Israeli firm can steal phone data in seconds

http://phys.org/news/2016-11-israeli-firm-seconds.html

by chang2301 • 10 years ago

225 76 10 years ago

turc1656• 10 years ago

"But privacy and rights activists worry such powerful technology can wind up in the wrong hands, leading to abuses."

Am I to believe that this firm is the right hands? Or government? Please...all hands are the wrong hands. These vulnerabilities need to be closed. I wouldn't be surprised if the NSA or some other government tentacle was paying them not to make whatever they found known.

Gee, I sound paranoid. What am I thinking, our government would never do that. Oh wait... http://www.reuters.com/article/us-usa-security-rsa-idUSBRE9B...

flipp3r• 10 years ago

Actually Cellebrite themselves have been victim of some kind of hack last month and had a load of their internal documents leaked online. So no, if any, this firm is _not_ the right hands.

rdtsc• 10 years ago

Any place which hoards 0-days is a prime target. Even if they are considered to be the "right hands", the "wrong hands" could grab those exploits eventually.

sjwright2• 10 years ago

The only "right hands" for a 0-day exploit is the device manufacturer.

user5994461• 10 years ago

I wouldn't be surprised if the NSA or some other government tentacle was paying them not to make whatever they found known.

It looks like your are unsure, so let me clarify.

There really are companies whose only business is to find and sell vulnerabilities to states. (Whether it's exclusive is just a matter of negotiations).

superflyguy• 10 years ago

Most US "charity" ends up in Israel too. Best to think of them as if they were an entirely US-funded university you then have to pay to use the services of.

wyldfire• 10 years ago

Among the data the firm claims to be able to access are text messages deleted years previously.

Among all the claims this one seems like it might be one that holds up with very recent iOS/Android releases. It would be interesting to find out whether they rely solely on the encryption to protect the deleted messages and whether overwriting the data would be thwarted by flash device wear-leveling indirection.

45h34jh53k4j2• 10 years ago

It will be interesting if Apple went after Cellebrite under the DMCA anti-circumvention clauses. I would laugh if their product became illegal in the United States.

tdkl• 10 years ago

Probably not, it's an Israeli firm.

otaviokz• 10 years ago

Pretty much my reasoning too.

r00fus3• 10 years ago

Any sales to US firms could be curtailed or punished.

Just like security itself - the goal is to provide enough barriers so predators go looking elsewhere for easier prey.

dogma1138• 10 years ago

Israel has a trade agreement with the US so DMCA is at the least partially enforced, most trade agreements have a bilateral enforcement of trademark and copyright protection laws.

Israel is also a member of the WTO so there is that avenue also.

45h34jh53k4j2• 10 years ago

So we have learned that some phone vendors give Cellebrite their phones before they reach market in order for them to discover and exploit vulnerabilities. Apple refuses to do business with these 'forensic' criminals.

Do not purchase a phone from a vendor that engages in this unethical practise.

ikonst• 10 years ago

Cellebrite got its start with the UME, a phone memory transfer tool for carriers' (POS and support). Carrier-oriented tools are a major part of its operations, though there have been some talks about spinning this off to a separate company.

Cellebrite gets early access to phones NOT due to its forensics operations, but for UME, since carriers (and that's lots(!) of carriers worldwide) are very much interested in good consumer experience on the devices' launch day.

I actually doubt it's been particularly significant to its forensics operations.

module0000• 10 years ago

It goes without saying - don't make this easy for them(or anyone). Use a strong alphanumeric password on your mobile devices. It's annoying and inconvenient until it saves your ass - there is still no "fast" way to crack a password like "My 42nd spaceship had 4 hearts of gold.", but it's not that difficult for your brain to remember.

Fingerprint unlock can save you some of the PITA of typing it - just be sure you power off your device when you have even the slightest chance of encountering an actor that could seize your mobile device - that way the passphrase will be required.

drvdevd3• 10 years ago

Another interesting point they mention is "recovering years long deleted texts." Consider the filesystem your phone uses for volumes it's writing data to and how it (probably just) unlinks files when deleted... [edit] and I should add a 'factory reset' will probably just write a new filesystem table over the old on disk without wiping anything on most devices

jdironman• 10 years ago

What about doing a factory reset, then use the 'encrypt device' option, then doing another factory reset. Would that provide an extra measure?

Unless, of course, the data in it's final state before the final factory reset is un-encrypted.

eridius2• 10 years ago

On devices with full-disk encryption (such as iPhones made in the past few years), a "factory reset" is equivalent to scrambling the entire disk. This is because it securely erases the keys that were used for all the data on the disk, and without the keys, all that data is effectively random garbage.

iNerdier• 10 years ago

It's not that hard to remember, but some sites (my last encounter was paypal) still insist on truncating passwords to a certain length. It's not much fun having to remember "My 42nd spacesh".

stephengillie• 10 years ago

Paypal and other websites are not mobile devices. Using a high-entropy random password is still a best practice with those, and many of us recommend a (database or deterministic) password manager.

