Trump shooter used Android phone from Samsung; cracked by Cellebrite in 40 min

https://9to5mac.com/2024/07/18/trump-shooter-android-phone-cellebrite/

by miles • 2 years ago

86 47 2 years ago

jrockway• 2 years ago

That's interesting. Back when I used Android a decade ago I thought you had to enter a passcode for LUKS or something, to decrypt all the user data. Maybe I am misremembering?

151552• 2 years ago

This is a company whose entire business model is derived from hoarding vulnerabilities.

I'm guessing this was a brute force attack or side channel attack of some kind, in concert with a packaged zero-day.

throwawayokwud• 2 years ago

From a tour I got in a forensics lab a while back, injecting a bootloader to bruteforce PINs was one of the options available at least. Had rows of phones punching numbers just waiting for the screen to turn green

hereme888• 2 years ago

So the TLDR is that a beta version of Cellbrite unlocked the phone, and it can't yet unlock iOS 17.x or later.

But we don't know what version of Android his phone had, or what "newer Samsung model" means.

There's nothing surprising about state actors being able to quickly unlock the phone of a [failed] presidential assassin.

tantalor• 2 years ago

No, we expect phone locking to work, even against state actors. The news here is that some Samsung model has an otherwise unknown exploit.

If they can crack his phone they can crack your phone.

tivert• 2 years ago

No, we expect phone locking to work, even against state actors

But that's an unreasonable expectation because software is universally such garbage. Some is just less garbage than others.

State actors have the resources to find the holes in anything that isn't utterly perfect.

jeroenhd2• 2 years ago

If they can crack his phone they can crack your phone.

And not just them, anyone with access (legal or otherwise) to these tools can.

np-2• 2 years ago

It’s a bit of a futile strategy though, kind of like trying to build a wall thick enough that a state actor can’t bust through. That is impossible because the state has access to nuclear weapons, gigantic drills, thousands of intelligent people whose sole mission in life is to break down that wall, nearly infinite budget, etc.

The only strategy that might work is to make it expensive or unviable to crack every single device. But in the case of something like this, an assassination attempt, then it’s a given that all stops are going to be pulled to crack it.

SEJeff• 2 years ago

I suspected that they used Cellebrite for this three days ago:

https://x.com/SEJeff/status/1813079033430876433

As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN.

Also, do not enable the biometrics such as FaceID. I'm very much of this opinion[1] that biometrics are usernames, not passwords.

[1] https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

dmix• 2 years ago

And turn your phone power off before committing a crime…

The first thing the police will do is connect it to power battery packs

millzlane• 2 years ago

Don't even bring your phone with you. You need to use old school methods to avoid tracking.

JKCalhoun2• 2 years ago

Numeric pin? Seems like fingerprints on the glass alone would make a shorter numeric pin trivial to crack.

I'm just thinking of all the other weak security systems like garage door keypads where the code is derived from the more worn buttons. Or cleaning/dusting an ATM keypad before someone enters their code and then carefully examining the buttons afterwards.

But who knows — perhaps people have completely munged up their displays making fingerprinting useless.

byproxy• 2 years ago

There are some touchscreen input systems that will randomize the configuration of the numbers displayed to mitigate the "finger smudge" attack.

askonomm2• 2 years ago

Would the ATM thing actually work though? Afaik most European ATM banks issue 4 digit pin codes and will block and eat the card at 3 invalid tries. Not sure how many tries you have total, but I figure it's not that easy to guess it right.

Update: ChatGPT says 12 tries total to get it right, so that makes it ~10% success ratio?

Zak2• 2 years ago

Also, do not enable the biometrics such as FaceID

I'd really like to see the ability to set a specific fingerprint to lock down the phone, requiring a different, more secure credential from the regular lockscreen to unlock. A long passphrase would probably be the right credential for most people.

doublepg23• 2 years ago

If you hold power and a volume key on an iPhone will disable biometrics and require your password.

eviks• 2 years ago

I'd like to have different fingers do different things, including one that prevents fingers from working And have a short extra custom gesture to face to unlock Or a dozen of other simple things we could get with a little more competition in a more open space

officeplant• 2 years ago

I'm not sure FaceID would have helped them as much in this instance going by pictures of the aftermath.

sholladay• 2 years ago

In addition to the problems you mentioned, biometric systems are basically designed to cause hash collisions. And probably to a higher degree than most people realize.

