No, Cellebrite Cannot “Break Signal Encryption”
signal.org
signal.org
So someone enthusiastically posted about wasting their time as if it was a technological achievement. Then someone (else?) realized that the long technical post sounded stupid and had it replaced.
And some people wonder where their tax money goes to — all these companies who are better at marketing themselves well as experts are getting free lunches!
[1]: https://web.archive.org/web/20201210150311/https://www.celle...
I agree with your post, except for this. It is NOT a waste of time to assert, once in a while, your power to examine, extract, and change anything running on your device.
Cellebrite isn’t meant for use with devices you own; it’s meant for use with devices seized by law enforcement. I’m not so sure that qualifies here.
That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.
Even for someone getting a bit more technical and tinkering with their device, tools like `adb` are fairly powerful on their own.
Not exclusively[1].
It would be interesting if they did that to something restricted, like a Netflix movie.
(I can dream, right?)
It may seem trivial from a security perspective since it doesn't involve breaking any cryptography, just using a decryption key as intended, but in practice the ability to get a plain-text dump of all messages is very useful.
> [...] Once the decrypted key is obtained, we needed to know how to decrypt the database. To do it, we used Signal’s open-source code and looked for any call to the database. After reviewing dozens of code classes, we finally found what we were looking for
> [...] After linking the attachment files and the messages we found that the attachments are also encrypted. This time, the encryption is even harder to crack. We looked again into the shared preferences file and found a value under “pref_attachment_encrypted_secret” that has “data” and “iv” fields under it.
Today I learned that I can do code cracking too...
ECH will be GREASEd. To prevent those who might want the capability to stop ECH in the future from getting a head start while it's uncommon, implementations would always pretend to be doing it anyway.
So talking to any TLS server, even one that has no idea about ECH, the client says basically "Hi, here is a normal unencrypted TLS 1.3 Hello message for this.server.example, also, here's an Encrypted Client Hello message". If the server actually does offer ECH, there could be a real Client Hello, perhaps addressed to another.server.example, encrypted inside the Encrypted Client Hello, but if not there's just random noise. An eavesdropper doesn't have the key, so they don't can't tell which is the case.
Obviously if your server can't do ECH, the Encrypted Client Hello is just a mysterious unintelligible extension with noise inside it, no further inspection needed.
And in some setups the server knows how to tell easily which key would have been used for any valid ECH, so if that key doesn't work then it was just noise, and can be ignored.
But in other cases the server knows two or more keys that might be valid, yet the client either can't or has chosen not to be open about which (if any) was used, so the server has to try them all until it finds out.
This is Section 10.4 of the current draft:
In GPG:
/* if KeyID is empty... */
if (!k->keyid[0] && !k->keyid[1])
{
log_info (_("anonymous recipient; trying secret key %s ...\n"), keystr (keyid));
}
err = get_it (ctrl, k, dek, sk, keyid);
k->result = err;
if (!err)
{
/* If get_it() succeeds */
if (!opt.quiet && !k->keyid[0] && !k->keyid[1])
{
log_info (_("okay, we are the anonymous recipient.\n"));
}
}
if (sk->pubkey_algo == PUBKEY_ALGO_ECDH)
{
/* Now the frame are the bytes decrypted but padded session key. */
if (!nframe || nframe <= 8
|| frame[nframe-1] > nframe)
{
err = gpg_error (GPG_ERR_WRONG_SECKEY);
goto leave;
}
}
else
{
if (padding)
{
if (n + 7 > nframe)
{
err = gpg_error (GPG_ERR_WRONG_SECKEY);
goto leave;
}
}
if (n + 4 > nframe)
{
err = gpg_error (GPG_ERR_WRONG_SECKEY);
goto leave;
}
if (dek->keylen != openpgp_cipher_get_algo_keylen (dek->algo))
{
err = gpg_error (GPG_ERR_WRONG_SECKEY);
goto leave;
}
/* Copy the key to DEK and compare the checksum. */
csum = buf16_to_u16 (frame+nframe-2);
memcpy (dek->key, frame + n, dek->keylen);
for (csum2 = 0, n = 0; n < dek->keylen; n++)
csum2 += dek->key[n];
if (csum != csum2)
{
err = gpg_error (GPG_ERR_WRONG_SECKEY);
goto leave;
}
}
BTW, did I just "break GPG encryption and deanonymize users" according to Cellebrite because I found the correct function in the code? And no, I didn't "review dozens of code classes", I just grepped the word "anonymous"... /s
So maybe more like the person who works the key cloning machine at the hardware store.
