FBI Recovers WhatsApp, Signal Data Stored on Michael Cohen’s BlackBerry

https://arstechnica.com/information-technology/2018/06/fbi-recovered-hundreds-of-encrypted-messages-from-michael-cohens-phone/

by mikece • 8 years ago

211 126 8 years ago

arstechnica.com

fwdpropaganda2• 8 years ago

Trump is in trouble now.

EDIT: It is suspected that Michael Cohen, being a long time Trump friend and personal lawyer, is familiar with Trump's money laundering. If Michael Cohen believes he's at risk of being sent to jail for many years, he might collaborate with the FBI.

sctb• 8 years ago

Could you please increase the amount of information in your comments?

Edit: thanks.

civilitty3• 8 years ago

A lot of trouble. A Ukrainian national said in an interview that he testified in front of a grand jury convened by the Mueller investigation last Friday. He said that the prosecutor's questions focused on Cohen so he is about to be squeezed from both sides and his family is now selling several multimillion dollar apartments (including his in-laws), supposedly to cover legal bills. His current legal team will cease all work for Cohen after today with sources saying that it is due to a failed attempt at negotiating down some already owed bills.

Federal grand juries convene on Fridays so we will know by Monday whether more indictments will be handed down.

fwdpropaganda2• 8 years ago

Trump Campaign to Discredit Michael Cohen is Underway

https://www.youtube.com/watch?v=-f-NToq6NW8

patrickg_zill• 8 years ago

I was under the impression that grand jury questioning was not to be disclosed? Am I wrong about this?

lamarpye3• 8 years ago

That is why I read Hacker News. The media will try cover up and protect Trump no matter what. Good thing commenters here can scoop the media and expose his lies.

hansthehorse• 8 years ago

The feds have already stated they will be going after every nickel they can get their hands on from both Manaford and Cohen if convicted. Leaving their family destitute is a powerful incentive to cooperate.

49bc• 8 years ago

The article doesn't specify whether or not the encryption was "broken", or whether Cohen is simply cooperating. My hunch tells me it's the latter.

craftyguy2• 8 years ago

Yea this is key. It's possible to have Signal on your device but not implement any device locking passcode or passcode for unlocking Signal... That would make it trivial to recover data if you have the device.

StudentStuff2• 8 years ago

An alternative method of protecting oneself is to set an expiry timer, which makes messages in a conversation ephemeral. 1 week seems to be a fine balance between being able to look back at old messages, while also not having those you communicate with be allowed to store data on your device for too long.

polar• 8 years ago

Is the model of the phone known? If it's a relatively new BlackBerry running Android, and if it can be rooted:

  * the main WhatsApp msgstore database in /data is not encrypted
  * the msgstore backup databases (.crypt* in /sdcard) can be decrypted easily using the key file (mentioned in the article) which is also stored in /data

One could probably reverse engineer the WhatsApp APK to figure out how the key file is generated.

I would hazard a guess that Signal messages are also not stored encrypted at the source and destination (beyond the protection offered by the operating system).

em3rgent0rdr• 8 years ago

obligatory: https://xkcd.com/538/

jlgaddis2• 8 years ago

No, it's really not.

We've all seen it. Hundreds of times.

qrbLPHiKpiux• 8 years ago

Bruce S. Trust the math. grugq, endpoints suck.

Bet he sung.

justboxing• 8 years ago

The letter to Judge Kimba Wood stated that "the Government was advised that the FBI’s original electronic extraction of data from telephones did not capture content related to encrypted messaging applications, such as WhatsApp and Signal... The FBI has now obtained this material."

I don't get this. How could you possibly decrypt encrypted messages without WhatsApp or Signal's assistance?

Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys?

ipsum2• 8 years ago

I haven't used Whatsapp or Signal, but you don't login every time you use the chat app, right? The phone could have just been unlocked by the owner or the PIN or pattern guessed, assuming the keys are stored on the device.

StudentStuff2• 8 years ago

They are very different platforms, Signal offers on-device encryption if you choose to enable it, prompting for a password when starting Signal after rebooting the phone. It will also keep a quick lock option in the menu on Android phones so you can easily prevent unauthorized access.

I believe Whatsapp has made a few compromises in this regard, but obviously Michael Cohen didn't bother to use disappearing messages in Signal or encrypt his Signal DB, despite how easy it is to do.

ben10402• 8 years ago

Encryption in transit doesn't imply encryption at rest.

For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.

ebikelaw• 8 years ago

Nothing on Google Drive is stored "in clear text".

snthd• 8 years ago

Media backups are not encrypted, but data is.

Backup key security is compromised by usability concerns (the need to restore the backup to a new phone without the old one).

https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whats...

odorousrex• 8 years ago

Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys?

But if the person who knows the relevant keys willingly hands over appropriate passwords/etc. for a more lenient sentence then encryption is moot.

djmips• 8 years ago

What a great point. They don't even have to publicize it, officially they just got the data by good hacking.

newscracker• 8 years ago

They probably decrypted it on the device through some brute force methods. This may be easy or difficult depending on the passcode/PIN used by the user on the device. This is a weak point from the user's side. They may have also obtained this from backups elsewhere that weren't encrypted or strongly encrypted.

