No, Cellebrite Cannot “Break Signal Encryption”

https://signal.org/blog/cellebrite-and-clickbait/

by hprotagonist • 6 years ago

645 239 6 years ago

signal.org

hyperion2010• 6 years ago

Ah, what a solid Mickens reference.

http://scholar.harvard.edu/files/mickens/files/thisworldofou...

hprotagonist• 6 years ago

i was very pleased to learn: he’s tenured now!

cgb223• 6 years ago

It’s shameful that one of the worlds best journalistic sources didn’t even bother to reach out to Signal to get comment on a story they ran about them

I feel like a lot of today’s mistrust of news stems from publications not verifying sources, or checking evidence, or at least scrutinizing what others are saying.

Wish we could fix that

lemoncurd2• 6 years ago

i have more faith in the onion than bbc, they are from the best newspaper

pirocks• 6 years ago

The BBC isn't a newspaper.

DaniloDias• 6 years ago

It isn’t shameful. It is yet another indicator that the journalism industry is creating the intellectual equivalent of Animal Crossing.

It’s a time waster that entertains- not a reflection of truth. How could any business be considered “the best” in its field and create such a shitty product? Simplest explanation: they are not trustworthy and never were.

Erlich_Bachman2• 6 years ago

This is not due to incompetence. This is done with the objective to influence the public opinion of cryptographic tools so that people will stop using them. The system has no way of actually breaking encryption, that's why it is focusing on the other ways to circumvent it - one of them being making most people (non-experts) believe that it doesn't work anyway so they will stop using it.

This is a focused campaign, this is not just random occurence of incompetence.

ffpip• 6 years ago

BBC article states "BBC has contacted Cellebrite and Signal for comment"

https://www.bbc.com/news/technology-55412230

judge2020• 6 years ago

How and when they contacted cellebrite/signal is important, but even when you see "refused to comment" there really isn't a timestamp for when contact was attempted/initiated. Is there a reason for this?

toby-• 6 years ago

And the original blog post by Cellebrite does claim to have 'cracked' the encryption, doesn't it? So the BBC's headline isn't exactly inaccurate.

buran77• 6 years ago

The Signal blog post says from the beginning that:

Since we weren’t actually given the opportunity to comment in that story

So it may just mean they were not given enough time to respond before publication, or even that they were contacted post-publication. In the race to front page "breaking news" the responses are expected to be published as updates to the story.

pwned1• 6 years ago

I've been on the receiving end of these calls. "This is so and so reporter from X News and we're running a story about X. Please call us back before 2pm so we can get a response."

It's 1:30pm.

andrepd3• 6 years ago

Related: the Gell-Mann effect. You read a newspaper story on a topic about which you are knowledgeable, and get mad at how wrong they've got everything. Then you turn the page and read the next story, on which you are not an expert, and take it at face value.

Matticus_Rex5• 6 years ago

In my circles this gets me into arguments all the time. Everyone reads a book, everyone but me likes it. I point out how one section I know a lot about is deeply wrong, everyone else says versions of "well other than that part it's a great book!"

I wish LW-style rationalist circles didn't attract such obnoxious people, because I don't know of any other collection of people who recognize and try to adjust for things like this.

alisonkisk2• 6 years ago

Nitpick: Its Gell-Mann amnesia, Michael Chrichton's name for Murray Gell-Mann's amnesiatic behavior, not an effect discovered or promoted by Gell-Mann.

worik• 6 years ago

"Gell-Mann effect" I had never heard of it. Looked it up. Thank you. I especially love the way it is named...

gsich• 6 years ago

Or the opposite happens.

krastanov2• 6 years ago

I like this meme, it is fun and so on, but I have to admit, it is not really a thing: I am a professional physicist and journalists at respected outlets are pretty good. NPR, PBS, NYT all do a pretty great job at science journalism. More often than not the rare complaints from professional scientists are more self-aggrandizement lacking awareness of the pedagogical constraints of popular press.

KingOfCoders2• 6 years ago

Thank you for this! This happens to me all the time, e.g. when the label planes (eg mixing f-16 and f-18) in pictures wrong. And every time I wonder what they get wrong where I'm not knowledgeable.

travmatt• 6 years ago

I’m just as concerned about: > According to one cyber-security expert, the claims sounded "believable".

One anonymous source at the topic of the article that bolsters the claim, then all the experts who were willing to attach their names to their words all temper the articles claim are towards the end of the article.

Brian_K_White6• 6 years ago

A post on the 2600 group on fb said "seems legit".

ehsankia3• 6 years ago

They couldn't even get a single named expert to comment on record?