After all, it would be annoying if FaceID failed just because I haven’t shaved today. So the algorithm has to account for that. As such, the entropy of the input is reduced.

jjav• 2 years ago

As much as it makes folks reel, this is working as intended. If you don't want them to crack your phones, consider setting a 10+ digit alphanumeric passcode instead of a numeric PIN.

Can't emphasize this enough. If you're going to use a phone, set a long strong password. Nothing else will do. Yes, it's a bit more inconvenient. There is no workaround.

nope1000• 2 years ago

Maybe a morbid question but could they theoretically unlock the phone with the fingerprint of his corpse or do those sensors require current (like a touchscreen does)? I'm asking because I heard in the US law enforcement can force you to unlock your device with biometrics but I wonder if that only works if the subject is alive.

delecti• 2 years ago

Seems the answer is yes, but only if you do the unlock very quickly after death. The reason seems to be what you suspected, that the fingerprint sensors require capacitance which is only maintained while we're alive.

https://www.livescience.com/62393-dead-fingerprint-unlock-ph...

spywaregorilla2• 2 years ago

Surely we can juice up a dead thumb to make it work, though, right?

neutered_knot• 2 years ago

It depends on the sensor and probably the state of the subject. This is called "liveness detection" and there is an article I found explianing the basics at: https://www.thalesgroup.com/en/markets/digital-identity-and-...

swader999• 2 years ago

Yes they can unlock android with a deceased owners finger if the login is setup for it and phone isn't restarted.

jeroenhd2• 2 years ago

I can't find who's the source on this. The best I can find is "people familiar with the investigation", but both the FBI and Cellebrite refused to comment on the story. This article quotes Bloomberg, which seems to be a copy of the Washington Post's article without all of the fluff.

I'm not surprised, there was a recent report that showed that Cellebrite can unlock any phone except for recent iOS and GrapheneOS. I'm just confused who "the people" that are being quoted everywhere are supposed to be.

kevinmchugh• 2 years ago

It's an anonymous source. Someone who knows something and isn't supposed to say it, so figure someone at the FBI or Cellebrite most likely. Anonymous sourcing is a fraught practice, but often a necessary one if a journalist doesn't want to be restricted by what an organization will officially allow. You have to evaluate the publication, the journalist, and whatever details are available to decide if you want to trust them.

The better publications will have policies on when anonymous sources can be used and may have those policies or an explainer of same available to readers. Eg here's Wapo's write-up on it: https://www.washingtonpost.com/policies-and-standards/#sourc...

adolph• 2 years ago

Its a claim that won't be confirmed and even if verified might be a lie to hide some better tech or just inane CYA. As an example, there is still nonpublic Kennedy material. Why would this event be any different?

instagib• 2 years ago

https://www.404media.co/leaked-docs-show-what-phones-cellebr...

They have a few charts listed. There’s still the several other companies with support documents that haven’t leaked.

rc_mob• 2 years ago

Am I the only one who has nothing important on my phone and also don't lock it at all.

Can't even get emails on my phone. I can however post comments on hacker news. FBI can have this comment for its data.

trallnag• 2 years ago

Then why do you have a phone?

OutOfHere• 2 years ago

Some basic phone security practices:

1. Set a sufficiently strong alphanumeric password for your lock screen.

2. Remember to reboot your phone weekly to reset any non-root malware.

3. Disable multimedia in the SMS messaging app as it's a vector for Pegasus style malware.

4. If using Signal, go to Settings, Privacy, Phone number, and set everything to Nobody. This again blocks messages from unknown users that could be a vector for Pegasus style malware.

I wish there was a system-wide permission to audit and/or disable screenshots, but there isn't.

Trump shooter used Android phone from Samsung; cracked by Cellebrite in 40 min

Related Stories