Reliability of police mobile phone evidence questioned after hack

Re:Reliability of police mobile phone evidence questioned af... by ycomnews2021 on Monday April 26, 2021 @12:07PM (#26944156)

claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in custody). Or 12/23/2019 at 2:00PM (before you bought the phone). If the dates on the data in Cellebrite can't be aligned to the dates of the actual events AND the last modification of the device was AFTER you last had control of it, nothing can be trusted from it.

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by btilly on Monday April 26, 2021 @02:10PM (#26945877)

No, that is not the problem.

The problem is that a report about a phone scanned on 2020-02-01 can be altered by a phone scanned on 2020-05-01 to say that there was porn when there wasn't. Oh, and that scan left a running program which will cause 5% of the phones scanned after that to randomly also claim porn that is not on the device.

Therefore if a single phone with Signal was scanned at the kiosk, NOTHING from that kiosk can be trusted.

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by ycomnews2021 on Monday April 26, 2021 @02:57PM (#26946531)

This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action.

If the USER could select the action, for research purposes, that might a different story.

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by btilly on Monday April 26, 2021 @03:55PM (#26947223)

Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did.

If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by myself248 on Monday April 26, 2021 @04:26PM (#26947622)

Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it.

Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by _kbh_ on Monday April 26, 2021 @07:41PM (#26949744)

The vulnerabilities allow for code execution in the context of the Cellebrite application via the parsing of a video file. It doesn’t matter what the application was designed to do, you can now make it do anything you want just by getting it to scan a phone with a malicious video on it.

[ Parent | on HN ]

Re:Reliability of police mobile phone evidence questioned af... by ycomnews2021 on Monday April 26, 2021 @08:39PM (#26950243)

Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content.

In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.

[ Parent | on HN ]