SoSoRoCoCo4• 6 years ago

I feel like a lot of today’s mistrust of news stems from publications not verifying sources

First, a nitpick: that is a thought not a feeling: you didn't state how it made you feel, you stated an idea.

Moving on... That's not why people mistrust the media. They mistrust the media because they are told to by politicians seeking to discredit journalism and control the narrative.

NateEag4• 6 years ago

I approve of your nitpick.

I am a counterexample to your main point. I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me.

I think I've seen every media source I've followed get significant facts wrong about things I know well.

I try to fight back against Gellman amnesia in my own head.

ksdale• 6 years ago

Double nitpick: People often colloquially use "I feel like" in place of "It is my opinion that" and it doesn't even strike me as literally wrong to describe an opinion as a feeling...

And do you think this episode is evidence of trustworthiness on the part of the BBC?

I agree with you that politician sow distrust, but poorly researched pieces are the fault of no one but the journalists.

mikece2• 6 years ago

There is a thin line between modern journalism and click-bait ad farms.

will4274• 6 years ago

Additionally shameful: - they haven't printed a retraction yet - the technology reporter in question doesn't understand the tech well enough to recognize the error, even when somebody states it explicitly (https://mobile.twitter.com/janewakefield/status/134141965721...)

andrewnicolalde• 6 years ago

Hey, that's my tweet :)

__MatrixMan__• 6 years ago

I used to work at a traffic signal company. We got bad press whenever somebody "hacked" our infrastructure. It was always a super sophisticated "default password attack".

I tried to get the default password changed to unique-per-unit randomly chosen uuid, just to be so obnoxious as to convince the customer to set their own password. Encountered resistance of the "but then they'd need to be retrained" sort.

I wish I could say we didn't deserve the bad name, but we kinda did.

AnonC• 6 years ago

When I read the original blog post by Cellebrite, which is on archive.org [1], it left me scratching my head too. Signal is open source. They had access to the device to dump everything. Then they went through the source code to figure out how to decrypt the data. Just as this blog response says, they could’ve just opened the app and retrieved the contents (and even forwarded that to another device if they wanted).

So someone enthusiastically posted about wasting their time as if it was a technological achievement. Then someone (else?) realized that the long technical post sounded stupid and had it replaced.

And some people wonder where their tax money goes to — all these companies who are better at marketing themselves well as experts are getting free lunches!

[1] https://web.archive.org/web/20201210150311/https://www.celle...

javajosh2• 6 years ago

wasting their time

I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.

zenexer3• 6 years ago

anything running on your device

Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.

alisonkisk2• 6 years ago

Using an example of hacking into data that is already directly available is silly.

It would be interesting if they did that to something restricted, like a Netflix movie.

yorwba• 6 years ago

Exactly. I've so far decrypted my own messages from two different apps because I needed some specific information that would've been too hard to find without RegExp-capable search. In both cases I was glad to find guides online explaining how to pull the database, get the decryption key and decrypt the database with the key.

It may seem trivial from a security perspective since it doesn't involve breaking any cryptography, just using a decryption key as intended, but in practice the ability to get a plain-text dump of all messages is very useful.

segfaultbuserr10• 6 years ago

Cracking The Code
[...] Once the decrypted key is obtained, we needed to know how to decrypt the database. To do it, we used Signal’s open-source code and looked for any call to the database. After reviewing dozens of code classes, we finally found what we were looking for
[...] After linking the attachment files and the messages we found that the attachments are also encrypted. This time, the encryption is even harder to crack. We looked again into the shared preferences file and found a value under “pref_attachment_encrypted_secret” that has “data” and “iv” fields under it.

Today I learned that I can do code cracking too...

wnevets• 6 years ago

is the equivalent to calling oneself a lock picking expert because they had the actual key to the lock?

throwaway744678• 6 years ago

Only if you can review dozens of code classes, that is.

modriano• 6 years ago

In the usecase I'm particularly familiar with (law enforcement, specifically of violent crimes), it's pretty valuable to minimize the amount of manual data handling investigators have to do. The State's Attorneys office/US Attorneys office/Prosecutor's office have finite resources and have to be selective about the cases they decide to spend resources on. Even if the correct suspect(s) has(have) been identified and arrested, the case can be rejected if the decision-making prosecutor thinks the evidence isn't strong enough or defending the evidence will be too difficult because evidence collection was done in a nonideal way. It may be possible to forward Signal messages to another device, but A) that just adds more links in the chain that can be challenged, and B) most detectives don't know that's an option or have any idea how to do it, so you'll regularly see sloppy stuff like photos taken by the detective of a phone displaying the messages of interest.

It's just a lot easier for the investigator to just plug the phone into a Cellebrite UFED analyzer and extract as much as is covered either by their search warrant or by the signed consent form of the phone's user(s), and it's a lot easier to defend in court, as it eliminates room for accusations that investigators cherry-picked messages and data that look incriminating out of context.

