ycomnews2021

These are great points. Thanks!

Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content.

In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.

This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action.

If the USER could select the action, for research purposes, that might a different story.

I'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is built around the tainted data they could argue that everything from that source (system/lab/department) should be thrown out and that the experts who collected it can't be trusted anymore due to incompetence. Sounds like a prosecutors worst nightmare.

The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited.

You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.

Imagine you opened the folder and made a Xerox copy of the documents, but the words or dates in the copies never match the original documents.

The crazy thing about this attack, is the person making the copy may never know until its presented in court and challenged. Then everything from the folder has to be thrown out.

claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in custody). Or 12/23/2019 at 2:00PM (before you bought the phone). If the dates on the data in Cellebrite can't be aligned to the dates of the actual events AND the last modification of the device was AFTER you last had control of it, nothing can be trusted from it.

The reason for this is chain of custody. They should be able to prove that from the time that the person last had the device until the point when the evidence was collected, no one modified it. And from the point where the evidence was collected, until when its presented to the court, no one modified it.

But these type of vulnerabilities present a problem, in that reading the device could/would modify timestaps of the data captured. The solution is to not use Cellebrite, there are lots of forensic analysis tools. To be effective Signal would need to exploit the major vendors equally.