1024core• 10 years ago

"Could you do anything to deprive them from throwing a stone at someone or from driving a car and running over people?

"You can't blame the car manufacturer at that point for delivering a car that was utilised to commit that kind of crime," he said.

This is specious reasoning. The point of a car is not to run over people; it's to go from point A to point B. This technology, on the other hand, has only one purpose: to break into cellphones.

libeclipse3• 10 years ago

A classic example of attacking the straw man.

ucaetano• 10 years ago

"Ben-Peretz said the company vets clients and always respects local laws, but the governments are primarily responsible."

Just following orders and the local laws...

dalbasal• 10 years ago

I think you're misunderstanding that quote.

He's saying (if I understand correctly, it's awkwardly phrased) that his company sells only to a small number of clients who are all regimes (meaning states). There are only a handful so he can vet them and demand commitments that the technology will only be used for good.

Plenty of other reasons to disagree. But, he is basically agreeing with you that this technology should be treated as a dangerous weapons-like thing and controlled in the way the sale of advanced weapons is controlled.

verbify• 10 years ago

There can be good reasons to break into cellphones, just like there can be good reasons to have a lock pick.

Our problems stem from overfunded and underregulated intelligence agencies, not from the tools they use.

gnarbarian• 10 years ago

I think it's an important distinction. The crime is in how it's used, not in the technology itself. Banning the tech outright only affects actors who are willing to follow the law. So banning this tool would mostly limit white hats.

The same principle applies to gun rights for example. The gun itself isn't the problem, it's how someone chooses to use it. (self defense vs crime). Nobody is an absolutist here, everyone draws the line somewhere slightly different.

Outlawing the tech ensures that good guys lose the arms race every time.

When I say good guys I don't necessarily mean the government. I mean anyone out there who is not using the tech for malicious intent. People using guns for self defense, breaking into an encrypted device to solve a crime, or retrieve lost work etc.

This keeps the focus on improving the actual technology (encryption). Rather than just banning law abiding citizens from taking part.

alimbada2• 10 years ago

They [the government] ask people to login to their email accounts and unlock their phones at the border. They really don't even need any technology to steal data. Intimidation works for them already.

brianwawok• 10 years ago

Then we just need a phone inside a phone right? Provide them with a fake password that shows no data, has 1 kids game app, and gives you plausible deniability. If coded correctly would be no way to prove if there is or is not a second deeper encrypted device.

wang_li• 10 years ago

Backup your phone. Wipe your phone. Cross the border. Restore your phone.

SG-• 10 years ago

Confused why they didn't demo it breaking a modern iPhone instead of a random Android device.

gordeh• 10 years ago

Probably because they couldn't? Far easier to show of a random android handset.

loader• 10 years ago

They probably chose the device they have the best success cracking. I wonder what phone they used ... checks ... LG G4 ... damn it, that's my phone.

deutronium• 10 years ago

Regarding the iPhone 5c, the attack from Sergei Skorobogatov is very interesting.

"The bumpy road towards iPhone 5c NAND mirroring" - https://arxiv.org/abs/1609.04327

And the video:

https://www.youtube.com/watch?v=tM66GWrwbsY

libeclipse3• 10 years ago

I wonder if they can crack devices that haven't been booted. Many of the newer smartphones encrypt data and require a password on boot.

cxseven2• 10 years ago

Too bad Google made the boot password the same as the screen unlock password. Since virtually everyone wants to be able to quickly unlock their phone, this makes security a Hobson's choice.

libeclipse3• 10 years ago

Yeah I can see that being the case for the vast majority of users. Also it's a damned shame that Google enforces a limit of 16 characters for the password.

My own password is a random 16 character string.

golergka• 10 years ago

Well otherwise the user will most likely forget the separate boot password as phones typically get rebooted once a month or so.

andrewpi• 10 years ago

Fingerprint readers seem to solve that problem. Booting the phone requires the secure password, but after that a fingerprint will suffice until the phone is powered off or left locked for 24 hours.

sqeaky2• 10 years ago

Does encryption defeat this? If not how are they getting the key from memory?

Does encryption defeat this when the device is off? If not what flaws exist in the encryption schemes?

zw123456• 10 years ago

I was wondering the same thing. If the data on the flash ram chip is not encrypted then worse case you just de-solder it and connect it to another computer and dump the data, I think I have seen that demonstrated someplace before. But I guess if they are using the users password you can just password cracking.

ronreiter• 10 years ago

Encryption could help but eventually exploits can beat anything.

sqeaky2• 10 years ago

Exploits are just ways to leverage those flaws. We have systems with no flaws for some older tech. Eventually we will fix this one too.

amelius• 10 years ago

Sounds like a risky business to be in. If Apple decides to change their encryption technology, you could be out of business some time soon after a new release.

chinathrow• 10 years ago

Or you just buy the next 0day from your vendor of choice.

anigbrowl• 10 years ago

There'll still be plenty of legacy users out there.

chebastian• 10 years ago

Your mistaken, looking at the forensic side of things burner phones are not your regular iphone or android.