I read "reviewed dozens" as "got lost in the code for a bit"
[0] https://www.freebsd.org/cgi/man.cgi?query=bsdgrep&sektion=1
[1] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/g...
"grep wizard who single handedly found the needle in the haystack"
It's just a lot easier for the investigator to just plug the phone into a Cellebrite UFED analyzer and extract as much as is covered either by their search warrant or by the signed consent form of the phone's user(s), and it's a lot easier to defend in court, as it eliminates room for accusations that investigators cherry-picked messages and data that look incriminating out of context.
TL,DR: Even if it's not an impressive feature technologically, it's still a valuable feature to some of Cellebrite's main customers.
Does a UFED even have a way of selectively extracting only what's covered by a warrant?
Are warrants usually granted that would be considered outrageous fishing trips by the more privacy aware of us here?
First, doing it manually through the app is not okay since it does not scale, you don't want to read a message, you want to retrieve and index all messages, and you might want to process many devices quickly.
Second, apps usually do not show the user all the information that's available - often there is extra metadata (which may be as important as the message contents) so you do want to decode the actual message database.
Third, doing it through the app might change things - the app may change state (for example, mark an unread message as read), send some notification to central servers, alter metadata, etc. So it potentially disrupts evidence, and that's not okay.
So the original blog post from Cellebrite makes all sense - if you do want to do forensics, then a tool that does all that is really a requirement, it's not wasting time.
Now if they were able to break the Keystore itself then they might be on to something but as it is it requires convincing criminals to give up their phone and their password. If you translate this to a physical analogy people's reaction would be 'no shit', but because it's digital you can apparently get away with it.
> So someone enthusiastically posted about wasting their time as if it was a technological achievement.
I think there's plenty of value and achievement in understanding a program's functionality, even when the source is fully available to you.
We all (presumably) agree that source code isn't self-documenting and that understanding someone else's work usually involves a lot of individual comprehension and context; I read this blog post as someone (diligently) describing their mental process as they tried to understand Signal's internal formats. As others have pointed out, there are oodles of "legitimate"[1] reasons for doing so.
[1]: From the perspective of LEO and the legal system, anyways.
Better than us, I presume? But unless you or I are prepared to do this work (to parse data from Signal and every other application out there), for the police, for other investigation agencies, for corporate and private investigators, for lawyers, for data protection officers etc., the vast majority of whom aren't programmers or reverse engineers, what's the problem if someone else is?
A what?
should be Tum61d.
to me what is embarrassing is that all of these major news outlets and professional journalists could not actually read the article and do some very basic research before blasting out to the public. It just really shows how low the bar is to get something published. I could blow my nose on YouTube and make stock picks based on where the bugger lands and I wouldn't be surprised if BBC Business picks up the breaking story. That's how low the bar is it seems. Sad.
More likely the opposite: Some engineer was tasked with adding Signal database handling, marketing got wind of it, and they went to town on blog posts and PR pieces about it.
Really though, they don't care that it's technically wrong. The target audience for this stuff isn't other engineers or technical people. It's their potential customers, who don't know the difference.
Their potential customers (forensic examiners not just in law enforcement, but also corporate investigators, incident response etc.) do know the difference. Being able to get data from the endpoint is exactly what they are after, because the alternative is that some poorly paid soul has to sit and photograph thousands of pages in numerous applications. Having access to the database saves time, reduces interaction with the exhibit and gets metadata which isn't shown on the phone.
> After getting the decryption key, we now needed to know what decryption algorithm to use. We went back to Signal’s open-source code and found this:
> Seeing that told us that Signal uses AES encryption in CTR mode. We used our decryption key with the AES encryption in CTR mode and decrypted the attachment files.
Was this supposed to be satire?
Oh wait, you're serious. Let me laugh even harder
I feel like a lot of today’s mistrust of news stems from publications not verifying sources, or checking evidence, or at least scrutinizing what others are saying.
