Paywalled. Can someone post the slide and article?
post
From the GOS forums, it looks like as long as you keep your phone up-to-date, block USB data in the locked state, and the phone is in the before-first-unlock state, cellbrite still can't break into it
the before-first-unlock state
Embarrassed to ask what this is exactly...?
When you reboot the phone, it is in the BFU state where everything is still encrypted until the user unlocks the phone, as I understand it. https://blogs.dsu.edu/digforce/2023/08/23/bfu-and-afu-lock-states/
What if you long press power button amd select "lock down"? Does that put it in the same BFU state?
No. Lockdown is not the same as BFU. Lockdown just turns off biometric unlocking.
This is a good precision to be aware of.
It is still an important function because in some places law enforcement may be legally authorized to compel a user to unlock their phone using biometrics, but of course if you disable biometrics, there are less options to force you to enter your passphrase/password etc.
Afaik, it only disables biometrics. BFU means the entire phone (should be) encrypted. You can test this by playing media and then pressing the lockdown button. If the media continues playing, it’s not encrypted.
If you can’t shut your phone down for whatever reason, disabling biometrics would be the second best option (assuming police cannot force you to reveal your password).
When your phone reboots, it prompts for a password before you are able to use any functionality of the phone (nothing's running in the background until you unlock for security purposes).
Before-First-Unlock refers to this, the post-reboot screen where nothing is actively running that can be easily hijacked. If you set your phone to auto-reboot after a certain amount of hours, you can safely assume people will have to have a BFU exploit to ransack your phone.
The opposite of this is After-first-unlock (AFU), which is after that initial reboot password check.
would using lockdown mimic the BFU state? or does it not matter once you actually unlock the first time?
The latter is true. Phone needs to be in BFU to work against cellbrite, I figure. Lockdown only turns off biometrics and makes the phone unlockable with a pin or password instead, iirc.
If you have enough time to put your phone in lockdown, just power it off. You can also set it so that the phone will automatically reboot if not unlocked in some time period (like a day).
This makes it go into BFU mode if it’s lost or stolen and kept powered.
Where can I find the auto reboot setting?
Assuming you’re on GrapheneOS: https://grapheneos.org/features#auto-reboot
I don’t think most other OEMs have an auto reboot feature
Yeah, oops, GOS only.
I don’t think most other OEMs have an auto reboot feature
There are very few phones where it would help because they're BFU exploitable.
Sounds like a lot of people are out there selling defective hardware.
block USB data in the locked state
So "charging-only when locked" is safe then, right?
Companies like cellebrite are the scum of the world.
I'm actually thankful they exist, because they're a commercial company. They disclose their capabilities and they advertise. If this was strictly a government operation, it could be quite secret, quite nebulous, we wouldn't get as many leaks. They're fulfilling a very positive role in the ecosystem as a red team giving valuable feedback to gos for blue teaming.
This article is behind a pay wall. So I found it for free. Same subject and leaks. https://www.androidauthority.com/cellebrite-leak-google-pixel-grapheneos-security-3611794/
There's also archive.today that can bypass these paywalls. https://archive.ph/NfjJm
We do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage
Lmao fuck them 😂 the grapheneOS forum is exactly where this info belongs so the devs can patch any vulnerabilities. As if companies like cellebrite care if (other) malicious actors get their hands on the exploits. They just don't want the the vulnerabilities to be fixed so they can keep using them
We do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage.
I was under the impression it was illegal to use exploits for purposes other than responsible disclosure?
illegal
What do you think this means?
Less 'leak' and more 'direct from the sales pitch'
In a statement, Victor Cooper, senior director of corporate communications and content strategy at Cellebrite, told 404 Media “We do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage.” Google did not immediately respond to a request for comment.
Which does exactly the opposite, making it easier for criminals and malicious actors to break into your system, since the device and OS devs don’t know about the vulnerabilities. Fuck off.
Article without paywall: https://www.androidauthority.com/cellebrite-leak-google-pixel-grapheneos-security-3611794/
Includes the screenshot and a link to the GrapheneOS thread.
Someone recently managed to get on a Microsoft Teams call with representatives from phone hacking company Cellebrite, and then leaked a screenshot of the company’s capabilities against many Google Pixel phones, according to a forum post about the leak and 404 Media’s review of the material.


all 4 comments