E.g random article from bestbuy.

http://www.bestbuy.com/site/at-t-gophone-lg-b470-prepaid-cel...

Ftuuky• 10 years ago

Aren't they owned by a Japanese pachinko company?

r00fus3• 10 years ago

You'd think if they could crack the latest iPhone/iOS they'd crow about it.

The article seems to paint it as a "we're confident we could" - which seems bizarrely vague. Why would they do that when they claim they can crack an LG G4 wide open?

JumpCrisscross2• 10 years ago

From the article:

Ben-Peretz remains confident his company can crack even the newest iPhones.

eridius2• 10 years ago

The next line in the article:

iOS devices have strong security mechanisms that give us a challenge, but if anyone can address this challenge and provide a solution to law enforcement, it is Cellebrite," he said, referring to Apple's operating system.

This makes it sounds like Cellebrite actually cannot currently crack the latest phones running iOS 10, but the CEO is merely expressing his belief that they'll figure out how to do it. See how he's not saying "we can do it", but instead he's saying "if anyone can do it, it's going to be us".

woobar• 10 years ago

This is a good point. But I am not sure they have demonstrated that they can crack a G4 wide open. They were able to access DCIM folder, which is very accessible by design. Even if they were able to bypass whatever protection this folder has ("password was disabled"), it is still far from wide open.

They might be able to do what they claim, but not much was actually presented.

JumpCrisscross2• 10 years ago

Does anyone track the quantity of U.S. tax dollars which go to such firms?

ka4eli• 10 years ago

Sounds like an Apple advertisment.

sjwright2• 10 years ago

And the good kind of advertising, because it's accurate. Apple did the hard engineering work across their entire software and hardware stack because they knew it was important.

They didn't settle for good enough.

They didn't weasel out of it by blaming "ease of use" concerns.

They didn't argue that maximum security wasn't a high priority for their customers.

They didn't deploy marketing slogans to pretend like they had done the hard engineering work. (cough Knox cough)

Adverblessly• 10 years ago

I wonder, if Ben-Peretz and his checks 250 researcher team can crack checks 150 phones a month what is stopping the <scary US government agency>/<Chinese equivalent>/<Russian equivalent> from forming a 2,500 researcher team and doing the same?

It's not like there's a shortage of relevant skills in the US (supposedly responsible for stuxnet) or Russia.

Or is it just that <scary government agency> doesn't want to share its toys with <local police>?

mschuster912• 10 years ago

Ah well, with Mediatek based phones it's pretty easy - you can readback the whole storage once you have its partition map from a rooted device, or you know the size of its flash chip and figure out the partition bounds later.

Dunno about the situation with other phones but given that many cheap Androids run Mediatek, it's not very difficult to claim a huge number of "crackable phones".

The only thing that should protect you from any kind of government snoops is encrypting your phone with a strong passphrase and shutting it off once you leave a room taking the cops less than 30 seconds to enter.

st3v3r• 10 years ago

I mean, with Trump's administration banning cybersecurity and encryption, this company should go out of business soon, right?

fredgrott• 10 years ago

it would be somewhat hard to ban math, right?

Take Trump's mouth blast with a grain of salt, as its not what he will end up doing once he learns what he is talking about.

brianpan• 10 years ago

This is completely off-topic, but can we take a moment and recognize how fantastic it is that the article has a picture of a hacker's desk with an assortment of mobile devices like: a calculator, 3 bluetooth mice, and a stapler?!

jwildeboer• 10 years ago

PR based self-marketing article is just that. "Be Very Afraid" hyperbole AFAICS.

arca_vorago2• 10 years ago

On a similar note, back when cell phones were just getting started, I started parsing the ownership of the cell towers. I noticed an unusually high correlation of Israeli companies owning them (back before the phone companies themselves really started investing in them). Now think about the purpose of an imsi catcher/stingray. The Israelis seem to be on the edge of cybersecurity across the board. I know while in Iraq I got lots of training that was decidely sourced from Israel too.

All that being said, Israel is also known as being just as active if not moreso than Russia and China in their espionage against the US. I think that's also worth considering.

defunctirl2• 10 years ago

Any specific resources/links re: that final comment? Not something I've ever read about, although I could imagine.. Not discrediting your statement, genuinely curious.

arca_vorago2• 10 years ago

Just a quick duck duck go search returns these:

http://foreignpolicy.com/2015/03/24/spy_vs_spy_america_and_i...

http://www.newsweek.com/2014/05/16/israel-wont-stop-spying-u...

http://www.counterpunch.org/2009/03/12/israeli-spying-in-the...

http://www.timesofisrael.com/new-nsa-document-highlights-isr...

test_pilot• 10 years ago

And somehow I can't connect my android phone to a mac computer with a USB cable to copy photos out, without it crashing 50% of the time. I must be missing something

Israeli firm can steal phone data in seconds

Related Stories