Wish we could fix that
It’s a time waster that entertains- not a reflection of truth. How could any business be considered “the best” in its field and create such a shitty product? Simplest explanation: they are not trustworthy and never were.
This is a focused campaign, this is not just random occurence of incompetence.
What's the evidence for this?
"Accuracy" is moot here: BBC's headline is misinformation.
> Since we weren’t actually given the opportunity to comment in that story
So it may just mean they were not given enough time to respond before publication, or even that they were contacted post-publication. In the race to front page "breaking news" the responses are expected to be published as updates to the story.
I imagine this is quite common behavior with journalist when they want "breaking news"
It's 1:30pm.
I wish LW-style rationalist circles didn't attract such obnoxious people, because I don't know of any other collection of people who recognize and try to adjust for things like this.
"That was a super interesting book, it brought up lots of ideas and explanations, lets discuss what parts if any we think are true." !
Folks call out information and facts as fake news, not apply healthy skepticism but a rejection of all knowledge and then at the same time falling for hoaxes.
The whole country needs to take a gap year and learn the scientific method.
It’s not a satisfactory answer, but ¯\_(ツ)_/¯
(I found LW/rationalism through philosophy circles, incidentally)
Sadly, I am not a comedian.
Sharing some anecdata, because I enjoy when others do.
I've got some very dear friends born in a highly prescriptive culture where credential-ism runs deep, being an intellectual is extremely valued -people are often denied leases due to their non-academic status- and authority figures and strangers get the "Mrs." and "Mr." treatment for years after you've met them. Early on in our friendship we would discuss and rant about everything and anything. We would often talk about my attitude of trusting no one and how I believe there are, truly, no experts, in the colloquial sense of the word. We've often had late-night discussions about my "stubborn and deeply misguided attitude", about how it's wrong that the only experts I trust are those who deeply distrust their own abilities, instincts and continuously attempt to disprove their own claims.
Shockingly, they defended the aforementioned views until many of their countries top virologists and they themselves, often and loudly, shared their opinion on covid-19 around March, April and May: covid-19 was nothing special, national mortality trends were unaffected, their country is rich and they had a high number of ICUs, it was basically just like the flu and nothing to worry about. Then, as we all know, shit hit the fan and we saw cooling trucks being turned into mortuary vehicles. I simply told them what I've always told them, and for the first time since we're friends they nodded with some sadness in their demeanour: trust no one, acquire evidence, make your own judgments, try to find hidden risks and the only so-called experts worth trusting are the ones who, in their own words, publicly and candidly express their skepticism towards their very own claims and try to help you reproduce their methods and conclusions.
Turns out the answer is math ;) more specifically stuff which didn't exist back then.
Anyway, according to Wikipedia: "Some mathematicians and historians, such as Carl Boyer, hold that Zeno's paradoxes are simply mathematical problems, for which modern calculus provides a mathematical solution.[6] Some philosophers, however, say that Zeno's paradoxes and their variations (see Thomson's lamp) remain relevant metaphysical problems.[7][8][9]"
So it seems like a few people are still wasting their time with this.
You can't simply extrapolate from finding one mistake in a book to declaring the whole book wrong. Likewise, you can't extrapolate from finding few bad publications to "everything is crap". I'm not trying to claim journalists are all good or even consistently good. But believing they are always bad is the same logical fallacy as believing they are always good.
So the situation is bad enough when I am encountering a new source. But if I'm already familiar with a source, and it's consistently wrong about the things I know, then I can only be even more suspicious of everything else they say; and sadly, an awful lot of publications do fall into that category. Finding a mistake in a book does make it more likely that it contains other mistakes, and it does make any given fact in the book more likely to be wrong.
If you can only check one thing and it's wrong, then it is entirely and clearly irrational to assume that everything else is correct.
It's not fully defensible to assume that it's 100% wrong either. Just by plain statistics you may assume almost anything must have some correct portion.
What's rational is to make as few assumptions as possible, and where guessing or informed guessing is necessary, use only the information you actually have. That means back to the beginning, if you can only evaluate one part, and it has a many errors, then that is the only thing you can use to make any assumptions about the rest, unless and until you get actual credible assertions about the rest from someone else who are themselves credible in that domain.
Well then why did you write about liking the book and whether it's good as the cause of disagreement? That's a very very different thing from whether the book is an accurate source!
