Like if we could get some into the hands of the best reverse engineers in software and hardware, how difficult might it be to figure out the methods by which they gain access (aside from standard brute force and the like)? Are these unreleased zero day software exploits? Or something that anyone with enough knowledge of of the hardware system could implement with say a few million dollars and a small team of capable people? How are updates delivered? Do we know that the devices don't provide remote access to the vendor themselves?
https://signal.org/blog/cellebrite-vulnerabilities/
https://cyberlaw.stanford.edu/blog/2021/05/i-have-lot-say-ab...
There would be thousands, if not tens of thousands of people in the world who can do it. Its much harder to create the exploit than to reverse it.
Cellebrite UFED Cellphone Forensic Extraction Device Teardown https://www.youtube.com/watch?v=7LLGGCXH9MQ
UFED - its right in the name :] Video has little demonstration with older phones, one click bypass for all passcodes.
There are numerous ways for LE to view and manipulate your online experiences. Your phone can be viewed remotely like remote desktop over your cell connection without your knowledge. Defeating all end to end encryption in the process.
LE is given access to your application APIs and can control the results you get from job searches, your YouTube recommended videos and even the advertisements you are served.
Now you may think there are protections and they need a warrant. They do not in many cases. Most important to understand is that LE only has to follow the law and the rules if they want to use information they collect against you in court. Most requests do not go this far. So it is wide open for your information.
Even getting your phone and getting into it is easier than ever. However once you get here odds are it will face scrutiny in court.
I am hopeful a lot of this will continue coming out and being verified more officially. We live in a surveillance state and most people need to be educated about it.
I still cannot find any article about this incident explicitly mentioning not even a specific model, but just whether it was Android or iOS at all.
While most of them keep referencing that old San Bernardino story where the attackers had an iPhone with an outdated security model even for the time of the incident (it was iPhone 5c iirc).
0. https://9to5mac.com/2024/07/18/trump-shooter-android-phone-c...
Obscure Chinese brands made such android phones for few more years.
All Google Pixels (2016 and later), and virtually any android phone made after circa 2018 are safe from naive bootloader attack: user data is encrypted, plus you have to "OEM unlock" to even get the recovery to run.
The FBI made a note that they accessed the phone, shared widely etc, https://www.fbi.gov/news/press-releases/update-on-the-fbi-in... , there isn't any other information regarding the case.
They are designed precisely to prevent this kind of attack.
I bet most of the exploits used by these boxes have nothing to do with the secure element but just bypass security using exploits in standard system or USB code. Most phones will be captured with the OS running but just the UI locked, with all encrypted volumes already mounted.
But this is not how cellebrite boxes work anyway. They focus on the device.