Signal CEO Hacks Cellebrite iPhone Hacking Device Used by Cops

vice.com

19 points·gmemstr··5 comments

> I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite.

While I'm skeptical of the method of acquisition, would be interesting if they actually got the hardware and could publish details.

Update : other news outlets reporting with more details, but not confirmation [0]

[0] https://arstechnica.com/information-technology/2021/04/in-ep...

It's a tongue-in-cheek English saying which implies that the item was stolen.

> Along with his colleagues, Marlinspike analyzed the device and found that it included several vulnerabilities that could allow an attacker to include an "otherwise innocuous file in an app" that when it gets scanned by a Cellebrite device exploits it and tampers with the device and the data it can access.

> Marlinspike published details about the exploits outside of normal "responsible disclosure" guidelines and suggested that he is willing to share details of the vulnerabilities as long as Cellebrite does the same with all the bugs the company uses to unlock phones, "now and in the future."

Pretty sure Cellebrite isn't going to do that because of their business model.

> In their analysis of the device, Signal researchers also found that it contained packages signed by Apple, and likely extracted from the Windows installer for iTunes version 12.9.0.167. According to Marlinspike, this could be a copyright violation.

I like to know how Apple will react to this!

The whole article has a subtle undercurrent of sarcasm and mirth; they clearly don't expect Cellebrite to disclose the vulnerabilities they use. They're just poking fun at them.

"It fell off the back of a truck" XD

Reply on news.ycombinator.com