TL,DR: Even if it's not an impressive feature technologically, it's still a valuable feature to some of Cellebrite's main customers.

bigiain3• 6 years ago

Having some familiarity, how often do you think " ... and extract as much as is covered either by their search warrant or by the signed consent form of the phone's user" is an accurate description of what actually happens in the field?

Does a UFED even have a way of selectively extracting only what's covered by a warrant?

Are warrants usually granted that would be considered outrageous fishing trips by the more privacy aware of us here?

TearsInTheRain• 6 years ago

Are there any real checks on government spending?

enkid• 6 years ago

I mean, law enforcement has a budget just like anyone else. They can't just make up money, unlike a national bank.

PeterisP• 6 years ago

"they could’ve just opened the app and retrieved the contents" is not really sufficient.

First, doing it manually through the app is not okay since it does not scale, you don't want to read a message, you want to retrieve and index all messages, and you might want to process many devices quickly.

Second, apps usually do not show the user all the information that's available - often there is extra metadata (which may be as important as the message contents) so you do want to decode the actual message database.

Third, doing it through the app might change things - the app may change state (for example, mark an unread message as read), send some notification to central servers, alter metadata, etc. So it potentially disrupts evidence, and that's not okay.

So the original blog post from Cellebrite makes all sense - if you do want to do forensics, then a tool that does all that is really a requirement, it's not wasting time.

aurelianito• 6 years ago

You can make a copy before opening the app.

smsm42• 6 years ago

As a forensic tool, it surely does, and such tools are both common and have their robust client base. I think the mistake in that article was to present a forensic tool as some kind of advanced code-breaking. I guess it sounds more exciting this way, but also kinda misleading - which is witnessed by the fact that BBC was totally misled about it.

contravariant• 6 years ago

Well starting a blog post by pointing out criminals are using it to communicate secretly and ending the post by concluding you can read it if you gain priviledged access to the device they're using to communicate is a bit of a let-down to be honest.

Now if they were able to break the Keystore itself then they might be on to something but as it is it requires convincing criminals to give up their phone and their password. If you translate this to a physical analogy people's reaction would be 'no shit', but because it's digital you can apparently get away with it.

woodruffw• 6 years ago

I agree that both the original post and the media coverage of this is extremely misleading.

So someone enthusiastically posted about wasting their time as if it was a technological achievement.

I think there's plenty of value and achievement in understanding a program's functionality, even when the source is fully available to you.

We all (presumably) agree that source code isn't self-documenting and that understanding someone else's work usually involves a lot of individual comprehension and context; I read this blog post as someone (diligently) describing their mental process as they tried to understand Signal's internal formats. As others have pointed out, there are oodles of "legitimate"[1] reasons for doing so.

[1]: From the perspective of LEO and the legal system, anyways.

thedanbob• 6 years ago

I agree as far as the content of the article is concerned. I think the main problem with it was its tone. I think if they had approached it the way you described, someone just going into detail about how they analyzed an unfamiliar application, it would have been fine. As written, it feels like a new programmer bragging to his friends about how he got "hello, world" to compile.

polar8• 6 years ago

all these companies who are better at marketing themselves well as experts are getting free lunches

Better than us, I presume? But unless you or I are prepared to do this work (to parse data from Signal and every other application out there), for the police, for other investigation agencies, for corporate and private investigators, for lawyers, for data protection officers etc., the vast majority of whom aren't programmers or reverse engineers, what's the problem if someone else is?

lxe• 6 years ago

"employs a proprietary open-source encryption"

A what?

e12e• 6 years ago

[Cellbrite] is not magic, it is mediocre enterprise software.

polar8• 6 years ago

Poorly written, over-priced assumptionware.

https://www.zdziarski.com/blog/?p=3717

ehsankia3• 6 years ago

The whole thing was the perfect level of angry and snarky.

erostrate• 6 years ago

Articles about this post would have been more appropriately titled “Cellebrite accidentally reveals that their technical abilities are as bankrupt as their function in the world.”

was also pretty good.

rapsey6• 6 years ago

If you have your device, Cellebrite is not your concern.

But if the attacker has a 0day, which likely all the big players do, they don't need your physical device. Which means signal will do squat to protect your data in that case.

edm0nd2• 6 years ago

All nation-state governments are just buying 0days from companies like NSO Group and Zerodium.

The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device.

I think Signal is pretty safe from such things. Better than for example Whatsapp. Which seems to be where a majority of these nation-states using their 0days and exploits on.

rapsey6• 6 years ago

All nation-state governments are just buying 0days from companies like NSO Group and Zerodium.

