Signal's CEO says he analyzed a Cellebrite device, used to extract data from phones, that fell off a truck, and it is full of easily exploitable security flaws

One of the biggest encrypted chat apps in the world just showed how a device used to decrypt messages can be hacked and tampered with. Source: Signal Blog .

VICE 2021-04-22 Lorenzo Franceschi-Bicchierai

Context & Ripple Effects

Cellebrite had already faced a 900GB data theft in 2017. Signal’s analysis shifts the focus from a breach of the vendor to weaknesses in the phone-extraction device itself, including the possibility of tampering.

The episode also reinforces Signal’s long-running privacy posture, including its earlier work on contact discovery designed to delete server-side data. Here, the company is challenging the security of a tool used against encrypted-phone users rather than changing Signal’s own service.

First-order effects

Cellebrite faces immediate pressure to patch the reported flaws and demonstrate that its extraction devices and their outputs cannot be altered by an attacker.
Investigators using Cellebrite devices must treat device security and the integrity of extracted data as operational risks exposed by Signal’s analysis.

Second-order effects

Signal gains a concrete argument that weaknesses in forensic tooling can undermine the reliability of data obtained from phones, not merely the privacy of the device owner.
Competing mobile-forensics vendors are pushed to differentiate on hardening and tamper resistance, because a compromise of the tool can affect confidence in its results.

Third-order effects

If forensic-device security becomes a recurring point of failure, mobile extraction will be judged increasingly on verifiable integrity controls alongside its ability to access phone data.
The case highlights the dual-use security dynamic: vendors that handle highly sensitive device data must defend their own products as rigorously as the phones they seek to examine.

The trend: Mobile-forensics tools are becoming a security battleground in which access capability and the integrity of the extraction system are inseparable.

