Security News > 2021 > April > Signal app's Moxie says it's possible to sabotage Cellebrite's phone-probing tools with booby-trapped file

It is possible to hijack and manipulate Cellebrite's phone-probing software tools by placing a specially crafted file on your handset, it is claimed.

Signal app supremo Moxie Marlinspike said in an advisory on Wednesday that he managed to get his hands on some of Cellebrite's gear, which is typically used by cops, government agents, big biz, and authoritarian regimes to forcibly access the contents of physically seized smartphones.

Once a device is unlocked by Cellebrite's UFED software, its files and applications can be examined using a Cellebrite program called Physical Analyzer running on a Windows PC. Marlinspike claims this software collection does a poor job of protecting itself when parsing malicious data extracted from handsets, to the point where it's possible for an innocent-looking file to inject and execute arbitrary code on the host PC. That code can then modify the analyzer's operation, manipulate forensics reports, and so on.

Signal's creator went on to say he'll disclose the holes he's found when Cellebrite discloses the vulnerabilities it exploits to forcibly unlock confiscated handhelds.

The Register understands these proof-of-concept exploits work against the latest builds of Cellebrite's tools.

This all comes after Cellebrite announced it had updated Physical Analyzer to parse the file formats used by Signal on unlocked devices.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/04/21/signal_cellebrite/