USA/Russia/Israel for sure have these programs.

The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device.

You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+.

This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person.

I think Signal is pretty safe from such things.

You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.

pkulak3• 6 years ago

Unless you use disappearing messages and view-once media messages like mentioned in the linked post.

roywiggins3• 6 years ago

Those features help against Cellebrite but not against actual 0days which can read incoming messages in real-time. If the NSO has a rootkit installed on your phone, it doesn't matter that Signal is shredding messages after you read them.

richardlblair2• 6 years ago

Yes, this is true for literally anything. All you just said is "If your device is compromised your device is compromised". That's not profound.

rapsey6• 6 years ago

It is when the vast majority of users relying on Signal security, sometimes with their lives, do not know that fact.

croes• 6 years ago

If anyone has access to your device, your data can't be protected, don't matter if physical or remote access. The attacker could simply log all your passwords, so there is nothing signal nor any other software could to.

londons_explore• 6 years ago

And more importantly, any software which claims to have "antimalware" or "anti-rootkit" or similar techniques is snake oil...

Above using the platforms secure storage for secrets, there is nothing more an app should do.

Brian_K_White6• 6 years ago

This isn't a useful observation.

A communication has many links in a chain.

Some links in most chains will have some weakness or other. So what?

That does not mean that there is no value in the strong links.

You might as well say "But if the attacker has a sniper, which likely all the big players do, they don't need to read you communications to get you, they can just shoot you from across the street. Which means Signal will do squat to protect your life in that case."

rapsey6• 6 years ago

It is a useful observation when the vast majority of users using Signal do not realize this.

pkulak3• 6 years ago

Using only the homeowner's house key and extensive key-sliding-into-lock reverse-engineering, I'm able to break into their home. Whitepaper coming soon.

edm0nd2• 6 years ago

This is the LockPickingLawyer here and today I'm going to read this whitepaper by pkulak

pkulak3• 6 years ago

Click out of one...

scrps2• 6 years ago

Don't forget a snappy and memorable name (suggestions: Lock0ut, KeyMast3r, Tumbld) and the requisite domain name to accompany it.

segfaultbuserr10• 6 years ago

Tumbld

should be Tum61d.

h_anna_h3• 6 years ago

the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false

The headline is actually true. Cellebrite did claim that after all. Whether or not it Cellebrite is lying is another story. Although it was pathetic of them to not reach out of Moxie. It only shows the quality of the mainstream media.

kortex2• 6 years ago

That doesn't absolve BBC of spreading misinformation, which is what they are doing. It takes near zero effort to make a dubious claim on a blog. If BBC then writes, "kortex claimed to have hacked the NSA", that's accurate, I did make a wild claim. It's also misinformation if that headline is published without any investigation as to if that claim has any weight beyond internet rambling.

"You can't put anything on the internet that isn't true"

"Where'd you read that?"

"Internet"

h_anna_h3• 6 years ago

Sure? I never said otherwise.

everfree• 6 years ago

They did? Signal seems to claim otherwise. From the linked Signal post:

Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.

1cvmask2• 6 years ago

Moxie of Signal has a great hilarious presentation on SSL at Def Con 19:

https://www.youtube.com/watch?v=UawS3_iuHoA

segfaultbuserr10• 6 years ago

Thanks for the link. Moxie's talk is better all the talkshows I've seen, absolutely hilarious, how could I miss this one before...

1cvmask2• 6 years ago

Here is another great one where he ties American action movies as narrative with secure communications:

https://www.youtube.com/watch?v=tOMiAeRwpPA

tialaramex3• 6 years ago

That is a fun presentation, although the title is misleading because it's 99% about the Web PKI which is orthogonal to SSL (and TLS). TLS doesn't care at all why you trust these certificates, if you want to trust certificates so long as the public key contains the decimal digits 42069 that's fine.

Even PKIX (the IETF's profile for X.509 on the Internet) is orthogonal to TLS as designed, although in practice you're creating a world of pain for yourself if you decide you do want TLS but you don't want PKIX since the two have grown next to each other for decades.

Anyway, almost all of Moxie's talk is about the Certificate Authorities in the Web PKI, and not about SSL/TLS per se at all. It's about his attempt (Convergence) at multi-perspective peer validation for authenticity to eventually replace Certificate Authorities. Could that have worked? Maybe, sort of. It never went anywhere much.

Of course in hindsight we can't blame Moxie for not guessing what will happen next - I expect few if any of us spent last Xmas thinking "Better enjoy this, next Xmas will be a totally different ball game because of a pandemic virus" either.

Imnimo2• 6 years ago

Signal says:

Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.