Even a specific section you prove to be wrong can still be good.
(If you want to read more about this then google "single observation unbiased estimator")
That's exactly the wrong kind of extrapolation I'm pointing out. If you found a flaw in one chapter, the book can be trash, and the chance of it being trash is definitely higher than without any other data, but whether the absolute chance of it being trash is sufficiently high enough can only be determined based on the nature of the flaw, and even then, the confidence for that conclusion can't be really that high.
Determining whether a source is trustworthy is an ongoing process: you're seeing one portion where you have some expertise or evidence and then another portion where you don't. You have to extrapolate from what you can validate to whether what you can't is valid.
The complaint behind Gell-Mann amnesia is that we're too quick to dismiss clear evidence that a source is untrustworthy, that we have a bias towards trust.
To put it in perspective, let's imagine the opposite, call it Crank Awareness. If you see a document and it's laid out poorly, uses weird boldface, all caps, colors and blinking text, you'll, at the very least, get the impression it's written by a crank before you even start reading.
> But believing they are always bad is the same logical fallacy as believing they are always good.
Again, this comes back to the problem of strict logical reasoning vs. treating trust as a larger process. We have limited resources to evaluate sources, so we're stuck making fallacious generalizations when we need to make a decision based on our sources. What we want in the long run is to incentivize authors to exercise care and diligence.
That would indicate we should punish known bad information by deprecating the authors. So another way of reading Gell-Mann amnesia is that readers aren't doing this. They're seeing stuff that they know is wrong and continuing to patronize the publications regardless, thus authors can be untrustworthy and still collect a paycheck.
Sometimes books about magical properties of crystals get their geology right. Sometimes they get it wrong.
If I apply your superficial filter I essentially give up my ability to convey the difference to your friends.
If I ignore your filter and pay attention to the entirety of each book, it's trivial for me to help them separate wheat from chaff. (Or at least chaffy-wheat from pure chaff.)
Imagine I give you a dictionary purporting to contain descriptions of the referents of the following words: (I assume you know what a sprint is, but not a bilparyoti or a zambungar)
* sprint - to run at a rapid pace for a short distance
* bilparyoti - a kind of bright blue butterfly, found in Congo-Brazzaville
* zambungar - a muddy colour, specifically that created when a landslide enters a clear river
Now, based on knowing that 'sprint' is 'correct', what is your probability, posterior to being supplied the dictionary, that you know what a 'bilparyoti' references?
Now, imagine that I tell you that the 'bilparyoti' is wrong and you are able to be convinced that the 'bilparyoti' is wrong. Is your prior for the accuracy of the 'zambungar' reference the same as the posterior after being supplied the information about the 'bilparyoti'?
Matticus, there, presumably laments the fact that the zambungar accuracy probability has not moved. Rationally it should move towards zero. By varying amounts, certainly, but towards zero. With his friends, P(zambungar_correct | bilparyoti_wrong) = P(zambungar_correct|bilparyoti_unknown), truly a situation worthy of wailing and gnashing of teeth.
Granted. But OP seems to be at the other extreme which is equally problematic:
> Everyone reads a book, everyone but me likes it.
That strongly implies a boolean value judgment to me.
Problems only really come in when ignorant people read too many stories and start to think that how they present things is actually real. And some people who know a particular area very well may find whatever the story does too patently absurd to suspend disbelief.
It's also a frustrating argument. What does it actually say? "Journalists are often wrong". No shit! That's why it's called "the first draft of history". Meanwhile, everybody is often wrong. But we don't have a "Djikstra amnesia" to describe all the times we fall short of the ideals of our own discipline, but forget about that when holding other people to our notional ideals of their disciplines.
Fortunately, most journalism is useless for information transmission and likely rarely alters behaviour - the latter having been chosen first with the journalism being used as justification. To that degree, the fact that most journalists are usually low quality information sources is not particularly dangerous since you never use them to do anything different from what you'd do.
There are lots and lots of people undecided about an issue, reading some journalistic drivel. They are most easily influenced on that undecided issue.
Perhaps we should?
(And then, of course, someone can post:
> Nitpick: Its Djikstra amnesia, tptacek's name for Edsger Djikstra's amnesiatic behavior, not an effect discovered or promoted by Djikstra.
when it eventually gets rounded to "Djikstra effect".)
