A database of over 500 iPhones cops have tried to unlock
vice.com
vice.com
the article mentions it but not much detail:
> Android devices, on the other hand, end up having large variations in the security of devices from different manufacturers, which may have their own vulnerabilities or may have difficulty distributing security and Android operating system updates to phones quickly.
The tools that Cellebrite sells will handle all but the most recent iPhones and maybe the most recent Androids. The newer the iPhone, the less likely a law enforcement officer is gonna have the tools to get into it. Cellebrite offers a service where you can ship them the phone and let their techs go at it. Whether it is because of legitimate limitations in their technology, or purely a marketing/commercial limitation, is unknown.
In general, any non-i{hone is Android. Most Androids are garbage phones that are sold by the dozen in the bottom of a bin at a gas station. Security isn't something its creator or buyer is really concerned about.
I have been out of the field for a few years, so things may have changed slightly in either direction, but I imagine its the same general concept. Newer is harder to break into, brand new iPhone model is probably impossible for now.
Nobody was able to access my Veracrypt computers.
I'm curious, did they try to put any pressure on you to unlock the devices for them?
I found a subsequent court case where my same prosecutor tried via the court system to get a different defendant to reveal their passwords and they failed. Oh well.
Reading their internal emails regarding encryption and their general tech capabilities was enlightening.
AMAA if you'd like.
Obviously I would never obstruct justice but in theory had I heard them knocking, there would have been plenty of time to do so.
Ironically half the "evidence" they recovered from the phone actually would have helped my case if it had gone to trial because it showed no criminal intent and no attempt to hide from law enforcement. In short, if they never gained access to that phone on their own it may have been in my interests to provide the passwords for that specific device but who knows.
Please elaborate.
>Is it because iPhones are more likely to be up-to-date in terms of patches and security updates, and hence android is easier to crack?
I don't want to make premature judgements without factual supporting evidence, but my personal anecdotal evidence suggests that these two guesses might be the correct ones. Me and some of my friends got S8+ a few years ago, back when it was Samsung's flagship smartphone. Among other things, we were all appalled by the update cadence. We were getting security updates, not even talking about major OS updates, about 3-6 months after Pixel phones were getting theirs. I cannot even imagine the horror show that non-flagship Android device owners have to go through in terms of updates.
The options for anyone else is usually a) always use the latest iOS device or b) use a hardened Android, or c) use a dumb phone for all non-critical comms. I should repeat that: if you're worried about security consider using f2f interaction because the number of places you're likely to trip up are endless no matter what device.
I don't believe in "hardened Android" either, unless it's developed and maintained by nsa or gchq.
It was silently fixed by apple once the story hit the mainstream news.
That said, nudes don't belong in any cloud.
this is a very good thread by thegrugq on ios vs android: https://twitter.com/thegrugq/status/1168981940462149644
edit: another thing that rubs me the wrong way about Apple recently is their stubborn stance against any outsider who might offer iOS introspection capabilities. this raises the bar for security researchers but is counterproductive to iOS security.
On iOS the files are encrypted so that some of them become available at boot, some the first time you unlock the device and some only while the device is locked.
On modern devices the key protection is managed by the security chip/Secure Enclave zo it can both attempt to limit attempts to a number of times and prevent people from brute forcing the key because only the chip can run attempts which are purposely made slow.
Typically Cellebrite like tools bypass the lockouts but still have brute forcing limited so it only practically works on short or poor pin or passcodes.
Still, it’s unlikely a device is going to remain safe for 15 years, if the adversary is patient it’ll eventually be unlocked; technology advances and bugs are found in everything.
Whether or not this is more or less secure really depends on your threat level. IMHO, turned on, the data is more secure if apps are configured properly with FBE. Turned off, data is more secure with FDE (assuming both scenarios the same key).
0. https://www.apple.com/business/docs/iOS_Security_Guide.pdf
Having a list of the times when a warrant was served and a phone unlocked with details of which OS+version, which jurisdiction and which unlock method would balance out the research.
The problem is that these tools not only allow you to read but actually write to the device. ("if you're a dev working for HackingTeam why on earth would you limit the feature to reading when you can provide r/w access?")
