FBI Recovers WhatsApp, Signal Data Stored on Michael Cohen’s BlackBerry | Hacker News Reader

FBI Recovers WhatsApp, Signal Data Stored on Michael Cohen’s BlackBerry

arstechnica.com

211 pointsmikece128 comments

Damn, you'd think that someone at that level would pay for better OPSEC support. But then, I guess that I'm not surprised. Blackberry does have a reputation, not at all deserved at this point. I'm pretty sure that the President's phone is just as poorly secured. Probably less, from what I've read.

... especially after the BB leadership bragged about helping law enforcement backdoor into things...

Just a question. Who would they pay? I know a few people I might pay for that but only incidentally & I’ve worked in tech. for 20 years.

Where would an average though maybe high priced attorney go to get advice other than “use signal & WhatsApp” if they knew they needed protection from a federal investigation?

Probably at least 20% of HN users, no?

Edit: So are y'all dumping on me because my 20% estimate is too high, or too low?

Okay so your answer is...

There are many security researchers who could do that.

Even I know the basic issues to address, even if I don't know all of the implementation specifics.

Name one company you could call up and ask “hey I’m doing some dirt that might get me inestigated by the feds, can you secure my comms?” And they’d say yes.

Now name one that an average attorney could find.

I’m not picking on you, I’m serious. I have a couple of people I might ask, but if expect most of them to say “no thanks”

>>Name one company you could call up and ask “hey I’m doing some dirt that might get me inestigated by the feds, can you secure my comms?” And they’d say yes.

No, "I'm doing sensitive work for a huge company and we fear that hackers are trying to penetrate our network and devices." How many would say yes now? Until the raid he was a big shot...and the personal "lawyer" to Trump.

I suppose we are now very much into personal bias.

Mine suggests that until very recently working as a personal lawyer for a reality star & planning for the “normal” security concerns therein wouldn’t be something high end firms would do (nor things lawyers would ask for) as a matter of course.

Remember by the time the feds come knocking it’s too late.

Leave bias aside for a second: Trump (before election) is a high profile person, he does have a huge business with hundreds /thousands of employees and is worth at least billions. To want security is not just normal but a super smart move. If they pay, why wouldn't the top OPSEC companies tell them how to secure their devices?

(Reading might do 99% of work though)

Or paying someone who's knowledgeable to read, and advise.

The billions number has always been in dispute, but I’m not suggesting he couldn’t pay some hypothetical person. I’m suggesting his roladex doesn’t have a specific person to call to do this & without this how do you get it done?

I disagree with the assertion that reading gets the job done. He was using signal. He read something about encrypted messaging.

When the feds came calling it wasn’t enough. You need highly specialized skills.

The billions number has always been in dispute

He's a braggart and not a great businessman considering the head-start he had, IMO, but that is irrelevant. Whether he has $3 billion or $10 Billion, he's still super rich, private jet rich for life. Even his children can sit by a beach house or two and live like kings for the rest of their lives.

>>I disagree with the assertion that reading gets the job done. He was using signal. He read something about encrypted messaging.

Signal message: "Joe, I'm sending a message so open Whatsapp and let me know when you're online...."

"OK, time to kill Jimmy. The rest of the money will be there tomorrow."

Delete it after it's read and...

OK, his client was a reality star. But now he's working for a controversial president. Who's under investigation by various agencies, probably including rogue elements of the NSA.

So is it any surprise that he'd be targeted?

If there aren't security firms that handle stuff like that, isn't that quite the market opportunity? From what I know, one would start with an iPhone. And then tweak for known fails. Buy the various hacking services/systems, and test against them. Not cheap, I know. And not easily doable without connections. But hey, better safe than sorry.

Feel of them, just don't say your hiding from the feds.....http://mobile.abc.net.au/news/2018-03-16/afp-seize-phones-as...

There was literally a company dedicated to exactly that got busted for exactly that. I am honestly too lazy to provide a reference on this Saturday morning, but you could have contacted them with: "hey I need secure communication about large quantities of cocaine/mdma/meth smuggling, what do you have that can help with that"

Numerous people in that company outright went on the lamb. This happened extremely recently and the sinola cartel and Australian biker gangs were among their clients.