Journalists, unlike say bloggers or marketers or think tank authors or pundits, have a fairly robust ethics/rules system about how to publish. Does it fail them at times? Of course, but do they fail at a higher % than other outlets?
I’ve never seen any actual evidence to suggest that. That there is a pithy quote from a Nobel prize winner isn’t interesting.
There isn't even that! The Nobel laureate is just part of the schtick.
> In all seriousness . . .
> I have no problem with NPR. NPR is great. That’s why I’m bummed when it falls for junk science.
And if we keep repeating that they'll likely fix it. It's absolutely fixable. NPR are not a total write off.
On the other hand, I listen daily to their flagship science show "Shortwave" and science-adjacent shows like "The Indicator" and their general news updates, and they are pretty great both in terms of being pedagogical and in not being misleading when they simplify something.
Same is true of criminal courts. "If you select only the examples of fraud of course my client looks like a fraudster."
Seriously if NPR had good science reporters why on earth aren't they tapping their colleagues on the shoulder and saying "Don't" or maybe "You need to correct that, it's NPR's reputation, not just yours." I mean, on the standards of popular journalism they're pretty bad. And NPR is the punchline when someone publishes research by media release fitting some model to noise and booking their TED talk[1]. NPR are always there.
[1] Some people think TED is good science too. Maybe it's not all garbage? I don't know, my search is not exhaustive once the pattern is established.
One anonymous source at the topic of the article that bolsters the claim, then all the experts who were willing to attach their names to their words all temper the articles claim are towards the end of the article.
First, a nitpick: that is a thought not a feeling: you didn't state how it made you feel, you stated an idea.
Moving on... That's not why people mistrust the media. They mistrust the media because they are told to by politicians seeking to discredit journalism and control the narrative.
I am a counterexample to your main point. I distrust most media sources because I've not once seen one present rigorous, transparent, verifiable research about a current event of interest to me.
I think I've seen every media source I've followed get significant facts wrong about things I know well.
I try to fight back against Gellman amnesia in my own head.
"Because I've never seen it, clearly it does not exist."
That's called faith and religion.
You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there.
IE, I can't see an atom with my eyes, and I can't duplicate all the research of history myself, but I can see some things with my eyesb and I can duplicate some research myself, and I can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales.
Except I never said that, whereas the previous post had a congruent summary of OP.
Strike one.
> You cannot rationally make decisions based on anything other than what you know and have seen or can reasonably project from there.
True. But that isn't what we are talking about, you ventured into strawman territory all on your own. The person was claiming they've never seen a truthful source, this is called the No True Scotsman fallacy. We're not talking about god, we're talking about the fact that some journalism is unbiased. There is much of it out there, but OP seems to think there isn't, or has convinced him/herself due to their own desire to not be wrong.
Strike two.
> can follow a reasonable, logical, defensible chain of trust from what I can directly prove to myself, to proofs I can accept indirectly, and distinguish those from fairy tales.
You've demonstrated that you aren't very good at following a "logical chain of trust" because you've reasoned to yourself, poorly, something that wasn't even being discussed.
Strike three.
First time playing with logic?
It never ceases to astonish me how people who throw around the terms "logic" and "rational thought" really, reeeeeally don't know how to deploy either.
However, if I've yet to see it, I don't know why I'd trust that it's happening regularly just outside my view.
Until I see evidence that it exists and is in fact the default state of journalistic reporting, I am not going to trust that it is.
By "distrust", I just mean that I do not default to trusting any news source I know of. I try to take what they say as plausible but not likely the complete picture. I also keep an eye out for what their overarching narratives tend to be and try to compensate for that in my own interpretation of events.
And do you think this episode is evidence of trustworthiness on the part of the BBC?
I agree with you that politician sow distrust, but poorly researched pieces are the fault of no one but the journalists.
We HAVE seen enough evidence to know that much just by tabulating stats and things like that John Oliver bit showing all the tv news stations using the exact same supposedly off the cuff remarks.
> poorly researched pieces are the fault of no one but the journalists
Agreed. THey should have consulted with HN, look at all the experts here.
> literally wrong to describe an opinion as a feeling.