There is no indication that they decrypted anything by breaking into the end-to-end transport/network encryption used by these apps.

P.S.: Your honest question (which wasn't snarky) was downvoted by some people for reasons I don't understand. Upvoted in an attempt to compensate. Such questions and responses can help more people learn about encryption and the protections necessary at different stages/layers.

MilnerRoute• 8 years ago

Manfort [not Cohen, as I originally wrote, but Manafort] had his message stored on iCloud. That turned out to be part of how the FBI was able to recover them so easily.

https://gizmodo.com/paul-manafort-learns-that-encrypting-mes...

wpdev_632• 8 years ago

Well I am not sure about blackberry but android and ios are fully compromised[0].

0:https://wikileaks.org/ciav7p1/?

AFNobody• 8 years ago

Blackberry is just a skin of Android these days.

tptacek• 8 years ago

This link doesn't say anything remotely like that.

bilbo0s2• 8 years ago

"...Cohen's messages were stored on iCloud..."

???

Your comment had me struggling to determine how one could store WhatsApp messages on iCloud. (From a Blackberry no less.)

But then I followed your link. I don't think that article was about Cohen. You may want to change your post.

On an equally important note, why is it that people out there assume that ANY form of electronic communication is impervious from government surveillance? The reality is that if a three letter agency is after you, it's probably unwise to be using WhatsApp and Signal in an incriminating fashion. (Or anything else for that matter.)

It's like locking your physical spaces. Yeah, you should go ahead and lock your house or office and turn on the alarm system while you're gone...

but you should also go ahead and assume that those three letter agencies planted surveillance devices in that house or office even in the face of your security measures.

williamscales• 8 years ago

It may be referring to the fact that WhatsApp has a cloud backup feature built in to the app that keeps a copy of your messages in a cloud storage provider. The Android app at least explicitly warns you that this database is not end-to-end encrypted and that doing this backup defeats the point of the encryption.

ohtwenty• 8 years ago

On an equally important note, why is it that people out there assume that ANY form of electronic communication is impervious from government surveillance? The reality is that if a three letter agency is after you, it's probably unwise to be using WhatsApp and Signal in an incriminating fashion. (Or anything else for that matter.)

Signal has a feature for self-destroying messages (on-read, or after x amount of time). Seems like that could've been used and it wouldn't have lead to this right here.

naner• 8 years ago

You can get WhatsApp and Signal on a BlackBerry?

Willson50• 8 years ago

Might be one of BlackBerry's newer Android phones.

UnoriginalGuy• 8 years ago

It is Android. So yes.

oxide• 8 years ago

Why wouldn't you be able to?

yjftsjthsd-h2• 8 years ago

BB used to run a custom QNX-based OS, not Android.

saagarjha3• 8 years ago

Wasn't one of the main selling points of WhatsApp back in the day that it ran on basically anything?

jlgaddis2• 8 years ago

If there's one (family of) devices(s) that the FBI certainly knows how to 100% completely pwn the shit out of... it's the Blackberry.

lstyls• 8 years ago

Why?

krn• 8 years ago

BlackBerry CEO: We'll Try To Break Our Own Encryption If Feds Demand It (2017)

https://www.forbes.com/sites/thomasbrewster/2017/10/25/black...

BlackBerry CEO blasts Apple for focusing on user privacy, data protection (2015)

https://www.extremetech.com/mobile/219661-blackberry-ceo-bla...

mirimir5• 8 years ago

Damn, you'd think that someone at that level would pay for better OPSEC support. But then, I guess that I'm not surprised. Blackberry does have a reputation, not at all deserved at this point. I'm pretty sure that the President's phone is just as poorly secured. Probably less, from what I've read.

yjftsjthsd-h2• 8 years ago

... especially after the BB leadership bragged about helping law enforcement backdoor into things...

kasey_junk4• 8 years ago

Just a question. Who would they pay? I know a few people I might pay for that but only incidentally & I’ve worked in tech. for 20 years.

Where would an average though maybe high priced attorney go to get advice other than “use signal & WhatsApp” if they knew they needed protection from a federal investigation?

mirimir5• 8 years ago

Probably at least 20% of HN users, no?

Edit: So are y'all dumping on me because my 20% estimate is too high, or too low?

subpixel• 8 years ago

Well the Russians are pretty good with computers. I mention this only half-facetiously.

karambahh• 8 years ago

I'm probably able to give this kind of advice myself but I certainly know a few C-levels at public companies listed on Eurostoxx 50 that don't have the proper digital practices

I have more than a couple times witnessed and thought "are you actually exchanging highly sensitive information with your board while using an open wifi in the same room as 5 of your direct competitiors, their staff and 1k random guys like me?"

They can ask legal or IT but either way it will end up being a project relegated on a larger roadmap and will not be properly implemented in a timely manner.

I guess what I'm looking for is a piece written by a reputable source (from their POV) such as Bloomberg or the WSJ. Any ideas?

dragonwriter• 8 years ago

Damn, you'd think that someone at that level would pay for better OPSEC support.

Cohen (and the whole Trump circle) went from operating at one level to a much higher level fairly quickly.