But the original Cellebrite post says:

Decrypting messages and attachments sent with Signal has been all but impossible…until now.

and

This time, the encryption is even harder to crack.

It's just that Cellebrite's claim is totally baseless and what they're actually doing is not "breaking" or "cracking" anything. The BBC article should have been more critical of Cellebrite's language, but I don't agree with Signal that their headline was "false".

coldcode• 6 years ago

They automated taking pictures of app content on an unlocked Android phone, and bragged about it as a breakthrough tech, then deleted the article and replaced it with fluff. Embarrassing.

Imnimo2• 6 years ago

Right, Cellebrite's clearly way off base here. But the BBC's headline seems to accurately describe their wild claims.

polar8• 6 years ago

automated taking pictures of app content

There's a world of difference between taking screenshots of an application and extracting messages and metadata from a database. I should imagine that Cellebrite's audience of corporate and law enforcement investigators would be very keen on getting access to this breakthrough. OTOH, Cellebrite's competitors have been able to do that for a while!

smurf_t• 6 years ago

BBC, you failed us here.

olodus• 6 years ago

If Cellebrite thought they had broken the signal encryption - why did they release it in a simple blog post? As responsible people in the sec community shouldn't they tell this to the Signal devs first so that they could review it and fix it if possible/needed? Or is that just something real security researchers are required to do and not something companies feel themselves bound to in any way?

raziel2p• 6 years ago

Probably just the company wanting to push out some engineering blog content, and very unfortunate phrasing in the blogpost itself. If they'd framed it as "let's learn how Signal's encryption works" there would not have been any issue.

saagarjha• 6 years ago

Cellebrite isn't a responsible security research company; they sell tools to the government to break into devices using security vulnerabilities.

upofadown4• 6 years ago

I suppose that the BBC article title could be considered to be correct in a narrow sense. Cellebrite makes products that can, in some cases, unlock phones. Signal Messenger depends on the phone OS to protect the key used to encrypt the saved data. So in some cases Cellebrite does have the power to break the saved data encryption.

The Signal case is interesting because the app used to have a feature where you could protect the data with a separate strong passphrase. That would of prevented this particular attack. For reasons that are not clear to me, Signal eliminated this feature.

tw25520481• 6 years ago

So in some cases Cellebrite does have the power to break the saved data encryption.

IIUC, in those cases they could instead just open the Signal app.

upofadown4• 6 years ago

But you would never want to do something like that if you were looking for evidence you might want to present at a trial.

mechnesium3• 6 years ago

Friendly reminder that reproducible F-Droid builds of Signal are still rejected for weak reasons [1]. You must trust the Signal binaries on popular app stores [2][3].

Don’t worry though; the Signal devs assure you that signed Android binaries from their website are reproducible [4]. As if checksum collisions aren’t something that state actors could trivially create [5].

I don’t trust Signal.

[1] https://github.com/signalapp/Signal-Android/wiki/F-Droid

[2] https://play.google.com/store/apps/details?id=org.thoughtcri...

[3] https://apps.apple.com/us/app/signal-private-messenger/id874...

[4] https://signal.org/blog/reproducible-android/

[5] https://shattered.io/

gruez2• 6 years ago

As if checksum collisions aren’t something that state actors could trivially create [5].
[5] https://shattered.io/

Collision attacks are an issue when using md5/sha1, but I don't see how it's relevant in this case. If state actors wants to replace the signal apk with a backdoored one, they'll need to pull off a preimage attack, not a collision attack. A collision attack wouldn't be useful because you still need the original publisher to sign the apk for you, which seems unlikely considering OWS isn't a CA or anything. If OWS was compromised by state actors into signing, then they can just sign the backdoored version directly, no need for a collision attack.

mechnesium3• 6 years ago

Thanks for pointing out collision vs. preimage. Interesting distinction.

h_anna_h3• 6 years ago

I presume that the idea is that the compiled binary from the source and that the binary distributed by signal would be different but have the same sha1s. It does not make a lot of sense though because one could simply use another algorithm.

NikolaeVarius• 6 years ago

Yes, the collided MD5 that looks like gibberish because a phone would have no clue wtf to do with a ranom blob of data?

j-james• 6 years ago

Signal's reasons for not wanting to maintain an F-Droid repository are terrible, but that doesn't in any way compromise their security. As others have pointed out, reproducibility goes farther than just checksums.

hjek• 6 years ago

You must trust the Signal binaries on popular app stores.

Or you can just run Signal Desktop exclusively without the hassle of smartphones[0]. Audio / video calls recently landed in Signal Desktop too[1].

[0] https://ctrl.alt.coop/en/post/signal-without-a-smartphone/

[1] https://signal.org/blog/desktop-calling-beta/

cyphar• 6 years ago

You can download the APK from their site[1] and have been able to for several years, that's how I install it on my devices (and it does autoupdates).