I don't know the gender of the OP, but one area where therapists and psychologists struggle with male patients is that they often say "I feel" instead of "I think", ann when asked what the feeling was, they struggle.
You can't feel an opinion. You can have one, and it can make you feel suspicious, or doubtful, or confused, because those are feelings.
This is a good example of how words used incorrectly are symptomatic of a deeper issue: male avoidance of feelings beyond hungry/angry/horny. It's not exclusive to men, but it is very common.
I tried to get the default password changed to unique-per-unit randomly chosen uuid, just to be so obnoxious as to convince the customer to set their own password. Encountered resistance of the "but then they'd need to be retrained" sort.
I wish I could say we didn't deserve the bad name, but we kinda did.
Even PKIX (the IETF's profile for X.509 on the Internet) is orthogonal to TLS as designed, although in practice you're creating a world of pain for yourself if you decide you do want TLS but you don't want PKIX since the two have grown next to each other for decades.
Anyway, almost all of Moxie's talk is about the Certificate Authorities in the Web PKI, and not about SSL/TLS per se at all. It's about his attempt (Convergence) at multi-perspective peer validation for authenticity to eventually replace Certificate Authorities. Could that have worked? Maybe, sort of. It never went anywhere much.
Of course in hindsight we can't blame Moxie for not guessing what will happen next - I expect few if any of us spent last Xmas thinking "Better enjoy this, next Xmas will be a totally different ball game because of a pandemic virus" either.
<3
was also pretty good.
But if the attacker has a 0day, which likely all the big players do, they don't need your physical device. Which means signal will do squat to protect your data in that case.
The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device.
I think Signal is pretty safe from such things. Better than for example Whatsapp. Which seems to be where a majority of these nation-states using their 0days and exploits on.
USA/Russia/Israel for sure have these programs.
> The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device.
You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+.
This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person.
> I think Signal is pretty safe from such things.
You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.
Be upfront about it. The vast majority of their users, even those who should know better do not realize this.
0days are not that expensive. Within reach of practically any bad guy really.
They are highly proud of Snowden recommending them. But anyone operating on the level he did is a moron to trust Signal. So what the fuck?
There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition.
I don't know why everybody is repeating this as if I somehow don't understand that. My point is Signal is promoted as some sort of panacea by security professionals even though all that security can be bypassed, likely routinely by actual bad guys.
Has he ever said that Signal is the end-all, perfect solution that will prevent all kinds of threats and provide perfect privacy? I am sure there is a lot of sloppy messaging out there, but an endorsement along the lines of "I trust Signal's encryption and that it's not backdoored" is not unreasonable
so you're user YES, which is NO-root, but YES
rm -rf /
Great Sucess.
NO or NON root system, it seems like a marketable gimmick.
Must be up your people's ass.
Just checked, Signal has this; does this actually serve to unencrypt the encryption key or is that still accessible as root?
It's a pervasive problem of lack of technology and security education in the West.
Not a priority for US etc to show people how to secure themselves.
Above using the platforms secure storage for secrets, there is nothing more an app should do.
A communication has many links in a chain.
Some links in most chains will have some weakness or other. So what?
That does not mean that there is no value in the strong links.
You might as well say "But if the attacker has a sniper, which likely all the big players do, they don't need to read you communications to get you, they can just shoot you from across the street. Which means Signal will do squat to protect your life in that case."
There were applications that worked that way before mobile phones and the web.
The developers might of considered that the real threat was a remote access trojan that would just keysniff the passphrase. I guess the Cellebrite thing is a reminder that there are other threats. As it is you are pretty much lost if someone is willing to snatch the phone from your hand while you are looking at cat pictures on the web. Phones really need more than one level of "unlocked".
The real threat for most people is forgetting the password.
The isolation concept can indeed apply to more than just functional separation, including separation in time, or in search depth (number of records returned) or by classification. It would be quite simple -- require auth to scan backwards more than an hour. Or 'press and hold to mark message as sensitive|expiring'. And possibly require a passphrase to access those sensitive messages / threads.
I've applied these techniques for database systems where NTK (need to know) rules apply, to force queries to be narrowly scoped. Likewise system backups don't all need to be online (or in the tape robot), most restores are from the most recent backup.