Discussion

@moxie Moxie Marlinspike on x
A few months ago Cellebrite announced that they would begin parsing data from Signal in their extraction tools. It seems they're not doing that very carefully. Exploiting vulnerabilities in Cellebrite's software, from an app's perspective: https://signal.org/...
@signalapp @signalapp on x
Our latest blog post explores vulnerabilities and possible Apple copyright violations in Cellebrite's software: “Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective” https://signal.org/... https://twitter.com/...
@ashk4n Ashkan Soltani on x
Joking aside, @moxie 's finding has the potential to invalidate digital evidence used in civil and criminal cases all across the country. I could see defense attorneys argue evidence obtained from @Cellebrite_UFED devices can't be relied upon as it can be easily tampered with htt…
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Funniest thing here is this message to Cellebrite tweeted by Signal. https://twitter.com/...
@a_greenberg Andy Greenberg on x
Just when you start to worry that @moxie might have lost his cyberpunk edge as CEO of the relatively grown-up non-profit behind Signal, he lays hands on a Cellebrite device that “fell off a truck,” hacks it and demos the bugs in a Hackers-themed video: https://signal.org/...
@swtechhelp Sex Work on x
I've talked a bit about @signal in the past — today they hacked the algorithm used by the police to infiltrate users phones...and are now adding a patch to their software to invalidate that hack. https://gizmodo.com/... I was worried about signal recently but...faith restored.
@carnage4life Dare Obasanjo on x
Signal's CEO lets the world know they go above & beyond in protecting people's conversations in the most epic way possible. Reverse engineering & hinting that Signal will compromise any data collected by phone cracking tools used by cops & authoritarians https://gizmodo.com/...
@xor Parker Higgins on x
Truly unbelievable. (this is an incredible post from Signal) https://signal.org/... https://twitter.com/...
@matthewbevan Matt Bevan on x
Took me a while to wrap my head around what was happening here but once I did it was very rewarding https://twitter.com/...
@donie Donie O'Sullivan on x
fell off a truck.... lol https://www.vice.com/...
@se_parkinson Sarah E. Parkinson on x
For those even remotely plugged in (ha) to the data security world, Signal basically uses this blog post to tell Cellebrite, a company that helps authoritarian governments strip data from (activists') phones: “if you come at the king, you best not miss.” https://twitter.com/...
@trevortimm Trevor Timm on x
Possibly the most satisfying blog post I've ever read. https://signal.org/...
@mattblaze Matt Blaze on x
@pwnallthethings I'm going to hazard a wild guess that the Cellebrite codebase consists of a lot of very messy special cases hacked in one by one over time.
@raphaelluta Raphal Luta on x
As often, a good offense is the best defense. Well played Signal ! https://twitter.com/...
@emptywheel @emptywheel on x
@pwnallthethings And meanwhile every law enforcement agency in the world screaming on the phone to Cellebrite's CEO.
@thegrugq Thaddeus E. Grugq on x
Very old anti forensics technique. I've been against it in the past, but the circumstances in this case are different, and I think makes sense. The key changes are: 1) fewer forensic software suites, 2) owner is not responsible https://twitter.com/...
@stevejang Steve Jang on x
sometimes, the universe works in mysterious and poetic ways. https://twitter.com/...
@corbett Christine Corbett Moran on x
This is the first example I can think of of an app deployed this widely exhibiting the plausibility of doing serious offensive security to complement its defensive security 🎤drop https://twitter.com/...
@swyx @swyx on x
TL;DR - Cellebrite helps oppressive regimes read your messages - Signal keeps your messages private - Cellebrite announces “Signal support” - Signal finds 9 years of vulnerabilities in Cellebrite - Signal permanently pwns Cellebrite You come at the king, you'd best not miss. http…
@kimzetter Kim Zetter on x
Signal really went to town with this video showing how they hacked Cellebrite's UFED device. Expect it to be replayed at hacker conferences the planet over; it's got a guaranteed spot in hacker lore https://signal.org/...
@erratarob @erratarob on x
1/ In case you don't have the context to understand this manifesto, let me explain it to you. https://signal.org/...
@erratarob @erratarob on x
9/ Thus Moxie's manifesto: if Cellebrite continues to try to hack Signal data, Signal will continue to hack Cellebrite. This is an interesting threat because if Cellebrite is easily hacked, it's data is no longer reliable in court cases.
@fredraynal Pappy on x
Back in 2001! @thegrugq introduced similar ideas to attack forensic tools. Now Cellebrite owns the market, is not transparent at all with its product and is being used by wrong people (and always have). @moxie clearly explains why we should not trust them, before, now or later. h…
@bcmerchant Brian Merchant on x
feels like Moxie Marlinspike is one of the last great audacious and prominent pirate hacker personalities, making a spectacle out of hacking oppressive and corporate tech for the public good, and for that I salute him heartily https://twitter.com/...
@dragosr @dragosr on x
Ooof. Cellebrite uses an ancient unupdated version of ffmpeg in their forensics software. Hilarity ensues. https://arstechnica.com/...
@atomicthumbs Site Specific Carnivorous Occurrence on x
more of this, less of cryptocurrency in the secure messaging app, please https://twitter.com/...
@hackingdave Dave Kennedy on x
I lol'd at the cellebrite fell off a truck so we basically owned it 😂😂 https://twitter.com/...
@ericajoy Erica Joy on x
i love a software company that truly values ~aesthetics~ https://twitter.com/...
@msuiche Matt Suiche on x
Serous bomb dropped here by @moxie “It seems unlikely to us that Apple has granted Cellebrite a license to redistribute and incorporate Apple DLLs in its own product, so this might present a legal risk for Cellebrite and its users.' https://twitter.com/...
@pwnallthethings @pwnallthethings on x
Exactly so. The point of the blog post was to cause a flood of paperwork and grief to Cellebrite. But actually distributing malware with Signal would generate a flood of grief and liability to Signal. It's kind of a no brainer it won't actually happen https://twitter.com/...
@el33th4xor Emin Gün Sirer on x
This is a fascinating story that is a must read for every ethical hacker, involving a “device that fell off of a truck,” files stolen from Apple by Cellebrite, and a plan to counteract scans of the Signal folders. https://twitter.com/...
@yoyoel Yoel Roth on x
I've read this blog post multiple times today, because, security content aside, it is one of the absolute best pieces of prose I've seen in a long time. https://twitter.com/... https://twitter.com/...
@realsexycyborg @realsexycyborg on x
The skeptic in me says this is reputation management but it's certainly the best behavior we've seen out of @SignalApp in while so I'm inclined to be charitable and applaud the spirit of the maneuver even if I'm a little unconvinced of the motivation👏🏻👏 🏻👏🏻 https://twitter.com/..…
@tqbf Thomas H. Ptacek on x
<3 https://twitter.com/...
@dalperovitch Dmitri Alperovitch on x
I wonder what kind of implications this has for use of Cellebrite data in past/current/future legal cases: '...it's possible to execute any code, and a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports...' ht…
@matthew_d_green Matthew Green on x
In fairness to Cellebrite: parsing lots of weird file formats seems like a recipe for disaster: it's why AV products kept getting broken by P0. Your main defense is keeping the tools out of civilian hands. Which Cellebrite obviously couldn't do, so 🤷‍♂️
@campuscodi Catalin Cimpanu on x
Moxie with the troll of the year: “fell of a truck” 🤣🤣🤣🤣 🤣🤣🤣 https://twitter.com/...
@el33th4xor Emin Gün Sirer on x
As usual, excellent work by @moxie and the @signalapp team. Preserving privacy remains a daily battle. https://twitter.com/...
@nickconfessore Nick Confessore on x
The good folks at @signalapp got ahold of a software/hardware package that authoritarian regimes use to spy on phones, reverse engineered, found that it may have stolen some @Apple iPhone code, and also easily hackable itself. Sad trombone! https://signal.org/...
@fox0x01 Azeria on x
@moxie 🔥🔥 https://twitter.com/...
@jason_koebler Jason Koebler on x
This is SUCH a wild / baller move. CEO of one of the biggest encrypted apps in the world hacks the device cops use to circumvent that encryption, suggest he could (or will?) update his app to hack them en masse https://www.vice.com/...
@emptywheel @emptywheel on x
Given that there's ALREADY a backlog of Cellebrite exploitation for the phones involved in Jan 6 attack, I would imagine someone at FBI is screaming bloody murder at Cellebrite right now. https://twitter.com/...
@timmarchman Tim Marchman on x
I cannot stress enough that this is both a very serious story and involves Signal's CEO posting one of the funniest blogs of all time https://twitter.com/...
@ashk4n Ashkan Soltani on x
Fun writeup by @moxie showing how vulns in the software that law enforcement use to search smartphones can be exploited by “simply by including a specially formatted but otherwise innocuous file” TL:DR: download a file to modify future reports & falsely incriminate someone else. …
@zackwhittaker Zack Whittaker on x
Don't get mad. Get even. https://twitter.com/...
@aionescu Alex Ionescu on x
I've officially gone from respecting Moxie a heck of a lot to being absolutely in love with with Moxie. This is absolutely brilliant. https://twitter.com/...
@pwnallthethings @pwnallthethings on x
Someone at Cellebrite trying to estimate the time for the “rewrite everything except this time not in C and then sandbox all of it” Jira ticket
@pwnallthethings @pwnallthethings on x
Omg this post https://t.co/tjaQqDf0ai
@gcluley Graham Cluley on x
Plenty of shade being thrown here! https://t.co/fxEhunfy7F

Chronicles