Hacker News Reader

Comment by c80e74f077 | Hacker News Reader

DeepL Translation: According to documents obtained by Disclose and Der Spiegel from European institutions, the Swedish company MSAB has provided the Moroccan police with a software called XRY capable of unlocking all types of smartphones to extract data from calls, contacts, location, but also messages sent and received by SMS, WhatsApp and Signal. As for Oxygen forensic, domiciled in the United States, it has delivered a data extraction and analysis system called "Detective". What makes it special? Bypassing screen locks on mobile devices in order to extract information stored in the cloud (Google, Microsoft or Apple) or secure applications on any phone or computer. The notable difference with Pegasus software is that both software require physical access to the mobile device to be hacked, and do not allow remote monitoring.

View on HN

Both XRY and Oxigen are AFAIK "common" and "established" forensics tools, unless the versions provided to Morocco are "special" there is nothing particularly "alarming" or "new/revolutionary", let alone "secret" about them,

https://www.msab.com/

https://www.oxygen-forensic.com/en/

Some products may be reserved to Law Enforcement or Licensed investigators, but I believe that's all.

Which is fair play.

I fully expect authorities from any countries to try to get evidences from physical access to electronic devices in the case of criminal investigation. Just like they can go into ones house and open safes with a torch if a judge allows it.

The problem is mass surveillance, not getting data about someone under arrest.

Of course, I unfortunatly also fully expect them to abuse that and use it outside of criminal investigations, without the knowledge of said person.

No, the problem is backdoors and misleading information.

That as well.

Apple may state that their enclave is secure, the existance of such tools and the fact they were part of PRISM hints that they are like all others: open to those with a lot of resources.

So does that mean that all phone manufacturers are essentially selling snake oil when it comes to device security?

Yes and no.

The manufacturers do their best to protect the users, but when it comes to criminal investigations there are tools[0] that can often make access to smartphone (or computers) data possible.

These tools are often prohibitively expensive and/or only licensed to LEO's (Law Enforcement Officers) and cannot unlock/access "everything", so there is no real "privacy risk" connected to them unless you are charged with a criminal offence and/or arrested.

To give you an example there are cases where an iPhone can be unlocked by two (AFAIK) different tools, one is made by Cellebrite that charges an awful amount of money for each unlock, and the other is Graykey that wants as well a lot of money but you can buy the "unlimited" option:

https://www.forensicfocus.com/forums/mobile-forensics/grayke...

both are only given to authorized investigators (Police/Government) only.

Of course it is possible - in theory - that someone malicious manages to get their hands on one of them and then proceeds to steal the phone from you, and then can afford to spend anything between 3,000 and 10,000 US$ to unlock it and access your data, but I find it improbable.

[0] until the manufacturer patches (if patchable) the vulnerability, and then the race starts to find a new one

Kinda. But physical access is a big barrier.

I am really surprised they don't do much against Pegasus though. I'm sure the agencies involved know what exploits it uses by now.

I guess because western powers use these tools too is why they don't lock them out.

Peagasus is an evolving product. Probably the early versions are useless these days.

https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_...

I wouldn't be surprised if it hasn't always been at full effectiveness on all platforms, as vulnerabilities are patched and others discovered.

Reply on news.ycombinator.com