The headline is actually true. Cellebrite did claim that after all. Whether or not it Cellebrite is lying is another story. Although it was pathetic of them to not reach out of Moxie. It only shows the quality of the mainstream media.
"You can't put anything on the internet that isn't true"
"Where'd you read that?"
"Internet"
> Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.
http://scholar.harvard.edu/files/mickens/files/thisworldofou...
Under the laws of many countries, that "record" alone would likely be inadmissible. Cellebrite's market is authorities who seize computers and then must follow forensics protocols for extracting digital evidence. It is not someone holding your device in their hands, opening up each app and taking screenshots.
>Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to.
But the original Cellebrite post says:
>Decrypting messages and attachments sent with Signal has been all but impossible…until now.
and
>This time, the encryption is even harder to crack.
It's just that Cellebrite's claim is totally baseless and what they're actually doing is not "breaking" or "cracking" anything. The BBC article should have been more critical of Cellebrite's language, but I don't agree with Signal that their headline was "false".
There's a world of difference between taking screenshots of an application and extracting messages and metadata from a database. I should imagine that Cellebrite's audience of corporate and law enforcement investigators would be very keen on getting access to this breakthrough. OTOH, Cellebrite's competitors have been able to do that for a while!
Have access to unlocked phone?: yes
Enabled signal backup?: yes
Copied key to decrypt backup?: yes
Downloaded Xeals signal backup decryptor from github[1]?: yes
Decrypted backup?: yes
Contacted BBC to inform them you "cracked" signal's encryption?: check
Profit
Would be interesting to know if an app specific PIN resists cellebrite analysis. Screen unlocked, Signal PIN enabled.
The Signal case is interesting because the app used to have a feature where you could protect the data with a separate strong passphrase. That would of prevented this particular attack. For reasons that are not clear to me, Signal eliminated this feature.
IIUC, in those cases they could instead just open the Signal app.
Cellebrite specializes in breaking and extracting data from encrypted partitions, and (this is the important part) extracting keys from the secure keystore (Qualcomm/exynos).
From Cellebrite point of view, the data and keystore are already "given", all the remains is "breaking" the app encryption scheme, which in signal's case is trivial.
- (1) They are working on this, but it serves to limit spam, and it is easily comprehensible by the non technical.
- (2) You don't have to give it access, it works either way. If does its best to only use this for finding which of your contacts use Signal, rather than uploading the full address book.
- (3) client side crypto is supplied by the server, which fundamentally is a big problem for a system like Signal. Until web crypto is not a dumpster fire you can't do better. (I personally think allowing the Electron app is a huge mistake but it's their call.)
No one that actually knows even a tiny bit about how shit works believed the story for even a moment.
Au contraire, I would imagine a law enforcement or corporate investigator would knows the difference between encryption in transit and encryption at endpoints, and therefore be in the market for what Cellebrite has achieved (if they aren't using a competitor[1] already).
I think I've figured it out. A tiny little bit of it, anyway.
Imagine you're a multi-million (okay, multi-billion) dollar communications company. You're WhatsApp. Apple (iMessage). Facebook. Google (RCS).
You store trillions of messages.
In those trillions of messages, you are going to have the statistical >100.00% guarantee that there are chats and conversations between individuals and groups that would launch World Wars 4 through 16 if certain other individuals, groups, governments and so forth were to learn/verify that A did really say <thing> to B. The nuclear launch codes don't fit in a football anymore.
I have no hope of ever confirming the validity of that Bloomberg article about the alleged Supermicro hack. But it seems "well duh" simple enough to be concerningly plausible (custom silicon packaged in WLCSP or SC70, bit-twiddling SPI? Too easy... :S). As a technically-flawless plausibility, I say it can serve as a concrete reference example of a fraction of the persistent, sweeping, ruthless, and terrifying scale of the super-industrial, Eye Of Sauron-style attacks that these companies have very obviously been facing for some time now.
So, my possibly-not-really-a-conspiracy-theory-since-the-pieces-come-together-without-fantastic-levels-of-extrapolation theory is, someone stumbled on an idea one day, maybe in a stuffy committee meeting, or maybe in a bar, to solve the problem by giving the people what they wanted... end-to-end encrypt everything... and go from encryption at rest, which is basically nothing, to encryption everywhere; and you instantaneously divest the massive, massive burden of owning all that readable data.
