Signal's CEO says he analyzed a Cellebrite device, used to extract data from phones, that fell off a truck, and it is full of easily exploitable security flaws

VICE 2021-04-23 Lorenzo Franceschi-Bicchierai

Context & Ripple Effects

Cellebrite had already faced a major exposure when a hacker stole 900GB of company data in 2017, and later reporting showed its extraction technology had been sold to NYC police for device unlocking and data collection. The newly reported flaws add a product-security challenge to a vendor already central to mobile-device forensics.

Signal’s CEO is using the device analysis to contest the security of a tool deployed against encrypted-phone users, following reports of Cellebrite’s police-facing mobile extraction capability.

First-order effects

Cellebrite faces immediate scrutiny over the security of its extraction hardware and software after Signal’s CEO said the device contained easily exploitable flaws.
Signal gains a concrete security critique of a forensic-tool provider whose products can retrieve data from phones, while Cellebrite’s police customers must account for the reported weaknesses in equipment they use.

Second-order effects

Law-enforcement buyers of Cellebrite tools may place greater weight on vendor security practices, not only on a product’s ability to unlock and extract handset data.
The finding compounds the reputational consequences of Cellebrite’s earlier 900GB data theft, raising the stakes for forensic vendors whose systems handle highly sensitive device data.

Third-order effects

Mobile forensics is becoming a two-sided security market: tools designed to extract information from phones also become high-value targets when their own software or devices can be compromised.
If public scrutiny of extraction-tool security persists, procurement competition will increasingly hinge on how vendors protect forensic systems and the data produced by them, alongside extraction coverage.

The trend: The story is one data point in the rising security scrutiny of digital-forensics vendors as their tools gain wider law-enforcement use.

