Israeli cybersecurity firm Cellebrite has confirmed that it is able to unlock devices running versions of iOS up to iOS 11.2.6, allowing law enforcement agencies to bypass the iPhone’s lock screen security.
According to a February 26th, 2018 Forbes report citing anonymous sources, Cellebrite has been telling its customers that it’s now able to bypass “the security of devices running iOS 11.”
Sources also told Forbes that Cellebrite is advertising its new techniques to law enforcement agencies, as well as private forensic companies, around the world.
Cellebrite told Forbes on February 28th, 2018 that the company can “retrieve (without needing to root or jailbreak the device) the full file system to recover downloaded emails, third-party application data, geolocation data and system logs.”
“Agencies can either provide the device already unlocked, furnish the known passcode, or use Cellebrite’s Advanced Unlocking Services to unlock the device,” a Cellebrite spokesperson told Forbes.
Cellebrite currently serves as a contractor to the U.S. Federal Bureau of Investigations (FBI), the U.S. Department of Justice, other U.S. agencies, as well as the RCMP and other Canadian agencies.
The only compelling reason for someone to buy an iPhone over more open, less expensive competitors was @Apple's stronger stance on users' right to privacy and security. This story and Forbes' Cellebrite report (https://t.co/insMgQARrY) threaten the core of an iPhone's value. https://t.co/qgXBmnJphl
— Edward Snowden (@Snowden) February 26, 2018
Forbes noted on February 26th that Cellebrite hasn’t made any public announcements about its iPhone unlocking technology, but that a January 2018 marketing document specifically states that the company’s ‘Advanced Unlocking and Extraction Services’ include “Apple iOS devices and operating systems, including iPhone, iPad, iPad mini, iPad Pro and iPod touch, running iOS 5 to iOS 11.”
Cellebrite also claims to be able to unlock Android devices, “including Samsung Galaxy and Galaxy Note devices; and other popular devices from Alcatel, Google Nexus, HTC, Huawei, LG, Motorola, ZTE, and more.”
While Cellebrite has contracts with law enforcement, it’s important to note that agencies need to send locked devices to Cellebrite — the company doesn’t yet sell an unlocking tool directly to customers.
“Once the device is unlocked and/or extracted, it is returned the originating agency,” Cellebrite told Forbes. “Any extracted data is also sent to the agency in encrypted form to ensure privacy and protect operational information.”
Should Canadians be concerned?
Though it’s a matter of public record that the RCMP has contracts with Cellebrite, the agency explained that it doesn’t disclose the private sector techniques, tools or services it uses during its operations.
“The RCMP uses various technical investigative tools and methods to lawfully obtain evidence in order to protect Canadians and advance serious criminal investigations,” said an RCMP spokesperson, in an email to MobileSyrup. “To maintain the integrity of investigations, we disclose neither specific techniques or tools developed, nor services of this nature provided to the RCMP by the private sector.”
The RCMP also told MobileSyrup that it “works closely” with its U.S. partners, and is confident in the legality of the tools and techniques used.
“The RCMP works closely with our US partners and is confident they use their tools and techniques in accordance with the legal framework authorized in their country, in addition to respecting Canadian sovereignty and Canadians’ expectations of privacy,” said the same RCMP spokesperson.
Apple declined to comment. However, the company has previously expressed its commitment to user security and privacy. The company has also repeatedly emphasized its commitment to improving iOS, in order to better protect its customers.
Anyone concerned about law enforcement agent bypassing private device security should ensure that devices are up-to-date with the latest firmware updates and patches.
It’s also worth mentioning that Cellebrite’s technology won’t apply to the majority of users, simply because most users aren’t actively engaging in illegal activity that would require the intervention of law enforcement.
Regardless of Cellebrite’s techniques or tools, however, Canada’s existing privacy legislation will need to be updated to account for the iPhone X’s Face ID, as well as other similar biometric security protections present on other devices.
Source: Forbes