It was covered on risky.biz podcast

Edit: the Canadians actually did ask them about secure communication for cocaine smuggling

Well the Russians are pretty good with computers. I mention this only half-facetiously.

I'm probably able to give this kind of advice myself but I certainly know a few C-levels at public companies listed on Eurostoxx 50 that don't have the proper digital practices

I have more than a couple times witnessed and thought "are you actually exchanging highly sensitive information with your board while using an open wifi in the same room as 5 of your direct competitiors, their staff and 1k random guys like me?"

They can ask legal or IT but either way it will end up being a project relegated on a larger roadmap and will not be properly implemented in a timely manner.

I guess what I'm looking for is a piece written by a reputable source (from their POV) such as Bloomberg or the WSJ. Any ideas?

> Damn, you'd think that someone at that level would pay for better OPSEC support.

Cohen (and the whole Trump circle) went from operating at one level to a much higher level fairly quickly.

Also, there's a “you don't know what it is that you don't know” issue involved.

This issue is huge in politics. The entire Clinton personal e-mail scandal was essentially her unwilling to give up her BlackBerry, something Obama was unwilling to give up too. These people learned how to use some technology decades ago, and will continue using it no matter what other issues it causes.

Fwiw - Obama didn't use an off-the-shelf blackberry; he used one that was modified such that it complied w/ with government security standards.

http://money.cnn.com/2014/05/22/technology/security/nsa-obam...

Check your timelines. Obama was elected in 2008, and BlackBerry was the dominant player in the market at that point.

Also, he DID swap out his phone for a secured one, and his staff instituted a number of security protocols to keep it secure.

As an aside: wow that timeline makes me feel really old

Yeah, I had the same reaction. This sort of stuff makes me _feel old_. But I'm not actually "old," so what gives?

That's the trap, and Seneca wrote some compelling stuff about recognizing the trap and avoiding it. It is aptly titled "On the Shortness of Life"...

Thanks for that. I had come across some of Seneca's writing before, while researching / reading about Stoicism, but hadn't come across this specific text, that I recall.

How about the part where we're further away from Win7 in time, than Win7 was from WinXP? It'll be 10 years since Win7 RTM next year!

A dominant player, yet Obama needed a special highly modified version to securely access the White House network. A huge amount of work to keep using what he was comfortable with.

Was there another smartphone platform he could have used at the time that would have been less work to secure? A secure smartphone for the President seems well worth the effort.

BlackBerry was probably the closest, and I expect they already knew what modifications to make.

I don't know what their preferred phone was at the time, but they were unwilling to go through the same effort for the Secretary of State, instead offering her a choice of non-BlackBerry phones.

Which is absurd, a SOS is mobile far more than a President by nature.

I think the importance of this cannot be understated. The Secretary of State is a nexus of not only extremely sensitive information, but of extremely sensitive information in motion which is also in overseas locations more often than not. If I were into tradecraft, I'd be much more likely to target the Secretary of State than the President for access to (relevant, valuable) sensitive information.

This is likely because his modified BlackBerry was a one-off project suited to his security requirements.

My understanding is that internal hardware was removed/shielded, and I assume software modifications were made as well, like only connecting to specific cellular base stations (such as the one in his official vehicle).

BlackBerry was the best thing you could get at the time. Obviously things have changed since then -- BlackBerry hardly exists anymore!

Which makes complete sense. He is the most powerful individual in a country of 300+ million people. If he needs a certain thing to keep him operating at peak efficiency and focus, he gets that thing. Period. Unless it violates national security.

Being elected president is not the time to learn a new technology suite. Hopefully most presidents have better things to do with their time than that.

At that level your people have people who have people to deal with that kind of minutiae.

>Being elected president is not the time to learn a new technology suite. Hopefully most presidents have better things to do with their time than that.

At what level does this stop being a waste of time for the person?

I'm not suggesting Obama should have been forced to change, but every else in his administration was forced to change. There's some serious clashing between the need for secure devices and the reluctance to change from old technology.

I think it's fair to ask what the secure alternative platform was. I wouldn't be surprised if it was five years out of date and barely functional. I think the President ought to be able to say "this is crap, improve it".

