out of whoever happens to be threatening them. They don't really give a shit about any political fallout either since they produce some of the best military technology on the planet and all the main foreign powers line up to buy it. US drone technology was built upon on Israeli technology. Israel provides the most advanced short range, mid-range, and ballistic anti-missile technology testing grounds. Any US funding given to Israel in this area is to guarantee access and allows Raytheon and other US military technology firms to partner with the Israeli firms.
9. Re:Two questions by Anonymous Coward · 2017-01-12 07:12 · Score: 1
  
  Better than Apple being an authoritarian cock sucking bootlicker like you.
10. Re: Two questions by Anonymous Coward · 2017-01-12 07:15 · Score: 0
  
  this article said nothing about decrypting more than likely a device thats kiosk like that can get the data off phones and now all that data is public at least thats how i read it.
11. Re: Two questions by Anonymous Coward · 2017-01-12 07:46 · Score: 3, Interesting
  
  The only reason they have been able to become a high tech and military industry powerhouse is thanks to the endless supply of money that keeps flowing in from the US. There are universities, tech, and medical campuses in Israel that are funded solely by US 'donations.' The entire country functions on favors and shady backroom deals. It is basically a nation equivalent of Hollywood.
12. Re:Two questions by Anonymous Coward · 2017-01-12 09:45 · Score: 0
  
  1) What's a "cellebrite"? 2) When are slashdot editors going to start using spellcheck to compensate for their dyslexia?
  Cellulite is the herniation of subcutaneous fat within fibrous connective tissue that manifests topographically as skin dimpling and nodularity, often on the pelvic region, lower limbs, and abdomen
13. Re:Two questions by Anonymous Coward · 2017-01-12 09:46 · Score: 0
  
  This was almost certainly a state sponsored hack and not some kid in his basement. Russia or China or maybe Iran. I would actually bet Russia since selling security exploits and doing exactly what Cellebrite does is like their fastest growing industry. Probably a Russian "competitor" with an okay from the Kremlin since no Russian hacker would dare do anything without political cover first.
14. Re:Two questions by Anonymous Coward · 2017-01-12 09:51 · Score: 0
  
  ... cracking software ...
  
  It's so rare to use the word 'cracking' when talking about bypassing cyber-security; thank you. Sometimes I can't blame the media, it's difficult to create a context for the word 'cracking', so the universal word, 'hacking' is used. Then again, sometimes I can: I noticed yesterday, a news show talked about Uber 'hacking' bank accounts: No, fraudulent EFTPOS withdrawals isn't hacking, or cracking an online service.
15. Re:Two questions by Anonymous Coward · 2017-01-12 10:33 · Score: 0
  
  yees yeeees, the mighty russians under every stone ...
16. Re: Two questions by cavreader · 2017-01-12 11:55 · Score: 1
  
  Almost all of the money the US has given to Israel over the years could only be used to purchase US military tech. The most recent deal with them is the first time they are allowed to spend a higher percentage on non-US weapons.
  "The entire country functions on favors and shady backroom deals"
  Can you name one other country on the planet who doesn't do the same thing?
17. Re:Two questions by Anonymous Coward · 2017-01-12 16:28 · Score: 0
  
  The whole thing was covered ad nauseam and, in my opinion, was largely a publicity stunt by Apple to showcase how secure their device is.
  And backfired because their device actually isn't secure at all.
18. Re:Two questions by Anonymous Coward · 2017-01-12 16:38 · Score: 0
  
  Better than Apple being an authoritarian cock sucking bootlicker like you.
  In the end that's what happened anyway. Apple were proven to be liars and the whole time they didn't need to write a custom OS to be able to get access to the phone at all, that was all just a 100% bullshit tagline. Regardless of your position on this politically you'd have to have Apple's collective hand up your ass operating you like a puppet if you pretend like you can't see their bullshit.
19. Re: Two questions by athmanb · 2017-01-12 21:54 · Score: 1
  
  Israel's budget is $70b, and they receive $3b in direct government aid from the US. That creates a whole bunch of weird incentives that pop up when a large amount of the money you spend doesn't come out of your own pocket. And I doubt that since the end of the Soviet Union, there is any other country that finances 5% of its operation through foreign aid. Even Venezuela currently only gets less than $100m a year total, and the Chinese probably aren't spending a lot of money on North Korea either although it's of course impossible to get real numbers there.
20. Re: Two questions by Anonymous Coward · 2017-01-13 02:24 · Score: 0
  