True, now "accidentally" forgetting the `s` in backend URLs doesn't let the NSA read everything anymore, but that kind of pales in comparison to being able to incontrovertibly, mathematically prove that, since the data really is encrypted before it leaves the device, there really is no chance any readable plaintext is leaking and potentially being stored; so if the nation states would kindly take stock of this situation and point the coherence death ray beams elsewhere that would be great since we are kind of on fire here at the moment and it's too hOT we are meLTING--
Getting this to catch on was obviously difficult. Anybody that can scare multi-billion dollar companies obviously has the skill to steer collective opinion and impression at scale. Whoever came up with the idea to piggyback on top of individual privacy is... a task-focused genius, I'll put it that way. On the one hand, the idea has scaled beautifully: all the tech folks have gone "Is private. Respects freedom. Og like." and loudly pushed for the idea everywhere they can. And from a sociopolitical perspective, the narrative is faultless and blameless, which is where the genius definitely shines through.
The first bit I can't say I like is the narrative appearance of first-class support for end-to-end encryption as a Scientific Advancement™. It's not. It's an implementationally-scoped, crowd control spin campaign to increase datacenter security beyond what disk encryption at rest can ever achieve. The scale of wreckage in the form of technically minded people who really believe the privacy narrative is disillusioning to see.
The other bit that I find unamusing is the long-term shifts in the attack landscape that will result from this. Specifically the fact that, an Eye Of Sauron style adversary is not ultimately going to care what their attack target is, or how to attack it, only that it gets vaporised. End-to-end encryption shifts the burden of responsibility to the owner of the server to the owner of the client. I can see the positive angle here from a think-tank standpoint - literal decentralization as a defence strategy - but still, Android/iOS are now the focus of some laser beams that were terrifying a bunch of rather large companies. Maybe it'll seem reasonable to heavily fund the vulnerability research scene to maintain a favorable status quo, and we'll see some impressive hacks going forward (or, er, we won't). Or maybe things are already "that bad" and I don't have anything to worry about. But considering that users are now that much more responsible for devices that are interesting in a way they were never before, this whole strategy kinda feels irresponsible to me if you squint at it from a certain angle. At the same time, it might ironically be ensuring our survival.
In this picture, law enforcement really is the afterthought. It's well known the law court system doesn't understand technology and is 20 (40? 50?) years in the past. That situation extends beyond the courts though, with law enforcement generally in the same position. But it's worse than it may at first seem, because the notion of "the past" that refer to a collective public interpretation of "now" doesn't do justice to the technological development that has happened at these companies over the last 5-10 years - these private companies are internally fighting battles of a complexity that the public law enforcement system cannot hope to comprehend, let alone help with.
In this fight, the best way to avoid World War 4 is to encrypt everything. But Washington is still getting over how cool they handled the Cold War, and the police still think it's "hard" and "complicated" and "special" to "hack phones".
Don’t worry though; the Signal devs assure you that signed Android binaries from their website are reproducible [4]. As if checksum collisions aren’t something that state actors could trivially create [5].
I don’t trust Signal.
[1] https://github.com/signalapp/Signal-Android/wiki/F-Droid
[2] https://play.google.com/store/apps/details?id=org.thoughtcri...
[3] https://apps.apple.com/us/app/signal-private-messenger/id874...
Collision attacks are an issue when using md5/sha1, but I don't see how it's relevant in this case. If state actors wants to replace the signal apk with a backdoored one, they'll need to pull off a preimage attack, not a collision attack. A collision attack wouldn't be useful because you still need the original publisher to sign the apk for you, which seems unlikely considering OWS isn't a CA or anything. If OWS was compromised by state actors into signing, then they can just sign the backdoored version directly, no need for a collision attack.
The vast majority of non-technical users have no knowledge about hexadecimal file comparisons or checksums. They see an app that promises privacy, and they click download.
Or you can just run Signal Desktop exclusively without the hassle of smartphones[0]. Audio / video calls recently landed in Signal Desktop too[1].
[0]: https://ctrl.alt.coop/en/post/signal-without-a-smartphone/
As for hash collisions, as far as we know SHA256 hasn't been broken yet and even if it were broken you would need to be able to create a valid APK with Signal's code and the backdoor which hashes to the same thing as Signal.