Hopefully your people's people's people don't interpret "setup e-mail for Mrs. Clinton to use on her Blackberry" as "setup an e-mail server on Mrs. Clinton's existing hardware and configure it on her Blackberrry."

But he did use it secure, not like Trump

> The entire Clinton personal e-mail scandal was essentially her unwilling to give up her BlackBerry

The main scandal was her violating FOIA. There were some additional security concerns, but her running on a platform of undoing civil rights era legislation was the bigger issue.

>but her running on a platform of undoing civil rights era legislation was the bigger issue.

I feel like this needs more explanation

FOIA is civil rights legislation from 1967. Clinton's entire campaign was based around the premise of rolling back those sorts of civil rights era protections, which is why she didn't turn over her email to the state department as was required by law.

Some? She mishandled Top Secret/SAP emails on her unsecured server.

https://www.businessinsider.de/hillary-clinton-email-server-...

No, she destroyed devices, used Bleachbit to delete evidence and they still found ~ 70 secret and top secret emails on her server. There is also evidence of a cover-up. The Russia narrative is also bogus in the case of the DNC hack they even refused to give the server to the FBI.

>>Damn, you'd think that someone at that level would pay for better OPSEC support

I think that he thought himself as untouchable and neglected it. Maybe dodged so many bullets over the years.

Question for HN: did the FBI break the Signal encryption or just managed to open his device to find all the messages there? Maybe sensitive messages need to be deleted.

> did the FBI break the Signal encryption or just managed to open his device to find all the messages there? Maybe sensitive messages need to be deleted.

I’m also interested in the answer to this question. From my layman’s understanding I see Signal as the most secure messaging solution out of the box, followed by WhatsApp but only if (and it’s a very big if) you don’t plan to do something that might raise the interest of a US 3-letter agency (i.e. you can use WhatsApp for random political corruption cases in European countries, like the politicians from my country do, but it’s not safe to use it if you plan to actively cross the interests of those 3-letter agencies). Telegram I also see as compromised by the Russian secret services, ignoring all the recent public brouhaha.

If anyone more knowledgeable has other views on this please feel free to correct me.

Based on the article it seems like the messages were recovered from the local copy stored in the device. Arguably (at least, this is my understanding of OWS's stance on the issue) Signal only really claims to protect in-transit communications. Once the message reaches the recipient, it is up to that individual to secure the local copies of the messages. Signal does have an option to encrypt the local copies, but FDE is the ideal for that

Which level was Michael Cohen at? From a career perspective he was an ambulance chaser (involved with a number of fraudulent car crash claims) with shady, Saul Goodman "back of the nail salon" style offices. Then he purportedly helped a reality star pay off people.

My point, I suppose, is that normally the associates of the president would be upstanding individuals who had achieved heights. In this case, as with many of DJTs associates, it is anything but that.

Manfort [not Cohen, as I originally wrote, but Manafort] had his message stored on iCloud. That turned out to be part of how the FBI was able to recover them so easily.

https://gizmodo.com/paul-manafort-learns-that-encrypting-mes...

Well I am not sure about blackberry but android and ios are fully compromised[0].

0:https://wikileaks.org/ciav7p1/?

Blackberry is just a skin of Android these days.

This link doesn't say anything remotely like that.

If you actually read down to the cellphone section, it says the cia/nsa/fbi have tools to gain access to cellphones remotely. Everything on your phone is up for grabs.

"...Cohen's messages were stored on iCloud..."

???

Your comment had me struggling to determine how one could store WhatsApp messages on iCloud. (From a Blackberry no less.)

But then I followed your link. I don't think that article was about Cohen. You may want to change your post.

On an equally important note, why is it that people out there assume that ANY form of electronic communication is impervious from government surveillance? The reality is that if a three letter agency is after you, it's probably unwise to be using WhatsApp and Signal in an incriminating fashion. (Or anything else for that matter.)

It's like locking your physical spaces. Yeah, you should go ahead and lock your house or office and turn on the alarm system while you're gone...

but you should also go ahead and assume that those three letter agencies planted surveillance devices in that house or office even in the face of your security measures.