As for hash collisions, as far as we know SHA256 hasn't been broken yet and even if it were broken you would need to be able to create a valid APK with Signal's code and the backdoor which hashes to the same thing as Signal.

[1] https://signal.org/android/apk/

mikece2• 6 years ago

While Signal's encryption is good, I don't like that (1) you have to have a phone number to register, (2) it asks for access to your contacts on your phone (3) you have to install the app on a computer rather than being able to just use it through a browser. For these reasons I prefer Wire... and you can log into three accounts at once on the free tier.

angry_octet2• 6 years ago

Re your points:

- (1) They are working on this, but it serves to limit spam, and it is easily comprehensible by the non technical.

- (2) You don't have to give it access, it works either way. If does its best to only use this for finding which of your contacts use Signal, rather than uploading the full address book.

- (3) client side crypto is supplied by the server, which fundamentally is a big problem for a system like Signal. Until web crypto is not a dumpster fire you can't do better. (I personally think allowing the Electron app is a huge mistake but it's their call.)

dylan604• 6 years ago

I found the original setup requiring a phone number off putting as well. However, I'm not sure how much it is used. In my case, I had a phone number that was used to set up signal. It was my number at the time. I now have a new number, yet there is no within Signal to update that number. It still shows the old number in my settings. ???? Signal still works just fine for me and all of my contacts

kvothe_• 6 years ago

Whoever wrote the article for Signal should be writing bars in rap songs. Such a great article. I was laughing the whole way through. The author manages to poke fun of Cellebrite and plug Signal.

1vuio0pswjnm7• 6 years ago

"2. Cellebrite is not magic. Imagine that someone is physically holding your device, with the screen unlocked, in their hands. If they wanted to create a record of what's on your device right then, they could simply open each app on your device and take screenshots of what's there."

Under the laws of many countries, that "record" alone would likely be inadmissible. Cellebrite's market is authorities who seize computers and then must follow forensics protocols for extracting digital evidence. It is not someone holding your device in their hands, opening up each app and taking screenshots.

Justsignedup• 6 years ago

Any time any encryption breaking has the words "well, if we can retrieve the decryption key from the phone" and doesn't back that up with a mechanism by which this is feasible, this isn't an encryption breaking as much as it is "if i had an already decrypted device, then man can i do cool stuff for you!"

elago• 6 years ago

More clarification on the topic would be nice. When I open the Signal app right now, I am nagged to "Create a PIN. PINs keep information that's stored with Signal encrypted. Remind Me Later / Create PIN".

Would be interesting to know if an app specific PIN resists cellebrite analysis. Screen unlocked, Signal PIN enabled.

pavon• 6 years ago

No Signal does not ask you for your PIN to access your messages. It is required to transfer your account to a new device, if you don't have access to the old one.

ianopolous3• 6 years ago

There is something which Signal could do to help even in this scenario. Give the user a logout option which leaves nothing but ciphertext on the device (e.g. by encrypting any plaintext keys with the passphrase). To login again you need a passphrase. Then as long as the user has enough time to click logout they are safe even when the device is out of their hands. Of course, after that, it might be prudent to consider the device compromised, and thus not login again afterwards in case it has been backdoored.

ben7799• 6 years ago

Exactly.. it would also be possible to design an app that never persists any messages or other information on the phone.. though at that point the whole thing is just a shell over a website.

There were applications that worked that way before mobile phones and the web.

upofadown4• 6 years ago

The Signal app used to have an option to protect the critical data with a strong passphrase but that option was removed.

The developers might of considered that the real threat was a remote access trojan that would just keysniff the passphrase. I guess the Cellebrite thing is a reminder that there are other threats. As it is you are pretty much lost if someone is willing to snatch the phone from your hand while you are looking at cat pictures on the web. Phones really need more than one level of "unlocked".

ianopolous3• 6 years ago

The real use case for this kind of cryptographic logout is travelling through airports. That is a very common situation.

mr_toad• 6 years ago

the real threat was a remote access trojan

The real threat for most people is forgetting the password.

angry_octet2• 6 years ago

Signal can at least have timeouts for requiring re-auth (typically biometric).

The isolation concept can indeed apply to more than just functional separation, including separation in time, or in search depth (number of records returned) or by classification. It would be quite simple -- require auth to scan backwards more than an hour. Or 'press and hold to mark message as sensitive|expiring'. And possibly require a passphrase to access those sensitive messages / threads.