The implication is that it's as easy to plant things on a device as it is to retrieve info. And if you know that the device has 99.9% child porn on it but end up not finding any why not plant something that gets you to court order you desperately need to convict the suspect?
What you're asking for is transparency in a world that is very much opposed to this because they consider themselves the good guys. And the response from them is always: "how dare you?!"
> Do you really think there are authorities planting evidence on phones?
I don't think so I know it. please read the HackingTeam leaks and other OSINT sources. you'll find plenty of attempts in them making every effort to do so. You don't need a tinfoil hat, just travel to an area that is hostile to your passport.
I would love to read more about this if you can point me in the direction of those leaks and sources.
For iOS, you need 2-3 up to date exploits to cover 80% of all devices.
Unlocking my phone throughout the day is done with Touch ID. If I think I’m going to encounter the police or be away from my phone, I press the lock button five times which disables Touch ID. I’ve been doing this for two years and it works great.
A close friend of mine is a cop in Ireland. I love him to bits but hate him for his bragging about how he loves to use his pepper spray after having his 5th Guinness.
Another brother of mine is actually a cop. He thinks that other cops are all corrupt. And he suffers a lot due to institutional racsim in the force and lack of promotion unless you agree to be a racist.
I grew up spending lot of time time riding a cop car with an old guy who really liked my gran and was with the criminal police. We walked our dogs together. I was 8 he was in his 50ies. One of the things I still remember vividly is when he exited the car to show me the power he had over people by stopping and questioning them and he also bragged about all the "dirty crooks" that he took shortcuts with to arrest them because he was the good guy and they were the bad ones.
My brother dated a girl who's ex was a cop with the criminal police in Bavaria. he (the cop) abused her and raped her over several years. He also loved to brag about what he would do to her and how he would fuck up her life if she ever left him. Covering his and his friends asses over speeding or parking tickets were the least of his crimes.
Seriously cops are just people. Fuck people. Fuck power. Fuck cops. If you think for 1 second that a cop has your interest in mind think again.
I can give anecdotes about friends who are cops that risked their lives to save strangers, even the bad guys. I know more than 1 cop who arrested a guy, and had the suspects family thank them for how they saved their life in the process.
I can also bring up anecdotes about how people who were so passionate about security were also criminals hiding criminal deeds. I could assume, and assert, that since I've personally seen people use their phones' security to hide evidence of murder, and infant rape, that all people who care about their phones' security are the same.
But that'd be a disservice. It'd be a disservice to those who legitimately care about security for legitimate reasons, because freedom is important, and fragile. It'd be a disservice to others who aren't sold on either side of the discussion. And it'd be a disservice to myself in that it makes me seem very narrow minded and narrow viewed. Its letting fear overcome observation.
There are 700,000 cops in America alone. Undoubtedly some are unqualified garbage. Some are malicious monsters. Some are believe the ends justify the means. Some are paragons of truth and justice. Some aren't malicious, or dumb, but only care about their careers and are shortsighted with all else. We can't make sweeping statements either way, it does nothing to help.
There have undoubtedly been cases of cops using rubber hose decryption. There have been warrants falsified intentionally and unintentionally.
But cops wanting to be able to execute search warrants on phones isn't as simple as "We want more power, more control". There are countless legitimate cases of human trafficking, murder, and sadly worse. We, as a society, have to figure this stuff out. We have to find the balance between "Give us all your secrets" and "Do whatever you want without question".
But we can't have this conversation to find the balance, until we admit that we are on a scale.
So given the choice between giving the police more power and less power, I would much rather they have less power.
> But we can't have this conversation to find the balance, until we admit that we are on a scale.
exactly!!
See this very relevant xkcd: https://www.xkcd.com/538/
I don’t see any option for it in the passcode settings either.
On my iPhone SE it takes me to a screen with power off, medical ID, and emergency SOS sliders. To get back to the home screen after that I need to enter my passcode.
https://www.imore.com/how-quickly-disable-touch-id-when-you-...
Aha, that does it!