It may be referring to the fact that WhatsApp has a cloud backup feature built in to the app that keeps a copy of your messages in a cloud storage provider. The Android app at least explicitly warns you that this database is not end-to-end encrypted and that doing this backup defeats the point of the encryption.

>On an equally important note, why is it that people out there assume that ANY form of electronic communication is impervious from government surveillance? The reality is that if a three letter agency is after you, it's probably unwise to be using WhatsApp and Signal in an incriminating fashion. (Or anything else for that matter.)

Signal has a feature for self-destroying messages (on-read, or after x amount of time). Seems like that could've been used and it wouldn't have lead to this right here.

Point is that the messages still have to go over the public networks, so if three letter agencies have you under surveillance, you should assume they're gonna get everything you're saying. You should NOT just say, "well, I'm using encryption so I'm golden."

If there's one (family of) devices(s) that the FBI certainly knows how to 100% completely pwn the shit out of... it's the Blackberry.

Why?

BlackBerry CEO: We'll Try To Break Our Own Encryption If Feds Demand It (2017)

https://www.forbes.com/sites/thomasbrewster/2017/10/25/black...

BlackBerry CEO blasts Apple for focusing on user privacy, data protection (2015)

https://www.extremetech.com/mobile/219661-blackberry-ceo-bla...

Related: BlackBerry gives Indian government ability to intercept messages (2013)

https://www.wired.co.uk/article/blackberry-india

Edit: Also

RIM to share some BlackBerry codes with Saudis: source (2010)

https://www.reuters.com/article/us-blackberry-saudi/rim-to-s...

BlackBerry approved in Russia (2007) [required access during criminal investigation]

https://www.nytimes.com/2007/11/27/business/worldbusiness/27...

> The letter to Judge Kimba Wood stated that "the Government was advised that the FBI’s original electronic extraction of data from telephones did not capture content related to encrypted messaging applications, such as WhatsApp and Signal... The FBI has now obtained this material."

I don't get this. How could you possibly decrypt encrypted messages without WhatsApp or Signal's assistance?

Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys?

I haven't used Whatsapp or Signal, but you don't login every time you use the chat app, right? The phone could have just been unlocked by the owner or the PIN or pattern guessed, assuming the keys are stored on the device.

They are very different platforms, Signal offers on-device encryption if you choose to enable it, prompting for a password when starting Signal after rebooting the phone. It will also keep a quick lock option in the menu on Android phones so you can easily prevent unauthorized access.

I believe Whatsapp has made a few compromises in this regard, but obviously Michael Cohen didn't bother to use disappearing messages in Signal or encrypt his Signal DB, despite how easy it is to do.

You can also set Signal to ask for a password after a certain time.

This is a common misconception apparently, one that I've fallen prey to myself in the past. Signal removed the option to use the password lock and now uses Android's built-in lock screen functionality to provide auth.

That screen was never meant to serve an encryption role and Moxie recommends using Android's full disk encryption feature to ensure data confidentiality at rest.

Encryption in transit doesn't imply encryption at rest.

For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.

Nothing on Google Drive is stored "in clear text".

...are you a Google Drive dev? How can you possibly make this statement?

It's clear to Google.

If I put a file with certain content into Google Drive, then Google Drive, or a subpoena for my Google Drive data, will return exactly those contents.

Hence, it is reasonable to apply any distinction to the content as a user of Google Drive sees it, and not as it may be stored on the backend. Hence, if the data WhatsApp pushes to the Google Drive API is unencrypted (and we're talking about the data, not about the HTTPS-encapsulated form that passes over the network), it is reasonable to call it "in clear text", and it wouldn't be reasonable to call it encrypted.

I'm pretty sure anything public on Google Drive is...

Unless you control the encryption keys in the communication, always assume it's accessible in plaintext.

It's maybe not stored in clear text, but it is at the very least stored in a form that Google can decrypt.

They would not be able to recover your data upon requesting a password reset, if they used proper end-to-end-encryption.

Media backups are not encrypted, but data is.