I've applied these techniques for database systems where NTK (need to know) rules apply, to force queries to be narrowly scoped. Likewise system backups don't all need to be online (or in the tape robot), most restores are from the most recent backup.

kortilla• 6 years ago

The annoying part is how effective this is for marketing Cellebrite. The types of people that use Cellebrite will never understand the nuance here.

polar8• 6 years ago

The types of people that use Cellebrite will never understand the nuance here.

Au contraire, I would imagine a law enforcement or corporate investigator would knows the difference between encryption in transit and encryption at endpoints, and therefore be in the market for what Cellebrite has achieved (if they aren't using a competitor[1] already).

[1] https://blog.oxygen-forensic.com/115-2/

modraino• 6 years ago

It is true that Cellebrite blog post looks like an amateur work. However, an important context is missing from signal' blog post:

Cellebrite specializes in breaking and extracting data from encrypted partitions, and (this is the important part) extracting keys from the secure keystore (Qualcomm/exynos).

From Cellebrite point of view, the data and keystore are already "given", all the remains is "breaking" the app encryption scheme, which in signal's case is trivial.

Throwaway17714• 6 years ago

What other security oriented apps have their own encryption scheme, independent of device system security?

jeffrallen• 6 years ago

Read this blog post to the last sentence, your patience will be rewarded with the mother of all digs.

nelsonenzo• 6 years ago

I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed and marketing was happy to have some engineering thing to blog.

to me what is embarrassing is that all of these major news outlets and professional journalists could not actually read the article and do some very basic research before blasting out to the public. It just really shows how low the bar is to get something published. I could blow my nose on YouTube and make stock picks based on where the bugger lands and I wouldn't be surprised if BBC Business picks up the breaking story. That's how low the bar is it seems. Sad.

PragmaticPulp• 6 years ago

I'm guessing some overzelouse 20 year old at cellebrite "hacked" signal and wrote a silly blog post that no one at the company reviewed

More likely the opposite: Some engineer was tasked with adding Signal database handling, marketing got wind of it, and they went to town on blog posts and PR pieces about it.

Really though, they don't care that it's technically wrong. The target audience for this stuff isn't other engineers or technical people. It's their potential customers, who don't know the difference.

polar8• 6 years ago

It's their potential customers, who don't know the difference.

Their potential customers (forensic examiners not just in law enforcement, but also corporate investigators, incident response etc.) do know the difference. Being able to get data from the endpoint is exactly what they are after, because the alternative is that some poorly paid soul has to sit and photograph thousands of pages in numerous applications. Having access to the database saves time, reduces interaction with the exhibit and gets metadata which isn't shown on the phone.

ehsankia3• 6 years ago

Right, some private company posting a misleading blog post is one thing, hell, even small news blogs posting about it, I could understand. But a large news organization such as the BBC not even bothering to contact Signal to get a statement or their side of the story? What the hell... Someone should get fired over this.

exikyut• 6 years ago

Ever since I learned Facebook greenlit "Signal is awesome, were using it" I've been trying to headscratch why. Then I realised WhatsApp had kicked the whole thing off years ago and got even more confused. Why do you want to encrypt everything??? It makes your life harder. It makes cooperating with law enforcement harder. It means legitimate users can't recover their messages. It means you can't do fun things with analytics, which is extremely contentious but concedably valuable. So, why??

I think I've figured it out. A tiny little bit of it, anyway.

Imagine you're a multi-million (okay, multi-billion) dollar communications company. You're WhatsApp. Apple (iMessage). Facebook. Google (RCS).

You store trillions of messages.

In those trillions of messages, you are going to have the statistical >100.00% guarantee that there are chats and conversations between individuals and groups that would launch World Wars 4 through 16 if certain other individuals, groups, governments and so forth were to learn/verify that A did really say <thing> to B. The nuclear launch codes don't fit in a football anymore.

I have no hope of ever confirming the validity of that Bloomberg article about the alleged Supermicro hack. But it seems "well duh" simple enough to be concerningly plausible (custom silicon packaged in WLCSP or SC70, bit-twiddling SPI? Too easy... :S). As a technically-flawless plausibility, I say it can serve as a concrete reference example of a fraction of the persistent, sweeping, ruthless, and terrifying scale of the super-industrial, Eye Of Sauron-style attacks that these companies have very obviously been facing for some time now.

So, my possibly-not-really-a-conspiracy-theory-since-the-pieces-come-together-without-fantastic-levels-of-extrapolation theory is, someone stumbled on an idea one day, maybe in a stuffy committee meeting, or maybe in a bar, to solve the problem by giving the people what they wanted... end-to-end encrypt everything... and go from encryption at rest, which is basically nothing, to encryption everywhere; and you instantaneously divest the massive, massive burden of owning all that readable data.