Also, there's a “you don't know what it is that you don't know” issue involved.

boomboomsubban4• 8 years ago

This issue is huge in politics. The entire Clinton personal e-mail scandal was essentially her unwilling to give up her BlackBerry, something Obama was unwilling to give up too. These people learned how to use some technology decades ago, and will continue using it no matter what other issues it causes.

aerotwelve• 8 years ago

Fwiw - Obama didn't use an off-the-shelf blackberry; he used one that was modified such that it complied w/ with government security standards.

http://money.cnn.com/2014/05/22/technology/security/nsa-obam...

zacharycohn• 8 years ago

Check your timelines. Obama was elected in 2008, and BlackBerry was the dominant player in the market at that point.

Also, he DID swap out his phone for a secured one, and his staff instituted a number of security protocols to keep it secure.

Alex39172• 8 years ago

The entire Clinton personal e-mail scandal was essentially her unwilling to give up her BlackBerry

The main scandal was her violating FOIA. There were some additional security concerns, but her running on a platform of undoing civil rights era legislation was the bigger issue.

_up2• 8 years ago

No, she destroyed devices, used Bleachbit to delete evidence and they still found ~ 70 secret and top secret emails on her server. There is also evidence of a cover-up. The Russia narrative is also bogus in the case of the DNC hack they even refused to give the server to the FBI.

onetimemanytime4• 8 years ago

>Damn, you'd think that someone at that level would pay for better OPSEC support

I think that he thought himself as untouchable and neglected it. Maybe dodged so many bullets over the years.

Question for HN: did the FBI break the Signal encryption or just managed to open his device to find all the messages there? Maybe sensitive messages need to be deleted.

paganel• 8 years ago

did the FBI break the Signal encryption or just managed to open his device to find all the messages there? Maybe sensitive messages need to be deleted.

I’m also interested in the answer to this question. From my layman’s understanding I see Signal as the most secure messaging solution out of the box, followed by WhatsApp but only if (and it’s a very big if) you don’t plan to do something that might raise the interest of a US 3-letter agency (i.e. you can use WhatsApp for random political corruption cases in European countries, like the politicians from my country do, but it’s not safe to use it if you plan to actively cross the interests of those 3-letter agencies). Telegram I also see as compromised by the Russian secret services, ignoring all the recent public brouhaha.

If anyone more knowledgeable has other views on this please feel free to correct me.

endorphone• 8 years ago

Which level was Michael Cohen at? From a career perspective he was an ambulance chaser (involved with a number of fraudulent car crash claims) with shady, Saul Goodman "back of the nail salon" style offices. Then he purportedly helped a reality star pay off people.

My point, I suppose, is that normally the associates of the president would be upstanding individuals who had achieved heights. In this case, as with many of DJTs associates, it is anything but that.

gpm• 8 years ago

Signal encryption relies on a password (last I used it, which was a long time ago). Typing long random passwords in a phone is nothing if not impractical.

It wouldn't shock me to find out they just brute forced the password.

michaelchisari• 8 years ago

Or found a sticky with the password on it when they raided his office.

joemaller1• 8 years ago

Most likely scenario.

hurrrrrrrrrr2• 8 years ago

It says that they have "731 pages of encrypted data" but nowhere does it say that they managed to decrypt the data, and read the plain text.

It states that they did not disclose what was in the "encrypted data" so... there's no indication or assurance that they've managed to access the plain text.

JustSomeNobody• 8 years ago

Why on earth would those fools print it all out?

hurrrrrrrrrr2• 8 years ago

Hard copy for future reference, in case some sort of vulnerability becomes exploitable at a later date.

Also, to provide a vague, yet seemingly impressive metric, true to form for federal government employees, because it seems official to the non-technical layman.

If you were to declare a metric such as 900KB of encyphered base64, well, gee, that's like, almost nothing. But print it out, and non-expert jurors start thinking "Well, gee! 700 pages is longer than that Stephen King book that I just read!"

And anyway, they wouldn't have to print it out, to obtain a quotable metric. All they'd have to do is paste it into an evidence template, and prep it in a printable format, like a DOCX file or a PDF. Then, they can subpoena for the metadata, and at least maybe infer a relationship between entities, even if they are denied awareness of the nature of the conversations etween them.

Seriously, this is how government officials and lawyers tend to think.

davesque• 8 years ago

My reading of that was that they had 731 pages of texts, which were supposed to have been encrypted by WhatsApp or Signal, that were stored in plain text.

That's what this article appears to suggest:

https://www.bloomberg.com/news/articles/2018-06-15/prosecuto...

From paragraph 2 in the article:

Investigators have restored 16 pages of documents found in Cohen’s shredder and recovered 731 pages of messages sent on encrypted platforms, including WhatsApp and Signal.

econ_th0• 8 years ago

i cannt read i am dumb, but?

did they have his phone password or is this saying they hacked the chat softwares?

mrcactu5• 8 years ago

do people still use BlackBerry in Washington? Seems a little out of date to me...

FBI Recovers WhatsApp, Signal Data Stored on Michael Cohen’s BlackBerry

Related Stories