Backup key security is compromised by usability concerns (the need to restore the backup to a new phone without the old one).

https://blog.elcomsoft.com/2018/01/extract-and-decrypt-whats...

Ah, I know WhatsApp warns you about setting up backups that it's not subject to encryption, but I guess I took that to be the entirety and not just media. Which is still a big gap, since in 2018 we share lots of media in chats.

In any case you are right that if you can restore an "encrypted" backup onto a fresh phone without any info from the old one, then all the bits necessary to do are held by parties who can be legally compelled to give them up.

Last I checked it was really easy to get data out of a WhatsApp backup.

No special skills needed except running locating the file, running a command and connecting using SQLite or something.

>Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys?

But if the person who knows the relevant keys willingly hands over appropriate passwords/etc. for a more lenient sentence then encryption is moot.

What a great point. They don't even have to publicize it, officially they just got the data by good hacking.

They probably decrypted it on the device through some brute force methods. This may be easy or difficult depending on the passcode/PIN used by the user on the device. This is a weak point from the user's side. They may have also obtained this from backups elsewhere that weren't encrypted or strongly encrypted.

There is no indication that they decrypted anything by breaking into the end-to-end transport/network encryption used by these apps.

P.S.: Your honest question (which wasn't snarky) was downvoted by some people for reasons I don't understand. Upvoted in an attempt to compensate. Such questions and responses can help more people learn about encryption and the protections necessary at different stages/layers.

The article doesn't specify whether or not the encryption was "broken", or whether Cohen is simply cooperating. My hunch tells me it's the latter.

Yea this is key. It's possible to have Signal on your device but not implement any device locking passcode or passcode for unlocking Signal... That would make it trivial to recover data if you have the device.

An alternative method of protecting oneself is to set an expiry timer, which makes messages in a conversation ephemeral. 1 week seems to be a fine balance between being able to look back at old messages, while also not having those you communicate with be allowed to store data on your device for too long.

That's a good idea. Even if you enable FDE and a strong passphrase, the court can still compel you to unlock it. They cannot compel you to automagically undelete expired messages (hopefully those are expired and removed in a secure mannner...)

Signal also has an option to truncate your message history automatically, i.e. it only keeps the n newest messages and deletes older ones.

Signal won't prune the messages until you open the app (or maybe the conversation) again. There've been a few releases where the changelog notes that the app didn't expire ephemeral messages properly.

Is the model of the phone known? If it's a relatively new BlackBerry running Android, and if it can be rooted:

  * the main WhatsApp msgstore database in /data is not encrypted
  * the msgstore backup databases (.crypt* in /sdcard) can be decrypted easily using the key file (mentioned in the article) which is also stored in /data

One could probably reverse engineer the WhatsApp APK to figure out how the key file is generated.

I would hazard a guess that Signal messages are also not stored encrypted at the source and destination (beyond the protection offered by the operating system).

obligatory: https://xkcd.com/538/

No, it's really not.

We've all seen it. Hundreds of times.

It seems to have been referenced 272 times in HN comments and 3 times in story headlines.

Bruce S. Trust the math. grugq, endpoints suck.

Bet he sung.

Signal encryption relies on a password (last I used it, which was a long time ago). Typing long random passwords in a phone is nothing if not impractical.

It wouldn't shock me to find out they just brute forced the password.

Or found a sticky with the password on it when they raided his office.

Most likely scenario.

You can get WhatsApp and Signal on a BlackBerry?

Might be one of BlackBerry's newer Android phones.

It is Android. So yes.

Why wouldn't you be able to?

BB used to run a custom QNX-based OS, not Android.

Whatsapp used to work on all sorts of crap. I'd not be surprised if they ran on pre-android BBs

WhatApp ran on Nokia's S60 platform, which is for feature-phones. Making a QNX version was probably much less of challenge.

You mean S40. S60 was Symbian, the smartphone platform.

Whatsapp was available on Symbian untill 2016, and they will support Gingerbread until 2020

Wasn't one of the main selling points of WhatsApp back in the day that it ran on basically anything?

Trump is in trouble now.

EDIT: It is suspected that Michael Cohen, being a long time Trump friend and personal lawyer, is familiar with Trump's money laundering. If Michael Cohen believes he's at risk of being sent to jail for many years, he might collaborate with the FBI.

