If you're gonna pwn, pwn hard

[Syonyk]

Oh man.

Dying laughing over here.

So, Signal is that comms tool created by Moxie Marlinspike, who has… shall we say, a unique sense of humor and a sporting sense of style.

Cellebrite is one of those “Phone Forensics Extractor Tools” used by police everywhere to find evidence of whatever on various phones.

The two met, and it was quite hysterical.

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an...

Summary: You can place a file on a phone that runs arbitrary code on the Cellebrite analysis workstation.

A couple choice quotes…

By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite. Inside, we found the latest versions of the Cellebrite software, a hardware dongle designed to prevent piracy (tells you something about their customers I guess!), and a bizarrely large number of cable adapters.

Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned. There are virtually no limits on the code that can be executed.

For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.

We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future.

It seems unlikely to us that Apple has granted Cellebrite a license to redistribute and incorporate Apple DLLs in its own product, so this might present a legal risk for Cellebrite and its users.

In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files.

I enjoyed the read. And might just keep Signal around!

[Symbioquine]

Certainly seems like Signal scored a win there.

Too bad the Cellebrite IPO isn’t done yet. It would have been interesting to see if this has a visible effect on their valuation…

[bombcar]

This makes up for signal doing stupid stuff with a coin imo.