SoylentNews

takyon writes:

The Washington Post reports that the FBI did not require the services of Israeli firm Cellebrite to hack a San Bernardino terrorist's iPhone. Instead, it paid a one-time fee to a group of hackers and security researchers, at least one of whom the paper labels a "gray hat". It's also reported that the U.S. government has not decided whether or not to disclose to Apple the previously unknown vulnerability (or vulnerabilities) used to unlock the iPhone (specifically an iPhone 5C running iOS 9):

The FBI cracked a San Bernardino terrorist's phone with the help of professional hackers who discovered and brought to the bureau at least one previously unknown software flaw, according to people familiar with the matter. The new information was then used to create a piece of hardware that helped the FBI to crack the iPhone's four-digit personal identification number without triggering a security feature that would have erased all the data, the individuals said.

The researchers, who typically keep a low profile, specialize in hunting for vulnerabilities in software and then in some cases selling them to the U.S. government. They were paid a one-time flat fee for the solution.

[...] The bureau in this case did not need the services of the Israeli firm Cellebrite, as some earlier reports had suggested, people familiar with the matter said. The U.S. government now has to weigh whether to disclose the flaws to Apple, a decision that probably will be made by a White House-led group.

FBI Director James Comey told students at Catholic University's Columbus School of Law that "Apple is not a demon," and "I hope people don't perceive the FBI as a demon." What a saint.

Original Submission

stormwyrm writes:

BBC technology correspondent Rory Cellan-Jones has met with representatives of the Israeli company Cellebrite, which helps police forces gain access to the data on the mobile phones of suspected criminals. They were rumoured to have aided the FBI in gaining access to the iPhone used by the San Bernardino shooter (though some reports contradict this). From the article:

It's an Israeli company that helps police forces gain access to data on the mobile phones of suspected criminals.

Cellebrite was in the headlines earlier this year when it was rumoured to have helped the FBI to crack an iPhone used by the San Bernardino shooter.

Now the company has told the BBC that it can get through the defences of just about any modern smartphone. But the firm refuses to say whether it supplies its technology to the police forces of repressive regimes.

[...] Mr Ben-Moshe claimed that his firm could access data on "the largest number of devices that are out there in the industry".

Even Apple's new iPhone 7?

"We can definitely extract data from an iPhone 7 as well - the question is what data."

He said that Cellebrite had the biggest research and development team in the sector, constantly working to catch up with the new technology.

He was cagey about how much data could be extracted from services such as WhatsApp - "It's not a black/white yes/no answer" - but indicated that criminals might be fooling themselves if they thought any form of mobile communication was totally secure.

Original Submission

BK writes:

According to the New York Post:

Cellebrite, an Israeli firm that supplies "forensics tools" to agencies around the world, including US law enforcement, appears to have suffered a serious hack. Motherboard claims to have 900GB of Cellebrite data, supplied to it by an anonymous hacker. Among other things, the data reportedly shows that the Israeli firm has been selling its technology to regimes known for their human rights abuses, including Turkey, the United Arab Emirates and Russia.

According to Motherboard:

The breach is the latest chapter in a growing trend of hackers taking matters into their own hands, and stealing information from companies that specialize in surveillance or hacking technologies.

Cellebrite is an Israeli company whose main product, a typically laptop-sized device called the Universal Forensic Extraction Device (UFED), can rip data from thousands of different models of mobile phones. That data can include SMS messages, emails, call logs, and much more, as long as the UFED user is in physical possession of the phone.

New York Post Again:

Cellebrite is best known for its rumored involvement in helping the FBI crack the San Bernandino shooter's iPhone, as Apple fought an order to assist through the courts. In addition to helping the FBI in that case, Cellebrite sells forensics devices and software to dozens of US law enforcement agencies and police departments.

Original Submission

takyon writes:

The FBI will not have to disclose the name of the vendor that it paid to hack into an iPhone used by one of the San Bernardino terrorists:

A federal court ruled yesterday that the FBI does not have to disclose either the name of the vendor used or price the government paid to hack into the iPhone SE of mass shooter Syed Farook, according to ZDNet. The device became embroiled in a heated national controversy and legal standoff last year when Apple refused to help the FBI develop a backdoor into it for the purpose of obtaining sensitive information on Farook and his wife Tashfeen Malik, both of whom participated in the terrorist attack that left 14 dead in San Bernardino, California in December 2015.

The Justice Department originally filed a lawsuit against Apple to compel it to participate by creating a special version of its mobile operating system, something Apple was vehemently against because of the risk such a tool posed to users. But very soon after, the government withdrew from the case when a third-party vendor secretly demonstrated to the FBI a workable method to bypass the iPhone's security system. Three news organizations — the Associated Press, Vice News, and USA Today — filed a Freedom of Information Act lawsuit in September 2016 to reveal details of the hacking method used. Because it was not clear how many phones the workaround could be used on, and whether the FBI could use it surreptitiously in the future, the lawsuit was seeking information that would be pertinent to the public and security researchers around the globe.

But it's probably Cellebrite.

Previously: Washington Post: The FBI Paid "Gray Hat(s)", Not Cellebrite, for iPhone Unlock
FBI Can't Say How It Hacked IPhone 5C
Meeting Cellebrite - Israel's Master Phone Crackers
Cellebrite Appears to Have Been Hacked
Senator Dianne Feinstein Claims That the FBI Paid $900,000 to Break Into a Locked iPhone

Related: FBI Resists Revealing its Tor User Identification Methods in Court

Original Submission