Could you please increase the amount of information in your comments?

Edit: thanks.

A lot of trouble. A Ukrainian national said in an interview that he testified in front of a grand jury convened by the Mueller investigation last Friday. He said that the prosecutor's questions focused on Cohen so he is about to be squeezed from both sides and his family is now selling several multimillion dollar apartments (including his in-laws), supposedly to cover legal bills. His current legal team will cease all work for Cohen after today with sources saying that it is due to a failed attempt at negotiating down some already owed bills.

Federal grand juries convene on Fridays so we will know by Monday whether more indictments will be handed down.

Trump Campaign to Discredit Michael Cohen is Underway

https://www.youtube.com/watch?v=-f-NToq6NW8

I was under the impression that grand jury questioning was not to be disclosed? Am I wrong about this?

It often is leaked, despite the rules.

The jurors are not allowed to talk about the proceedings but unless the judge institutes a gag order or the contents of the testimony are otherwise protected (i.e., the case involves a child whose identity must be kept sealed, person testifying has security clearance and the topic is classified, etc.), witnesses can do whatever they please.

Bribing foreign government officials is not to be disclosed either, but here we are.

That is why I read Hacker News. The media will try cover up and protect Trump no matter what. Good thing commenters here can scoop the media and expose his lies.

Maybe if your definition of media is Fox News and Fox News alone. Washington Post, NY Times, CNN, MSNBC, and hell even Yahoo News have been the ones revealing most of these details for the public to see through what must be some of the best investigative journalism in history. Although I hate the panel circus, false equivocating, and general pussy footing in the media, they have been doing an admirable job. In the last week we've also seen more and more on screen personalities call out Trump's lies as lies instead of "inaccurate statements" so even that is changing.

The only better sources for developments in this fiasco are the unsealed court documents coming out of the investigation.

I thought it was spelled Faux News.

My definition of the media is pretty expansive. If Trump is in so much trouble, I would think the Washington Post or New York Times would lead with it. Maybe they buried the trouble in the Style section.

How are you sure that the parent comments isn't lying to you, either? I'm not saying that it is, but you should take more care to verify your sources rather than relying on random commenters on a technology forum…

I was being sarcastic.

Poe's law strikes again!

The feds have already stated they will be going after every nickel they can get their hands on from both Manaford and Cohen if convicted. Leaving their family destitute is a powerful incentive to cooperate.

do people still use BlackBerry in Washington? Seems a little out of date to me...

i cannt read i am dumb, but?

did they have his phone password or is this saying they hacked the chat softwares?

It says that they have "731 pages of encrypted data" but nowhere does it say that they managed to decrypt the data, and read the plain text.

It states that they did not disclose what was in the "encrypted data" so... there's no indication or assurance that they've managed to access the plain text.

Why on earth would those fools print it all out?

Hard copy for future reference, in case some sort of vulnerability becomes exploitable at a later date.

Also, to provide a vague, yet seemingly impressive metric, true to form for federal government employees, because it seems official to the non-technical layman.

If you were to declare a metric such as 900KB of encyphered base64, well, gee, that's like, almost nothing. But print it out, and non-expert jurors start thinking "Well, gee! 700 pages is longer than that Stephen King book that I just read!"

And anyway, they wouldn't have to print it out, to obtain a quotable metric. All they'd have to do is paste it into an evidence template, and prep it in a printable format, like a DOCX file or a PDF. Then, they can subpoena for the metadata, and at least maybe infer a relationship between entities, even if they are denied awareness of the nature of the conversations etween them.

Seriously, this is how government officials and lawyers tend to think.

My reading of that was that they had 731 pages of texts, which were supposed to have been encrypted by WhatsApp or Signal, that were stored in plain text.

That's what this article appears to suggest:

https://www.bloomberg.com/news/articles/2018-06-15/prosecuto...

From paragraph 2 in the article:

> Investigators have restored 16 pages of documents found in Cohen’s shredder and recovered 731 pages of messages sent on encrypted platforms, including WhatsApp and Signal.

Reply on news.ycombinator.com