  The majority of that $3B gets fed back into US military technology corporations. That $3B has also given the US some control over what Israeli military technology gets exported to countries such as Russia and China. The only real benefit Israel receives from the US is the US veto powers in the UN. However, Russia or China could provide the same veto powers if Israel decided to seriously downgrade ties with the US. While the US and Europe wring their hands over the Palestinians do you think the Russians or Chinese would let that issue stand in the way of luring Israel away from their relationship with the US?
Good... Good.... by freeze128 · 2017-01-12 06:12 · Score: 1

Millions of souls laughed and laughed at this breach, until they realized that the hack could contain their own data.
Too bad they didn't publish the data. by volodymyrbiryuk · 2017-01-12 06:14 · Score: 5, Insightful

Too bad they didn't publish the data.

--
sudo rm -r -f --no-preserve-root /
Pot meet Kettle by nehumanuscrede · 2017-01-12 06:14 · Score: 5, Funny

This is a company who specializes in selling products whose purpose is to bypass built in protections in order to gain access to others data without permission.
Am curious how they feel when it happens to them.
1. Re:Pot meet Kettle by Anonymous Coward · 2017-01-12 07:10 · Score: 0
  
  Am curious how they feel when it happens to them.
  i'm sure mossad will ensure we never know.
2. Re:Pot meet Kettle by BlueStrat · 2017-01-12 07:30 · Score: 3, Interesting
  
  Am curious how they feel when it happens to them.
  
  i'm sure mossad will ensure we never know.
  If the hacker(s) is/are smart the first thing he/they did was set up multiple deadman caches of the data that would automatically splash the data all over the web and physically send multiple copies of the data by multiple means/routes to multiple news/press/media outlets across the world if anything happened to them, as insurance against any possible reprisals/arrests/etc. I would, and I'm no uber-1337 h4x0r. Just in no hurry to find out if there's an afterlife or if my cellmate's name would actually be 'Bubba'. :)
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
3. Re:Pot meet Kettle by zlives · 2017-01-12 07:31 · Score: 1
  
  i am sure they feel great about the publicity that they can hack "successfully" data on phones. I mean it took FBI like months to figure out to use them.
4. Re:Pot meet Kettle by Xest · 2017-01-12 21:32 · Score: 1
  
  I'm actually rather concerned that contrary to the implication in the summary that this is no longer simply citizen hacking but in fact escalation of state sponsored hacking. It seems we're beginning to find out more and more that nation states are engaged in hacking from the hacks we know about for sure such as the North Korean hack of Sony, through to the ones that we can make a reasonable assumption on such as the Russian hacks of the DNC (even Trump finally said on Wednesday he thinks it was the Russians), through to those we simply don't know about.
  Even if we step back a few years we had the Syrian cyber army being quite active in it's hacking attempts. Given that Syria worked closely with North Korea on their attempted nuclear program (Syria's nuclear program destroyed by Israel in 2007 was shown to be a clone of North Korea's) then would it really be far fetched to assume that given that North Korea also has strong offensive hacking capabilities that it wasn't engaging with them on that too? Similarly the UEA ClimateGate hack was eventually believed based on analysis to be an act by Russia as it was carried out just days before a major climate conference in 2009 that sought to reduce emissions by cutting fossil fuel use - far and away the foundation of Russia's entire economy so they had clear interest also in sabotaging such an agreement and it worked, the conference was largely a failure as a result.
  Of course it's not one sided, we know about Stuxnet being a likely US-Israeli attack, and we know that the five eyes countries have been engaging in these sorts of things for years thanks to the revelations by Snowden. I'm not saying it's just some countries or others doing it, on the contrary, I think everyone is doing it. Frankly I suspect at least some of the purported hacks by anonymous were merely just nation states using the broad anonymous idea as cover for their actions.
  Could this Cellebrite hack for example be revenge by Iran for Stuxnet? At this point I do not think that's far-fetched for one minute, though hopefully time will tell.
  My concern is that this is getting out of control. How long before this escalates and what we once laughed at as being paranoia, the idea of "cyber war" becomes a reality and someone decides to break a damn, or overload a powerplant? Ukraine already saw last year an outage on their powergrid because of hackers. Thankfully I believe no one died, but how long before someone does and it stops just being a cyber war?
  We're learning more and more about this and so far solutions
  have been purely political and diplomatic. A couple of years back we were seeing constant hacks on the US from China, and this died down - I saw an article recently explaining what happened, and it turns out that there was more than meets the eye to the US charges against 5 Chinese mentioned here:
  https://www.justice.gov/opa/pr...
  The images that the US used for these arrest warrants were apparently personal images the US themselves had stolen from these Chinese general's laptops after their own hacks against them. The effect was to send a public message to the Chinese that "we can do it too" and it seems to have been succesful as China/US relations on this front seem to have significantly improved and this seems to have been the driver for the China/US cyber agreement agreed late last year. It appears the Chinese cyber command got spooked when they saw their own non-publicly available data used to provide pictures in arrest warrants against them and forced a whole Chinese reconsideration of the issue.
  It's clear therefore that increased state hacking isn't merely the paranoia that people once thought it was and that it's generally becoming more prolific, or at least, we're becoming far more aware of it as time goes on and more information is released. So the point I was going to make in reply to your post was this - I'm
5. Re:Pot meet Kettle by BlueStrat · 2017-01-13 00:13 · Score: 1
  
