News for hackers. Stuff that matters.

A comment on Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer. Parent comment

Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by zie on Wednesday April 21, 2021 @05:27PM (#26895659)
The client code is open source, so it should be pretty easy to tell if they actually do it.
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by mannerheim on Wednesday April 21, 2021 @07:11PM (#26896554)
I would assume their aesthetically pleasing files would not be part of their client code since the clients are fetching these files from Signal.

So whether they're fetching aesthetically pleasing files would be easy to tell, but trickier to tell if those files actually have payload.

[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by PeterisP on Wednesday April 21, 2021 @08:14PM (#26897061)
Automatically open the files with Cellebrite software tools in a sandbox environment?
[ Parent | on HN ]
Re:Exploiting vulnerabilities in Cellebrite UFED and Physica... by mannerheim on Wednesday April 21, 2021 @09:57PM (#26897852)
Wouldn't necessarily work:

> Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding.

You would have to have an already existing Signal account that's been around for some time and hope you get sent one of these files.

[ Parent | on HN ]