News for hackers. Stuff that matters.

A comment on Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer. Parent comment

Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by Zarathust on Wednesday April 21, 2021 @02:49PM (#26893883)
This indeed looks like a FUD statement, implying that they can have an infinite amount of potential vulnerabilities. Realistically though, writing parsers that do not yield control of your whole device is not that complex. The people exploiting iOS zero days can certainly do it.
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by Karunamon on Wednesday April 21, 2021 @08:59PM (#26897403)
You're not wrong at all, but if they're shipping these garbage ancient versions of ffmpeg, there are likely oodles of other bugs lurking around. And, if Cellebrite acts like most other companies who've had their awful security exposed, they will fix only this bug and leave everything else.
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by kevinmchugh on Wednesday April 21, 2021 @03:05PM (#26894066)
It's not that hard but neither is shipping patched versions of ffmpeg. This company will have some catching up to do.
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by spoonjim on Wednesday April 21, 2021 @09:20PM (#26897529)
But it might be easier for Cellebrite to just stop exfiltrating data from Signal. Of course, other apps could discover similar vulnerabilities.
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by chopin on Thursday April 22, 2021 @10:58AM (#26903500)
That's not enough. With file system permission, Signal could place files anywhere (like prepared gifs in the Pictures folder).

I think this taints any phone having Signal installed.

[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by da_big_ghey on Wednesday April 21, 2021 @03:21PM (#26894239)
the signal are capable for finding more exploit with more time. important piece is that exists now a reasonable doubt on data from the celebrite, so it are not so good for evedince.
[ Parent | on HN ]