  I'm actually rather concerned that contrary to the implication in the summary that this is no longer simply citizen hacking but in fact escalation of state sponsored hacking.
  As true as the things you bring up may be re: State-sponsored hacking, none of that really matters and nor will anyone in the US/Five-Eyes nations be able to appreciably change things until spying on domestic populations by their respective domestic governments in those nations is halted/brought under control. That, by far, is the most immediate and proximate threat, and the most likely to directly and negatively affect the average person in those nations as they try to change the status quo. It is domestic spying that supports companies like Cellebrite, after all, as there logically must be orders of magnitude more cases of the US and other Five-Eyes nations wanting/requesting tools for their domestic use than there are opportunities for use against foreign targets of interest.
  Regaining control over Western domestic governments and their intelligence agencies will go far towards being able to control such State sponsored hacking operations as those you refer to and, I would argue, a necessary prerequisite for any meaningful change to occur.
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
6. Re:Pot meet Kettle by Xest · 2017-01-13 01:08 · Score: 1
  
  I think you're right, but I think it's a similar situation across the globe - realistically spy agencies in Russia, China and so forth shouldn't be doing those things to innocent citizens either so I don't think it's entirely a Western problem.
  I think it's a general issue here that governments need to get together and accept that they all need to reign in their agencies before shit really does hit the fan with some mutual agreement to start actually following the Universal Declaration of Human Rights (that governs against this sort of thing), and to start governing cyber operations against each other in the same way military operations are governed against each other - i.e. it's not just some routine thing you do on a whim, and that there are consequences for it.
  I mean, let's be clear, the sort of shit you are describing already has in some countries has profoundly damaging real world consequences - the whole arab spring started in Tunisia precisely because overreaching security services eventually pushed one man just that bit too far for example.
  So you're absolutely right to point out that uncontrolled security services can cause more harm than good if they are not reigned in appropriately, and if left to go to far, they in themselves can become a catalyst for national collapse as in the arab spring.
7. Re:Pot meet Kettle by BlueStrat · 2017-01-13 16:03 · Score: 1
  
  I think you're right, but I think it's a similar situation across the globe - realistically spy agencies in Russia, China and so forth shouldn't be doing those things to innocent citizens either so I don't think it's entirely a Western problem.
  Well, it's the same problem in Western nations and Russia, China, etc. Government gaining too much power and control. The only difference being that Russia, China, etc are just further down the same road. We here in Western nations can realistically only affect change in our own nations.
  Because our nations are already heading down the total-surveillance road, we can only offer minimal support to those in Russia, China, etc attempting to change things in those nations. We in the West, in order to be able to offer real assistance to the people of those nations, must first get a handle on our own governments, as our governments are our people's main instrument in dealing in foreign affairs. The clock is ticking, as history shows us that once freedom is lost it is highly unlikely to be regained until multiple generations have passed, that is if it is regained at all, which is not assured and becomes less and less likely as time passes.
  Strat
  
