After the cellphone hacking company Cellebrite said it had figured out a way to access the secure messaging app Signal, Signal said in a blog post that it has turned the tables. The app's creator Moxie Marlinspike claimed that his team obtained Cellebrite's hacking kit and discovered several vulnerabilities. He then implied that Signal will update the app to stymie any law enforcement attempts to hack it.
Cellebrite sells a suite of "data analysis devices" called UFED that allows law enforcement to break into iOS or Android phones and extract messaging logs, call records, photos and other data. The app was most famously used by the FBI to unlock the iPhone of the San Bernardino shooter back in 2016-17, reportedly paying up to $900,000 for the tools.
Marlinspike managed to obtain a Cellebrite UFED, complete with the software and hardware dongle, joking that it fell off a truck while he was out for a walk. (Older versions of the devices have popped up on eBay and other sites in the past.)
He noted that it used some old and out-of-date DLLs, including a 2012 version of FFmpeg and MSI Windows installer packages for Apple's iTunes program. "Looking at both UFED and Physical Analyzer, though, we were surprised to find that very little care seems to have been given to Cellebrite’s own software security," he wrote.
Signal's team found that by including "specially formatted but otherwise innocuous files in any app on a device" scanned by Cellebrite, it could run code that modifies the UFED report. For instance, it could potentially insert or remove text, email, photos, contacts and other data while leaving no trace of the tampering.
In a tweet (above), Signal demonstrated the hack in action, with the UFED parsing a file formatted to run code and display a benign message. However, the company said that "a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports, or exfiltrate data from the Cellebrite machine." Marlinspike then implied that it might install such code within Signal to foil future Cellebrite extraction attempts by law enforcement.
Signal released details about the supposed Cellebrite vulnerabilities without giving the company any warning, but said it would change tack if Cellebrite reciprocated. "We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future."
Cellebrite told Ars Technica that it "is is committed to protecting the integrity of our customers’ data, and we continually audit and update our software in order to equip our customers with the best digital intelligence solutions available." Signal's claims should be treated with some skepticism without seeing more details around the hack, along with confirmation by other security experts.
All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
via https://AiUpNow.com April 22, 2021 at 05:30AM by , Khareem Sudlow,
