this post was submitted on 08 Nov 2024
246 points (93.9% liked)
Technology
59638 readers
4332 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Cellebrite? I don't think that's how encryption works
There are attacks where rather than trying to crank the password you just capture the hash which is stored in memory somewhere and then using a tool that lets you bypass the standard login inject that hash into the app, totally bypassing the UI interface and the password hashing algorithm.
The app sees the hash is correct and isn't aware that the information has been input via nonstandard methods, and so allows access.
The attacker still doesn't have a clue what your password was, but they don't need to. Interestingly enough this means that every time they want access to your data they have to do this because they don't have a way of actually changing the password or finding out what it was.
Link? That sounds incredibly stupid design
Yeah. It is. Every design has assumptions and every design can be abused by those assumptions. I'd like to say it's not a failure in design but it's really just a failure of imagination. No one thought this would be an issue, turns out it is, so someone fixed it.
The problem is that not every system gets updated.
It might work that way, actually .
Just because the phone is encrypted doesn't mean there's not an exploit that makes it easier to bypass or extract the passphrase. Celebrite is unfortunately pretty good at attacking out of support phone and breaking into them.
Use a modern, supported OS on a device put out by a trusted vendor and you're probably ok. But old software/hardware makes it much easier to bypass.
Apparently some phones have a totally isolated electrically separated microcomputer which is in charge of encryption and decryption. Your phone doesn't actually know how the encryption decryption is done because it's separated from the microcontroller.
Any attempts to modify the microcontroller or replace any of its components with more cooperative components, will result in all of the data being wiped. This is implemented at the firmware level with the instructions being in ROM.