Signal: Hacking Cellebrite from an Attacked Device

Cellebrite manufactures software to automate the extraction and indexing of data from mobile devices. They operate in a gray area where corporate branding goes side by side with digital intelligence, if you can call theft that way.





Their list of clients includes authoritarian regimes in Belarus, Russia, Venezuela and China; death squads in Bangladesh; military juntas in Myanmar; as well as those who crave violence and oppression in Turkey, the UAE and other countries.





A few months ago, they announced that they were adding Signal support to their software .





Their products have often been linked to harassment of journalists and activists around the world, but much less has been written about how their programs work and what they actually do . Since Cellebrite software is associated with security bypass, let's take some time to explore the security of their own software.





Background

First, everything about Cellebrite starts with someone else already holding your device in their hands. Cellebrite does not conduct data eavesdropping or remote monitoring. Their main software products are two (and both for Windows): UFED and Physical Analyzer.





UFED backs up your device to a Windows machine (basically, it is a frontend for adb backup



Android and a backup from iTunes to iPhone, with some extra data extracting). After creating the backup, Physical Analyzer then parses the files from the backup to display the data in a readable way.





ellebrite , Signal, , Physical Analyzer , Signal. Physical Analyzer , , Cellebrite.





- , , , . , Cellebrite , .





, ...

, , . , . , : "Cellebrite".





Cellebrite, , ( - , ), .





Cellebrite case on the side of the road.
Cellebrite .

, , , Cellebrite "" ("untrusted") , . , , Cellebrite , , , "" , Cellebrite "" , . .





ellebrite , , , Cellebrite .





, UFED Physical Analyzer, , , , , ellebrite. , .





( , ), FFmpeg, 2012 , . FFmpeg, ellebrite.





FFmpeg vulnerabilities by year.
FFmpeg .

, , Cellebrite, , , Cellebrite . , , .





, , ellebrite, Cellebrite , ( , , , , ), - . , Cellebrite.





, , Cellebrite , , , Cellebrite - . Cellebrite , , , ellebrite , .





, , Cellebrite , , , , , .





UFED ( Physical Analyzer). , UFED , Cellebrite. MessageBox Windows API, . ; , , , , (, !) Cellebrite.





, , Physical Analyzer MSI AppleApplicationsSupport64.msi



AppleMobileDeviceSupport6464.msi



. MSI Apple , , Windows iTunes 12.9.0.167.





MSI packages.
MSI-.

Physical Analyzer MSI- C:\Program Files\Common Files\Apple



. (DLL), , iTunes iOS .





DLLs installed on the system.
DLL-, .

Cellebrite iOS Advanced Logical Tool Apple iOS. , Apple UFED iPhone Logical.exe, iOS Advanced Logical Tool.





DLLs loaded into the process.
DLL-, .

, Apple ellebrite Cellebrite, ellebrite .





, Signal (App Storage). Signal , , .





, , .





We have several different versions of files that we find aesthetically pleasing, and we will slowly iterate over them over time. These files have no other purpose.








All Articles