  --
  Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
What in the world Batman? by Anonymous Coward · 2017-01-12 06:21 · Score: 2, Funny

Israeli forensics software company owned by a Japanese console game development company? What kind of weird crap is that?
900 GB? How many.,. by Anonymous Coward · 2017-01-12 06:23 · Score: 0

...Libraries of Congress is this?
Historic Quote by Anonymous Coward · 2017-01-12 06:26 · Score: -1

"I'll grab whoever's and whomever's pussy that I want with whatever and whumever hand is not in my pocket jiggling my junk. It's the American way. Grab one pussy or grab two. You grab me and I'll grab you".
- Donald Trump
1. Re:Historic Quote by GLMDesigns · 2017-01-12 07:04 · Score: 1
  
  Funny how you latch on to locker room talk and think it represents a person you don't like but ignore statements like:
  
  "he's clean and articulate" by politicians you do like.
  
  --
  If you're scared of your govt then you need to further restrict its powers
  Vote 3rd Party in 2016 and beyond
2. Re:Historic Quote by Anonymous Coward · 2017-01-12 07:14 · Score: 0
  
  Ah yes the "But Bill Clinton!!!" comeback. "It's okay for someone on my team to do bad things if I can point out someone else doing something bad."
3. Re:Historic Quote by Anonymous Coward · 2017-01-12 07:20 · Score: 0
  
  Which of these two people was elected president and is now meeting with a french fascist?
Now what? by Anonymous Coward · 2017-01-12 06:28 · Score: 1

They get the data and see the applications and attack vectors. Unless they provide software to counter this stuff there is nothing useful here.
1. Re:Now what? by MrL0G1C · 2017-01-12 21:01 · Score: 1
  
  Except that Google, Apple, MS et al might have to fix the vulnerabilities if this info is released which it probably will be.
  
  --
  Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
Gay Anal Sex! by Anonymous Coward · 2017-01-12 06:37 · Score: -1, Troll

Anyone here tried it?
I heard Rob Malda gave timothy AIDS so they both promptly died and kdawson didn't know how to log into his Windows machine without timothy to guide him through typing his user name and password. Only time can tell how long this site will stay up. Will the lone T1 go down, or will the scrappers find the Pentium Pro running the Mandrake Linux server and scavenge it for gold?
Only time will tell.
1. Re:Gay Anal Sex! by Anonymous Coward · 2017-01-12 06:42 · Score: 0
  
  I want to mod you up for the Pentium Pro gold reference, but I just *can't*, I'm so sorry :(
2. Re:Gay Anal Sex! by Anonymous Coward · 2017-01-12 07:16 · Score: -1
  
  NT 4 r0cked on teh Pentium Pro.
3. Re:Gay Anal Sex! by Anonymous Coward · 2017-01-12 08:51 · Score: 0
  
  nt4 was the DEC Alpha dream workstation.
  Mandrake Linux is for Slackware wannabees and LinuxFromScratch noobs. I endorse TurboLinux for my high performance desktop needs.
Gay Butt Sex is amazing!! by Anonymous Coward · 2017-01-12 07:10 · Score: 0

kdawson. Now that's a name I've not heard in a long time. A long time...
1. Re:Gay Butt Sex is amazing!! by Anonymous Coward · 2017-01-12 11:33 · Score: 0
  
  kdawson. Now that's a name I've not heard in a long time. A long time...
  Did you hear it in a galaxy far, far away...?
Help is on its way by troll+-1 · 2017-01-12 08:09 · Score: 2

Does Giuliani know about this?
DNC by Anonymous Coward · 2017-01-12 08:44 · Score: 0

It's not DNC so who cares..
anti-anti-semite by Anonymous Coward · 2017-01-12 12:54 · Score: -1

Anti-anti-semite!
Pythonesque by Anonymous Coward · 2017-01-12 16:36 · Score: 0

Those responsible for hacking the people who have just been hacked have been hacked.
There, I fixed that for you... by Anonymous Coward · 2017-01-12 18:35 · Score: 0

Hacker Steals 900 GB of Cellebrite Data
Should read:

Hacker Copies 900 GB of Cellebrite Data
I'm pretty sure that Cellebrite still has the data.
Waah waah waah by Anonymous Coward · 2017-01-12 23:21 · Score: 0

But Billy peed under his chair!!!
littlekids.