Moxie Marlinspike Is an Old-school Hacker at Heart

Cellebrite is the Israeli firm that helps police/political forces from all over the world break into phones and other stuff to "prosecute bad guys." They are not too particular about who gets swept up. In epic hack, Signal developer turns the tables on forensics firm Cellebrite | Ars Technica

On Wednesday, Marlinspike published a post that reported vulnerabilities in Cellebrite software that allowed him to execute malicious code on the Windows computer used to analyze devices. The researcher and software engineer exploited the vulnerabilities by loading specially formatted files that can be embedded into any app installed on the device.

There is a fair amount of technical detail, but there are a couple of good quotes as well.

Marlinspike said he obtained the Cellebrite gear in a “truly unbelievable coincidence” as he was walking and “saw a small package fall off a truck ahead of me.” The incident does seem truly unbelievable. Marlinspike declined to provide additional details about precisely how he came into possession of the Cellebrite tools.

Heh. And though he doesn't say it explicitly, it seems like he is going to be seeding some landmines for Cellebrite in new versions of Signal. No more than they deserve.

To be fair Cellebrite has recently stopped sales to Russian and Belarus state actors, but they have sold to Bangladesh, Saudi Arabia, and in a recent trial in Indonesia (of someone opposed to the current regime) Cellebrite hacked his Samsung S10 for the government.

The vulnerabilities could provide fodder for defense attorneys to challenge the integrity of forensic reports generated using the Cellebrite software.

Not that it will stop bad countries from doing bad things to their populations.

Cellebrite isn't the only "digital forensics" firm in the world, of course; a quite famous one, Azimuth, is out of Australia.

And you should be using Signal. I know you will ignore that advice because "It's hard!" Or something. Here's a link to the Signal site. It may be the only secure way to communicate using your smartphone.