In a post from your blog, the founder of encrypted messaging app Signal, Moxie Marlinspike, described how he found vulnerabilities in a device that could hack Signal, the Cellebrite. Cellebrite became known in Brazil recently when it was used to recover deleted messages between councilor Dr. Jairinho and Monique Medeiros, accused of the murder of the boy Henry Borel.
Device to perform the hack was found by chance by Signal
In an incredible “stroke of luck,” Marlinspike said he found a Cellebrite device that had fallen off a truck in the street. Coincidentally, the Israeli security firm announced a few months ago that it had added support for hacking Signal in your software.
Image via Signal
As Marlinspike explained in the post: “By including a specially formatted but harmless file in an app on a device that will be scanned by Cellebrite, it is possible to execute code that modifies not only the Cellebrite report generated from those scans, but also past and future Cellebrite reports for all scanned devices in any arbitrary way (inserting or removing text, emails, photos, contacts, files, and any other type of data), without detectable timestamps or checksum failures. This can even be done randomly, which calls into question the integrity of Cellebrite reports.”
To prove their point, the Signal team used a Windows message window in Cellebrite to bring up the message “Mess with the best, die like the rest. hack the planet!”
In a reply email to ArsTechnica, a spokesperson for the Israeli company wrote: “Cellebrite is committed to protecting the integrity of its customers’ data, and we continually audit and update our software to equip our customers with the best digital intelligence solutions available.” The spokesperson did not directly address the issue of the company’s device being hacked by the Signal team.
In his post about the hack, Marlinspike points out that Cellebrite also makes its services available to authoritarian regimes to persecute their opponents. It seems like the tables have turned, doesn't it, Cellebrite?
Through which channels you reach those people, classic and out of the box. The Next Web
Image: Nahel Abdul Hadi/Unsplash/CC
