Searching this thread shows it wasn't posted yet. Hope that's the case. The original Bloomberg (18/07) and WP (16/07) articles are behind a paywall (Bloomberg archived here) but The Verge recap was posted shortly after.
Published last Friday, July 19, 2024
There is one problem though. As with Pegasus, it's almost certain that Cellebrite's UFED tools can not only extract data from password protected devices but they can also change (and plant?) the data.
This was reported by The Telegraph back in 2021:
Some technicalities from Wiki:
MintPress commented:
Cellebrite allegedly "fixed the vulnerability" but it's quite reasonable to assume that that feature was not accidental and may still be part of a "special offer" per friendly request. And given the changing reports on what was found on Crooks' Samsung, I wouldn't exclude the possibility that like with most "info" about the event, it's all "work in progress" with many mishaps on the way.
Published last Friday, July 19, 2024
The FBI got into the Trump rally shooter’s phone in just 40 minutes
The shooter reportedly had a newer Samsung phone.
www.theverge.com
The FBI used an unreleased tool from the Israeli mobile forensics company Cellebrite to unlock the Trump rally shooter’s phone — and opened it in less than an hour, according to reports from Bloomberg and The Washington Post.
Investigators at the FBI’s Pittsburgh field office first tried to open Thomas Matthew Crooks’ phone with a Cellebrite tool but weren’t able to break into it. The phone was sent to the FBI lab in Quantico, Virginia, on Sunday, where agents called Cellebrite’s federal team, people familiar with the investigation told Bloomberg. Cellebrite sent the FBI an unreleased tool that’s still in development, which was able to unlock Crooks’ phone in 40 minutes.
The Verge has reached out to Cellebrite for comment. The FBI declined to comment.
The speed with which the FBI was able to unlock Crooks’ phone is illustrative of the advancements in mobile device forensic tools (MDTFs) in recent years — but the fact that investigators couldn’t crack the phone using tools currently on the market shows how developments in operating systems can quickly render these tools obsolete.
Crooks had a newer Samsung phone that runs on an Android operating system. Internal Cellebrite documents obtained by 404 Media show that the Cellebrite tools currently on the market have failed to unlock many phones running iOS 17.4 or newer, as well as Google Pixel 6, 7, and 8 phones that have been turned off.
In a briefing with members of Congress on Wednesday, the FBI said Crooks had searched for the dates of former President Donald Trump’s public appearances, as well as the dates of the Democratic National Convention in Chicago, according to various media reports. Crooks also reportedly looked up prominent figures, including FBI Director Christopher Wray and Attorney General Merrick Garland.
According to media sources, FBI officials also said they found a Steam profile they believed belonged to Crooks and that Crooks posted an ominous warning message ahead of the shooting that read, “July 13 will be my premiere, watch as it unfolds.” CNN later reported that investigators now believe the account is fake.
The FBI said it found the Trump rally shooter’s Steam account, then took it back
Officials have yet to determine a motive for the shooting.
www.theverge.com
There is one problem though. As with Pegasus, it's almost certain that Cellebrite's UFED tools can not only extract data from password protected devices but they can also change (and plant?) the data.
This was reported by The Telegraph back in 2021:
Moxie Marlinspike, the chief executive of encrypted messaging app Signal, published a blog in which he outlined a vulnerability that could change messages as Cellebrite extracted them, potentially ruining critical evidence.
Some technicalities from Wiki:
In 2021, Moxie Marlinspike, creator of the encrypted messaging app Signal, pointed to a number of vulnerabilities in Cellebrite's UFED and Physical Analyzer software that allowed for arbitrary code execution on Windows computers running the software. One exploit he detailed involved the UFED scanning a specially formatted file which could then be used to execute arbitrary code on the computer running the UFED. Marlinspike wrote that the code could then "[modify] not just the Cellebrite report being created in that scan, but also "all previous and future generated Cellebrite reports" from all previously scanned devices and all future scanned devices in any arbitrary way"
MintPress commented:
Cellebrite’s customers include law enforcement agencies in Colombia, including the national police, law enforcement in Mexico, and Argentina’s border patrol. Law enforcement often relies on Cellebrite to extract mobile data and use it for evidence, raising legal and security concerns. Moxie Marlinspike, founder of encrypted messaging app, Signal, claimed Cellebrite’s software is unreliable and the data can be corrupted — potentially putting innocent people behind bars.
Cellebrite allegedly "fixed the vulnerability" but it's quite reasonable to assume that that feature was not accidental and may still be part of a "special offer" per friendly request. And given the changing reports on what was found on Crooks' Samsung, I wouldn't exclude the possibility that like with most "info" about the event, it's all "work in progress" with many mishaps on the way.