True, now "accidentally" forgetting the `s` in backend URLs doesn't let the NSA read everything anymore, but that kind of pales in comparison to being able to incontrovertibly, mathematically prove that, since the data really is encrypted before it leaves the device, there really is no chance any readable plaintext is leaking and potentially being stored; so if the nation states would kindly take stock of this situation and point the coherence death ray beams elsewhere that would be great since we are kind of on fire here at the moment and it's too hOT we are meLTING--

Getting this to catch on was obviously difficult. Anybody that can scare multi-billion dollar companies obviously has the skill to steer collective opinion and impression at scale. Whoever came up with the idea to piggyback on top of individual privacy is... a task-focused genius, I'll put it that way. On the one hand, the idea has scaled beautifully: all the tech folks have gone "Is private. Respects freedom. Og like." and loudly pushed for the idea everywhere they can. And from a sociopolitical perspective, the narrative is faultless and blameless, which is where the genius definitely shines through.

The first bit I can't say I like is the narrative appearance of first-class support for end-to-end encryption as a Scientific Advancement™. It's not. It's an implementationally-scoped, crowd control spin campaign to increase datacenter security beyond what disk encryption at rest can ever achieve. The scale of wreckage in the form of technically minded people who really believe the privacy narrative is disillusioning to see.

The other bit that I find unamusing is the long-term shifts in the attack landscape that will result from this. Specifically the fact that, an Eye Of Sauron style adversary is not ultimately going to care what their attack target is, or how to attack it, only that it gets vaporised. End-to-end encryption shifts the burden of responsibility to the owner of the server to the owner of the client. I can see the positive angle here from a think-tank standpoint - literal decentralization as a defence strategy - but still, Android/iOS are now the focus of some laser beams that were terrifying a bunch of rather large companies. Maybe it'll seem reasonable to heavily fund the vulnerability research scene to maintain a favorable status quo, and we'll see some impressive hacks going forward (or, er, we won't). Or maybe things are already "that bad" and I don't have anything to worry about. But considering that users are now that much more responsible for devices that are interesting in a way they were never before, this whole strategy kinda feels irresponsible to me if you squint at it from a certain angle. At the same time, it might ironically be ensuring our survival.

In this picture, law enforcement really is the afterthought. It's well known the law court system doesn't understand technology and is 20 (40? 50?) years in the past. That situation extends beyond the courts though, with law enforcement generally in the same position. But it's worse than it may at first seem, because the notion of "the past" that refer to a collective public interpretation of "now" doesn't do justice to the technological development that has happened at these companies over the last 5-10 years - these private companies are internally fighting battles of a complexity that the public law enforcement system cannot hope to comprehend, let alone help with.

In this fight, the best way to avoid World War 4 is to encrypt everything. But Washington is still getting over how cool they handled the Cold War, and the police still think it's "hard" and "complicated" and "special" to "hack phones".

radoslawc• 6 years ago

If reason for that blog post was to get famous. Well I'd day mission accomplished. I haven't heard about Cellebrite before.

Throwaway17714• 6 years ago

Infamous.

scrps2• 6 years ago

I've made it even easier for Cellebrite...

Have access to unlocked phone?: yes

Enabled signal backup?: yes

Copied key to decrypt backup?: yes

Downloaded Xeals signal backup decryptor from github[1]?: yes

Decrypted backup?: yes

Contacted BBC to inform them you "cracked" signal's encryption?: check

Profit

[1] https://github.com/xeals/signal-back

tempfs• 6 years ago

This whole thing was just BBC clickbait and Cellebrite advertising to the idiots in law enforcement.

No one that actually knows even a tiny bit about how shit works believed the story for even a moment.

el_dev_hell• 6 years ago

From the original blog post:

After getting the decryption key, we now needed to know what decryption algorithm to use. We went back to Signal’s open-source code and found this:
Seeing that told us that Signal uses AES encryption in CTR mode. We used our decryption key with the AES encryption in CTR mode and decrypted the attachment files.

Was this supposed to be satire?

aemreunal• 6 years ago

In the undying words of Bender from Futurama:

    Oh wait, you're serious. Let me laugh even harder

https://www.youtube.com/watch?v=_n5E7feJHw0

methodsignature• 6 years ago

Signal seems a bit of a jerk company. They should have "stayed above the fray". Instead, they ridiculed. They were in their rights to do so but should have been the better. Throwing insults, however well grounded, is never good for a brand and shows a lack of level-headedness. They could have simple stated the story is a non-story and stated why. This could have been paired with working with the BBC to get a retraction in place, taught someone at BBC something, and maybe even gotten a little free positive PR from them in the process.

OJFord• 6 years ago

No, I Cannot Take This Case Seriously.

No, Cellebrite Cannot “Break Signal Encryption”

Related Stories