“In what appears to be a major breakthrough for law enforcement, and a possible privacy problem for Apple customers, a major U.S. government contractor claims to have found a way to unlock pretty much every iPhone on the market,” Thomas Fox-Brewster writes for Forbes.
“Cellebrite, a Petah Tikva, Israel-based vendor that’s become the U.S. government’s company of choice when it comes to unlocking mobile devices, is this month telling customers its engineers currently have the ability to get around the security of devices running iOS 11,” Fox-Brewster writes. “That includes the iPhone X, a model that Forbes has learned was successfully raided for data by the Department for Homeland Security back in November 2017, most likely with Cellebrite technology.”
“Forbes was told by sources (who asked to remain anonymous as they weren’t authorized to talk on the matter) that in the last few months the company has developed undisclosed techniques to get into iOS 11 and is advertising them to law enforcement and private forensics folk across the globe,” Fox-Brewster writes. “Speaking about the latest developments, Electronic Frontier Foundation senior staff attorney Adam Schwartz said the way in which the government did business with the likes of Cellebrite was ‘of great concern.’ He said it was clear that Cellebrite was hoarding vulnerabilities rather than disclosing them to vendors like Apple, which would lead to patches and better security for the general public. “All of us who’re walking around with this vulnerability are in danger,” he added.”
Read more in the full article here.
MacDailyNews Take: What’s preventing Apple from simply buying Cellebrite and patching whatever vulnerabilities they find?
Apple should simply buy Cellebrite and other entities like it and task these newly acquired engineers with hardening iPhone to ridiculously hack-proof levels. — MacDailyNews, March 24, 2016
Furthermore, the simple act of Apple acquiring Cellebrite will be a marketing coup as any doubts about iPhone security will be immediately erased. — MacDailyNews, March 29, 2016
SEE ALSO:
Apple’s new challenge: Learning how the U.S. cracked terrorist’s iPhone – March 29, 2016
Did the FBI just unleash a hacker army on Apple? – March 29, 2016
Apple declares victory in battle with FBI, but the war continues – March 29, 2016
Apple vows to increase security as FBI claims to break into terrorist’s iPhone – March 29, 2016
U.S. government drops Apple case after claiming hack of terrorist’s iPhone – March 29, 2016
Meet Cellebrite, the Israeli company reportedly cracking iPhones for the FBI – March 24, 2016
Good we need to put criminals behind bars and send to execution terrorists. The governments never going to have my iPhone because i am not making a crime.
tactileman,
Perhaps we should also abolish the other inconvenient parts of the Bill of Rights. Trials are expensive and sometimes result in a not-guilty verdict. Giving the government the right to conduct summary executions would be much cheaper and better (for the government).
You are “not making a crime” only because the government has not yet chosen to define anything you do as a crime. That could change tomorrow… and probably would if the government had arbitrary power without any checks or balances.
Sadly, we’ve seen that some administrations are willing to bend the rules for political gain. After further insight into the actions behind the FBI and Justice Department in late 2016, we should all feel uncomfortable with any increased power for the government.
If Cellebrite has agreements in place with the US Gov’t, Apple acquiring them would mean they have to hack their own stuff for the Feds.
Then just have a shell company buy Cellebrite .. and their contract terms are to be the firewalled one way pass-through back to Apple for where the OS holes are.
What a bunch of fearmongering in these responses. I’m 60 frickin’ years old, definitely NOT a luddite, and have no fear that ‘the government’ is going to suddenly institute draconian, ridiculous laws tonight to use against me tomorrow.
you didn’t learn much in sixty years.
This solution is something which intelligent, law abiding people should feel comfortable about.
On a number of occasions I have proposed that governments should undertake massive projects comparable to the WW2 Bletchley codebreakers which enabled the Brits to read Nazi communications encoded via the Enigma machines. In this case, a private company appears to have taken on that challenge. The alternative would likely be that legislators would pass laws requiring encryption technology to have an official back door.
The reason why I think that solutions of this sort are the best way forward is that there are always going to be occasions where important evidence is believed to be within a locked smartphone. At the moment, the authorities use emotionally charged incidents to push the argument for obliging every company to create a back door for use by law enforcement agencies. This sort of solution which is believed to be offered by Cellebrite is likely to be very costly and probably requires a certain amount of expertise, together with physical access to the device. Therefore it would only be a practical option in connection with serious crimes. There is little prospect that ordinary citizens will have the contents of their iPhones examined under routine circumstances. This is a much safer option than legislating for a back door because back doors could be accessed remotely by criminals without the user even knowing.
If you believe that governments will not allow manufacturers to continue to sell smartphones which they cannot access under any circumstances, then having a solution which is expensive and requires possession of the device is the least dangerous option.