Discussion

@signalapp @signalapp on x
Our latest blog post explores vulnerabilities and possible Apple copyright violations in Cellebrite's software: “Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective” https://signal.org/... https://twitter.com/...
@moxie Moxie Marlinspike on x
A few months ago Cellebrite announced that they would begin parsing data from Signal in their extraction tools. It seems they're not doing that very carefully. Exploiting vulnerabilities in Cellebrite's software, from an app's perspective: https://signal.org/...
@uhoelzle Urs Hlzle on x
Amusing security analysis of a cell phone “forensics” tool, which turns out to be not so secure itself. https://twitter.com/...
@olabini Ola Bini on x
This is quite interesting, considering that an old version of Cellebrite UFED was used to extract information from my phone. Of course, my phone had already been modified by the analysts before doing this extraction, so evidence shouldn't be valid anyway. This adds another reason…
@wethergeat @wethergeat on x
Oh, MAN do I hope this is true. Your thoughts, @greg_doucette? https://gizmodo.com/...
@jbuting Jerome Buting on x
Software that cops & authoritarian governments use to break into people's phones can be easily hacked itself to insert text & images. So police-generated Cellebrite reports of a phone's content may contain files the phone's user never downloaded. #excludejunkscience @cifsjustice …
@doctorow Cory Doctorow on x
As Marlinspike explains, the job of Cellebrite's tools is to ingest untrusted input - the files from a seized mobile device - and parse them. This is a very dangerous task: “This is the space in which virtually all security vulnerabilities originate.” 5/
@doctorow Cory Doctorow on x
Now, Signal founder Moxie Marlinspike has turned the tables on Cellebrite in a delicious act of security analysis, which he wrote up in detail on Signal's corporate blog: https://signal.org/... 4/
@doctorow Cory Doctorow on x
Incredibly, Cellebrite's programmers do no input sanitizing, just trusting all the files they receive and passing them from subroutine to subroutine. What's more, these subroutines call on wildly out-of-date software with dozens - even hundreds - of known vulnerabilities. 6/
@doctorow Cory Doctorow on x
Marlinspike intimates that he turned up more vulnerabilities than he enumerates in his analysis, but he is not making the kind of “responsible disclosure” to Cellebrite that is common among “white hat” security researchers. 9/
@jstrauss @jstrauss on x
This should basically end Cellebrite's law enforcement business since no court should ever admit evidence recovered with Cellebrite knowing that it could have been silently altered. https://twitter.com/... https://twitter.com/...
@swtechhelp Sex Work on x
I've talked a bit about @signal in the past — today they hacked the algorithm used by the police to infiltrate users phones...and are now adding a patch to their software to invalidate that hack. https://gizmodo.com/... I was worried about signal recently but...faith restored.
@carnage4life Dare Obasanjo on x
Signal's CEO lets the world know they go above & beyond in protecting people's conversations in the most epic way possible. Reverse engineering & hinting that Signal will compromise any data collected by phone cracking tools used by cops & authoritarians https://gizmodo.com/...
@matthewbevan Matt Bevan on x
Took me a while to wrap my head around what was happening here but once I did it was very rewarding https://twitter.com/...
@ashk4n Ashkan Soltani on x
Joking aside, @moxie 's finding has the potential to invalidate digital evidence used in civil and criminal cases all across the country. I could see defense attorneys argue evidence obtained from @Cellebrite_UFED devices can't be relied upon as it can be easily tampered with htt…
@a_greenberg Andy Greenberg on x
Just when you start to worry that @moxie might have lost his cyberpunk edge as CEO of the relatively grown-up non-profit behind Signal, he lays hands on a Cellebrite device that “fell off a truck,” hacks it and demos the bugs in a Hackers-themed video: https://signal.org/...
@dragosr @dragosr on x
Ooof. Cellebrite uses an ancient unupdated version of ffmpeg in their forensics software. Hilarity ensues. https://arstechnica.com/...
@raphaelluta Raphal Luta on x
As often, a good offense is the best defense. Well played Signal ! https://twitter.com/...
@stevejang Steve Jang on x
sometimes, the universe works in mysterious and poetic ways. https://twitter.com/...
@fredraynal Pappy on x
Back in 2001! @thegrugq introduced similar ideas to attack forensic tools. Now Cellebrite owns the market, is not transparent at all with its product and is being used by wrong people (and always have). @moxie clearly explains why we should not trust them, before, now or later. h…
@realsexycyborg @realsexycyborg on x
The skeptic in me says this is reputation management but it's certainly the best behavior we've seen out of @SignalApp in while so I'm inclined to be charitable and applaud the spirit of the maneuver even if I'm a little unconvinced of the motivation👏🏻👏 🏻👏🏻 https://twitter.com/..…
@yoyoel Yoel Roth on x
I've read this blog post multiple times today, because, security content aside, it is one of the absolute best pieces of prose I've seen in a long time. https://twitter.com/... https://twitter.com/...
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Funniest thing here is this message to Cellebrite tweeted by Signal. https://twitter.com/...
@xor Parker Higgins on x
Truly unbelievable. (this is an incredible post from Signal) https://signal.org/... https://twitter.com/...
@swyx @swyx on x
TL;DR - Cellebrite helps oppressive regimes read your messages - Signal keeps your messages private - Cellebrite announces “Signal support” - Signal finds 9 years of vulnerabilities in Cellebrite - Signal permanently pwns Cellebrite You come at the king, you'd best not miss. http…
@thegrugq Thaddeus E. Grugq on x
Very old anti forensics technique. I've been against it in the past, but the circumstances in this case are different, and I think makes sense. The key changes are: 1) fewer forensic software suites, 2) owner is not responsible https://twitter.com/...
@bcmerchant Brian Merchant on x
feels like Moxie Marlinspike is one of the last great audacious and prominent pirate hacker personalities, making a spectacle out of hacking oppressive and corporate tech for the public good, and for that I salute him heartily https://twitter.com/...
@erratarob @erratarob on x
9/ Thus Moxie's manifesto: if Cellebrite continues to try to hack Signal data, Signal will continue to hack Cellebrite. This is an interesting threat because if Cellebrite is easily hacked, it's data is no longer reliable in court cases.
@erratarob @erratarob on x
1/ In case you don't have the context to understand this manifesto, let me explain it to you. https://signal.org/...
@corbett Christine Corbett Moran on x
This is the first example I can think of of an app deployed this widely exhibiting the plausibility of doing serious offensive security to complement its defensive security 🎤drop https://twitter.com/...
@ericajoy Erica Joy on x
i love a software company that truly values ~aesthetics~ https://twitter.com/...
@atomicthumbs Site Specific Carnivorous Occurrence on x
more of this, less of cryptocurrency in the secure messaging app, please https://twitter.com/...

Chronicles