Hacker Leaks Cellebrite's Phone-Hacking Tools
In January we learned that a hacker broke into Cellebrite’s network and stole 900GB of data. Now the hacker has dumped some of Cellebrite’s phone-hacking tools on the Internet.
In their README, the hacker notes much of the iOS-related code is very similar to that used in the jailbreaking scenea community of iPhone hackers that typically breaks into iOS devices and release its code publicly for free.
Jonathan Zdziarski, a forensic scientist, agreed that some of the iOS files were nearly identical to tools created and used by the jailbreaking community, including patched versions of Apple’s firmware designed to break security mechanisms on older iPhones. A number of the configuration files also reference “limera1n,” the name of a piece of jailbreaking software created by infamous iPhone hacker Geohot. He said he wouldn’t call the released files “exploits” however.
Zdziarski also said that other parts of the code were similar to a jailbreaking project called QuickPwn, but that the code had seemingly been adapted for forensic purposes. For example, some of the code in the dump was designed to brute force PIN numbers, which may be unusual for a normal jailbreaking piece of software.
“If, and it’s a big if, they used this in UFED or other products, it would indicate they ripped off software verbatim from the jailbreak community and used forensically unsound and experimental software in their supposedly scientific and forensically validated products,” Zdziarski continued.
If you remember, Cellebrite was the company that supposedly helped the FBI break into the San Bernadino terrorist iPhone. (I say “supposedly,” because the evidence is unclear.) We do know that they provide this sort of forensic assistance to countries like Russia, Turkey, and the UAE—as well as to many US jurisdictions.
As Cory Doctorow points out:
…suppressing disclosure of security vulnerabilities in commonly used tools does not prevent those vulnerabilities from being independently discovered and weaponized—it just means that users, white-hat hackers and customers are kept in the dark about lurking vulnerabilities, even as they are exploited in the wild, which only end up coming to light when they are revealed by extraordinary incidents like this week’s dump.
We are all safer when vulnerabilities are reported and fixed, not when they are hoarded and used in secret.
Slashdot thread.
Subscribe to comments on this entry
r • February 6, 2017 7:10 AM
One hand watches the other; Timex, Rolex, Apple.
Your words, will escape you. They will come home to roost in other’s, oblivious to their creators intent.
Even if you’re here for what you view as the good of humankind, other human’s have other ideas and publication means a loss of control.
Information is agnostic to the barriers we construct in our minds, it’s the reverse plaster cast of your hand when you were 12 held up for all to see fingerprint and all.