You mean like building a wall on our borders? Didn’t work very well for East Germany or the Chinese.
But actually works very well for the Israelis.
In the short term it seems to have worked (Israel’s Wall), but I wonder about it over time. The geography and demographics of the Levant do not look encouraging for such a policy.
Don’t remember people trying to get into East Germany.
No they were trying to get into West Germany. I was there and saw it with my own eyes in the US Army.
Got to stand on the border- the real one, not the fence.
My wife was born and brought up in East Germany. She fled to the west just a few days before the Berlin Wall came down. We’re visiting that area again in June, having been there for a couple of weeks at Christmas.
The wall and border fortifications were pretty good at stopping people getting across, after all there were minefields and lethal booby traps which were effectively automatic guns in addition to all the machine gun emplacements and observation posts, but the bottom line was that it was unsustainable and is now regarded as a futile exercise in trying to stop the inevitable.
One tiny correction. They weren’t necessarily trying to get into West Germany, they were primarily wanting to get out of east Germany.
My wife travelled from east Germany to Hungary and then on to England. She didn’t specifically want to live in England, but wanted to learn the language properly and see what it was like. As it happened, she liked the place and stayed put, but there were a whole bunch of other countries which she fancied visiting, many of which we have recently been able to visit.
Oh, you mean like the way they rammed the “Patriot Act” through Congress? Or the National Security Agency’s warrant-less surveillance program, or they way they just renewed it? Or the law that was also rammed through Congress that allows the government to purchase your browsing history? I mean, I don’t know anything about you, or what you just purchased on Amazon, or what size jeans you wear, or what your “proclivities” are, but Congress can now purchase your entire browsing and purchasing history. All these laws are rammed through Congress without a majority of Congressmen and women even knowing the provisions within them. Or how it’s none of their damn business knowing what you do on the internet, or what is on your iPhone. And who knows what else our government is doing to spy on us that does not even need the approval of Congress—things that are done in the name of “National Security.”
Whether the Government is coming after you, per se, Americans have a right to privacy that seems to be ever-more eroded as time passes.
Everyone’s a Criminal: More Laws Passed Than Can Be Read?
Not to sound Andy Rooney-ish, but have you ever really thought about how many laws govern your existence? There are so many laws out there that nobody really knows how many there are.
… Secondly, and even more sinister, is the fact that since there are probably 1,000 times more laws on the books than are known to the citizenry, it all but ensures that everyone’s guilty of something . And in the government’s eyes, it’s good that virtually everyone is a criminal of one type or another. Here’s why: Because if you ever challenge any part of the government — the Housing Department, the Board of Education, the Bureau of Licensing and Regulation, the Election Board, the DNR, the DMV, the BLM, or whatever — it’ll be able to find something, maybe many things, you’re guilty of…
– Jim Amrhein
Well if you cross the border, your phone might be snoop in without cause even if you did not do a single crime in your live.
Wouldn’t crossing the border be crime number one? Then whatever illegal action taken be crimes, 2,3,4, etc.?
Non Citizen Federal Crimes:
Non citizen illegal aliens are about 7% of the US population, yet they commit:
22% of murder
18% of fraud
33% of money laundering
29% of drug trafficking
72% of drug possession
GAO report GAO-06-646R found the illegals commit between 3.5 to 5 times the crimes as the average citizen.
Federal Prisons in May 2017
188,658 inmates. 41,554 illegal aliens, plus 5101 more awaiting adjudication.
Out of all of the arrests:
12 percent were for violent crimes such as murder, robbery, assault and sex-related crimes
15 percent were for burglary, larceny, theft and property damage
24 percent were for drug offenses
and the remaining offenses were for DUI, fraud, forgery, counterfeiting, weapons, immigration, and obstruction of justice.
“Every crime committed by an illegal alien is one that would not have occurred if that alien wasn’t in the United States in the first place.”
“Every gun fired would not have killed children if there weren’t guns in the United States in the first place.”
And every drunk driver with alcohol, every knife with every cut, every cigarette, every every every thing else.
If there weren’t guns allowed in the US, only criminals would have them and the rest of us could not defend ourselves. A law doesn’t stop people from crossing the border, buying meth or copying movies. Do you really think that if guns were outlawed the “bad guys” would turn theirs in? Nope. But, the newly defenseless law abiding people would have to. If someone broke into your house (and they did mine when I was at home alone making pizza in the kitchen for when everybody else got home), how would you defend yourself? Words?
If we have no-fly lists to prevent suspected terrorists from getting onto planes, why not have no-gun lists to prevent people with certain criteria deemed risky/dangerous (prior history of violence, mental problems, etc.) from purchasing guns. A driver’s license requires written and practical tests. A gun license may need to have similar criteria.
