A new device has been developed that can allegedly unlock and extract data from new hi-tech Smartphones and iPads.
The new gizmo has been developed for the police and intelligent agencies by the Israeli forensic and data extraction firm Cellebright. It means that secretive agencies such as MI5 and the FBI will be able to access privacy data from both Android and iOS handsets.
In advertising the new tool, the company claimed that the device could unlock and download data easily from any handset – even the newest models on the market.
UFED
The Universal Forensic Extraction Device (UFED) Premium tool can be used to perform full file system extractions on their flagship devices.
The tool allows the user to downloaded emails and email attachments, as well as deleted content. The tool’s developers promise to “increase your chances of finding the incriminating evidence and bringing your case to a resolution”.
Devices that are particularly at risk include the Samsung Galaxy S6 through to S9 models, as well as “popular device models” from Motorola, Huawei, LG and Xiaomi. The tool also supports all Apple devices running iOS 7 to iOS 12.3.
Unlock
Users can determine passcodes and perform unlocks for all Apple devices, as well as make use of sophisticated algorithms to minimise unlock attempts.
In the same way, Android devices, can be bypassed with ease, with users then accessing unallocated data to maximise the chances of recovering deleted items.
Users can also choose to use in-house services, provided by certified forensic experts, to gain access to evidence from locked, encrypted or damaged devices using in-lab only techniques.
With greater emphasis being placed on user privacy and information security, it does not seem likely that manufacturers will approve the use of the approve of the UFED Premium tool.
It will be sold as an “on-premises tool”, which means that the police will be able to buy the hacking device and then use it themselves – however they want.
Dan Guido, the founder of the New York-based security firm Trail of Bits and a long-time iOS-focused security researcher told Wired: “It’s well understood that this is the business Cellebrite is working in.
“It was only a matter of time until they solved the problem, and then told people about they solved it, which is what we’re seeing now.”
He said he was surprised at how vocal Cellebright had been recently in marketing their new tool.
He thought the publicity around even more aggressive government-contracted hackers like NSO Group—which has been repeatedly revealed in the act of hacking iPhones and Android devices remotely, rather than the more common physical access unlocking that Cellebrite allows—may have given Cellebrite the sense that it’s free to talk openly about its new product.
He added: “It’s 2019. I’m kind of surprised it took this long for someone to start talking in the open about doing this.”
Data
Cellebrite claim that it’s the only solution for law enforcement agencies looking to unlock data from devices.
Its website states:
“Bypass or determine locks and perform a full file system extraction on any iOS device to get much more data than what is possible through logical extractions and other conventional means.
Gain access to 3rd party app data, chat conversations, downloaded emails and email attachments, deleted content and more, increase your chances of finding the incriminating evidence and bringing your case to a resolution.”
Apple has worked hard to block tools from companies like Cellebrite and Grayshift. Last October, it was revealed that the GrayKey forensics box from Grayshift could no longer unlock iOS 12 devices due to changes made by Apple.
Wired notes that Grayshift has since developed tools that allow it to unlock “at least some versions of iOS 12.” The two forensics companies are head-on competitors with one another, and Cellebrite’s announcement this week is likely to win back at least some customers from Grayshift.
The UFED hacking tool commonly used by the FBI, Department of Homeland Security and other law enforcement agencies in the US and elsewhere. It’s the most powerful tool yet created by the Israeli company, able to extract a huge amount of data – even data which has been deleted from phones.
In America, a brand new UFED tool normally costs $5,000 to $15,000 depending on the model, but just last month, older UFED models were found on eBay for as little as $100.
Investigations
According to Forbes, some of these devices appear to have been sold by police, and in some cases still contain data extracted from phones involved in criminal investigations.
Cybersecurity researchers are now warning that valuable case data could have leaked as a result.
Matthew Hickey, a cybersecurity researcher and cofounder of training academy Hacker House, bought a dozen UFED devices and probed them for data. He discovered that the secondhand kit contained information on what devices were searched, when they were searched and what kinds of data were removed. Mobile identifier numbers like the IMEI code were also retrievable.
Hickey believes he could have extracted more personal information, such as contact lists or chats, though he decided not to delve into such data. “I would feel a little awful if there was a picture of a crime scene or something,” he said.
Hickey was able to extract data from older iPhones using the device. It’s likely that the device was sold because it is now outdated and unable to access devices running current or recent versions of iOS.
But now with the latest versions of UFED’s available able to unlock new devices, the threat to privacy continues.
Cellebrite has written to its customers reminding them that the terms of sale do not permit resale. Units are supposed to be disposed of by returning them to the company.