You need to seriously go watch the movie ‘Red Dawn’ you turd.
Nonsense. That’s all I’ll say, nonsense.
Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety.
— Benjamin Franklin, Historical Review of Pennsylvania, 1759
Power corrupts; absolutely power corrupts absolutely.
I find it really scary that anybody would quote someone from 1759 on a specific situation that exists in 2018 and deems it to be unquestionable in its relavence. How far do we go back with this logic before we accept that their views were dictated by an environment and knowledge totally different to present day circumstances. Do we take these people’s views on slavery as right now or do we just pick and choose to suit our existing opinions? Do we go back and accept that Mohamed claimed salt and fresh water don’t mix so it must be true when more up to date knowledge informs us it’s it’s totally erroneous despite the gist earthers demanding obeyance. Or if what one once said 250 years back in history governed by their experiences at the time, is so unquestionably analogous to today’s society can we not ask why Benjamin Franklin didn’t give us his views on the smart phone rather than simply some apparent philosophical argument as to the morality of its use?
The words may be 250 years old, but they’re lasting and completely relevant today. We see the affects of invasive gov’t today in places like Russia and North Korea- where their citizens were promised protection at the expense of sinister and covert ‘selling of their souls to the man’. Need we mention Hitler? There was history before our Founding Fathers which compelled them to act and speak the way they did. History of totalitarian gov’t is perpetual- history very much repeats itself in this sense. Slavery was a passing phase in America, and more complex than we’re lead to believe these days (simply because people don’t remember the nuances of historical reference, nor do they care). Yet we still have human rights abuses and genocidal tendencies in this world- these acts originated somewhere guided by some ideology and advanced by some power, right? History tends to repeat itself in broad strokes, and humans have very short memory spans. But hey, let’s just trash the whole Constitution- it’s probably not relevant anymore.
It is probably worth mentioning the original context of the Ben Franklin quote yet again:
Near the end of the 1750s, during the Seven Years’ War between the French and British empires (known over here as the French and Indian War), the Pennsylvania Colony was facing increasing danger from Canada and its allied native tribes. The colonial legislature passed a tax bill to pay for the troops guarding Pennsylvania.
Not surprisingly, the bill was opposed by the major landowner/taxpayers in the colony, particularly by the Penn family. They convinced the Governor to veto the bill, arguing that the elected legislature had no authority to impose taxes without Crown authority (which would be withheld without the oligarchs’ consent).
That caused a “constitutional crisis,” which the landowners proposed to settle by making a voluntary payment sufficient to finance the defense of the colony, in exchange for the legislature’s acknowledgment that it did not have authority to impose a mandatory tax. The legislature (and the people of Pennsylvania) refused to back down, notwithstanding the imminent danger of invasion. Eventually, the landowners and Governor blinked.
So, when Franklin spoke of “purchasing a little temporary safety,” he was talking literally about a financial payment to defend against an imminent public danger. When he spoke of “giving up essential liberty,” he was talking about the essential right of the people of Pennsylvania, through their elected representatives, to assess taxes and collect them from the wealthy.
So the quote was not originally about the right of individuals to protect their personal liberties from government invasion, but exactly the opposite. It was about the right of a representative government to adopt laws and enforce them against unwilling individuals.
That bears further reading. Thank you! This would indicate that the quote has been used incorrectly almost every time I’ve seen it.
Spyintheskyuk hit the nail on the head. That quote by Benjamin Franklin in no way fits this (or so many other) situations in which it is sited. The words sure look good, but they are soooo taken out of context.
MDN…
Not judging but you are aware the government can block such a sale or even the legitimate import, right?
Actually, no, the government cannot block such a small purchase of Cellebrite as a company. There is no government law that would prevent it. There is no possible anti-trust component that would be involved, which is the only thing that the government would have oversight that would enable them to prevent acquisition.
Not on anti trust, but on national security. Also Cellebrite is not a US company.
“What’s preventing Apple from simply buying Cellebrite and patching whatever vulnerabilities they find?”
Several reasons off the top: Cellebrite doesn’t want to sell the company; They make more money off the attention and services they provide for such a ‘difficult’ to crack device.; They make Apple second guess their security and possibly create new vulnerabilities in the process..
Easily solved. Issue a firmware update that renders their technique useless (not that hard).. and offer them through a foriegn subsidiary $500 million for the company. At the same time prepare legal action against them (it doesn’t matter who is wrong or right the legal fees to a tiny company like that would be enormous). The carrot and the stick.
I suppose if Apple knew how Cellebrite did their unlocking creating the ‘fixed’ firmware would be simple. As it is, it seems Apple does not currently know how so developing said firmware would be a ‘shotgun’ approach that may introduce a whole slew of other vulnerabilities. More complex systems tend to have more points of vulnerability if changes made are not fully comprehended.
Well. that’s ios 11 and ios12 was ALREADY supposed to offer higher security http://www.businessinsider.com/apple-ios-12-update-features-release-date-iphone-ipad-2018-1
Cellebrite is a sub of Sun whose market value is around $16 billion. Apple could easily buy them and Sun has been pissing Apple off for some time now http://fortune.com/2016/03/29/fbi-iphone-stock-suncorp/ so should a $900 billion plus company buy a $16 billion company to protect its security and shore up its Asian presence and hosting revenue stream (that’s where Sun gets most of its money from now).
I suppose Apple could try to buy out controlling shares of Sun Corp. but I don’t think they’ll make it easy if they don’t want to be bought. “Poison Pills” are still a thing right?
Another “wrench” to trying to take over Sun Corp. may possibly be Yakuza connections stemming from involvement in the Pachinko industry.
Since iOS 12 has yet to be released we still don’t know if the vulnerability in question has been remedied.
If Cellebrite has this tech it’s worth exponentially more than $500 million, major intel services would pay billions for access to this. The company is almost certainly a front for Israeli intel, so it’s not going to be sold.
Nick.. you are right. I misjudged it. Sun is worth $16 billion but that, as I mentioned above, is easily within Apple’s reach. How much is it worth to Sun to break Apple’s security? Enough to get pulled into endless expensive lawsuits? Samsung paid Apple $548 million. If Sun were to lose such a suit it would likely be more.. and they are WAY smaller than Samsung. IOS 12 and beyond may (emphasis on may) render the point moot at least for a while. Apple clearly cares about this issue since it forms a cornerstone of privacy for end users. They won’t just let it slide. They have three avenues. Innovate, buy, or sue. I’m sure they are looking at all three right now.
What do you imagine the charge Apple would have to use to ‘pull’ Sun Corp into a lawsuit that wouldn’t get thrown out immediately?
Breaking EULAs, for one.
Off the bat how would that stick? Cellebrite is not the “End User” referenced in the “End User Licensing Agreement”.
The extent of enforceability of EULAs is still to be determined. Same for the extent of penalties.
As I alluded to before, these types of companies are very interesting to intelligence agencies worldwide, if they aren’t front companies for the intel agencies themselves. Even Apple doesn’t have the resources to sue companies backed by foreign governments or to purchase them if they don’t want to be sold, I think innovation is the only option for now.
Do they have legislation to do that? Oh wait, it doesn’t matter.
Nothing is hack-proof, except this:
https://en.wikipedia.org/wiki/One-time_pad
So unless Apple comes up with a way to securely chain keys and pads in an unhackable manner, hack-proof iPhones will never exist. Maybe Timmy should just give up on the hardened privacy stance and boost services like Siri et al already
Here’s the direct link to the Forbes article:
https://www.forbes.com/sites/thomasbrewster/2018/02/26/government-can-access-any-apple-iphone-cellebrite/#31244686667a
TOTALITARIANISM continues to encroach upon We The People, from BOTH lunatic extremes.
Well it not really surprising is it?
All Apples software is full of bugs now-days!
#disillusioned
How long before this technology falls into the “wrong hands.” As mentioned above, Cellebrite has already been hacked.
How is Cellebrite’s work not in violation of the Digital Millennium Copyright Act? I know it is a US law and the company is an Israeli one, but the law was enacted to comply with the WIPO Treaty- international law.
http://www.wipo.int/treaties/en/text.jsp?file_id=295166#P136_19843
The US Government should not be contracting with a company that violates US law.
Unless Cellebrite is copying the iPhone or one of its components and selling it as their own product, how does the DMCA apply at all? Are you implying that Apple DOES know how Cellebrite cracks the iPhone, Apple has copyrighted the process, and somehow Cellebrite is copying that?
The treaty behind the DMCA says modifying any encrypted content is illegal. If the content they are accessing is encrypted and they decrypt it, they have violated the law.
Israel is a signatory to the treaty that mandated the DMCA bill.
Which article are you citing as being violated? Article 5?
I am not the IP lawyer in the family- that would be my older Brother. I work in Medicine.
However, the breaking of encryption by a private firm would seem to violate the treaty and the various national laws that resulted from the Treaty. In the US that would be the DMCA.
Perhaps you are recalling that this Act was used to sue and shut down companies providing software to copy video and audio media by removing the encoding protecting the product. In that situation the Act was effective in being used to sue those companies for breaking the encryption since the result was widespread copying of the product being protected.
In the current situation with breaking encryption on iPhones, this Act is probably not relevant unless you can claim some kind of copyright infringement resulting from the breaking of the encryption.