Author: seo

Cellebrite iPhone cracking tool allows clients of the company to view virtually every private data on their phones – sometimes even locked.

But the precise capabilities of an iPhone depend on the model and version of iOS that it runs. To see the capabilities of the latest version, we were able to access the documentation.

Background

Cellebrite makes a range of hardware and software kits designed to unlock both iPhones and Android smartphones, and extract most of the data on them.

Some versions are sold to commercial companies, while Cellebrite Premium is – in theory – sold only to law enforcement agencies. However, the exact position is unclear. For example, the company recently revealed that it has over 2,800 US government customers, many of which would not fall within what one would normally think of as ‘law enforcement.’

Investigators with the US Fish and Wildlife Service frequently work to thwart a variety of environmental offenses, from illegal deforestation to hunting without a license. These are serious crimes but they don’t usually involve hacking phones. But Fish and Wildlife agents are among the increasingly broad set of government employees who can now break into encrypted phones and siphon off mounds of data with technology purchased from the surveillance company Cellebrite […]

The list includes many that would seem far removed from intelligence collection or law enforcement, like the departments of Agriculture, Education, Veterans Affairs, and Housing and Urban Development; the Social Security Administration; the U.S. Agency for International Development; and the Centers for Disease Control and Prevention.

Other Cellebrite clients are bluechip firms that want to carry out internal investigations and cybersecurity businesses.

Cellebrite Premium kit

The flagship phone cracking kit offered by the company is known as Cellebrite Premium. This is a hardware and software package comprising:

• Cellebrite Premium laptop, with pre-installed software
• Android Adapter
• iOS Adapter
• iOS Adapter (AFU version, for use after the phone has been powered off)
• A complete set of cables and carrying bag
• A hardware license dongle, without which the software won’t run

The software allows users to extract either specific target data (for example, Messages or photos) or the complete filesystem, which contains almost all user data – including Keychain passwords, which then gives the user the ability to access most services you use. Here’s what the company says about it:

By performing full-file system and physical extractions, you can get much more data than what is possible through a logical extraction, and access highly protected areas such as the iOS Keychain or the Secure Folder.

Accessing 3rd party application data, stored passwords and tokens, chat conversations, location data, email attachments, system logs, as well as deleted content, increases your chances of finding the incriminating evidence.

Cellebrite iPhone cracking capabilities

Back in February, the company kept its most advanced capabilities in-house, but the webpage relating to this has since disappeared, and it seems from the documentation we’ve reviewed that Cellebrite Premium can now do everything that CAS used to do.

We should note that the documentation we have obtained pre-dates the launch of the iPhone 13, and at that time the company apparently had no ability to access the iPhone 12 either.

Full access even when locked, with any supported iOS version

Cellebrite Premium can unlock and gain access to the full filesystem of the following models of phone even when protected by a passcode, with the unlocking time dependent on the complexity of the passcode. The company will unlock your phone and allow you to access all supported iOS versions.

• iPhone 4S*
• iPhone 5*
• iPhone 5S*
• iPhone 6
• iPhone 6S
• iPhone SE
• iPhone 7
• iPhone 8
• iPhone X

*Interestingly, in-house unlocking is required for these three models if they are running iOS 5 or iOS 6, while Cellebrite Premium allows clients to unlock devices directly if running iOS 7 or later.

The reason these models can be cracked regardless of iOS version is because of unpatchable vulnerabilities in these models. One of these was revealed with the checkm8 exploit, and another flaw discovered in the Secure Enclave later the same year. This too cannot be patched.

Full access even when locked, with older iOS versions

There are three models of iPhone the kit can unlock if they are running any version of iOS up to iOS 13.7.

• iPhone XR
• iPhone XS
• iPhone 11

Full access only with passcode

The same three models running iOS 14 or iOS 15 cannot be unlocked by the company, either with Cellebrite Premium or the company’s in-house resources. If clients possess the passcode for the phone, full filesystem access can be obtained.

• iPhone XR (iOS 14 or 15)
• iPhone XS (iOS 14 or 15)
• iPhone 11 (iOS 14 or 15)

Law enforcement may or may not have the power needed to force a suspect to reveal their passcode – this depends on the country and the jurisdiction.

Brute-force unlocking is very time-consuming

Unlocking devices requires the kit to brute-force passcodes. This relies on being able to disable the lockouts Apple applies to repeated passcode attempts, but even so is a slow process due to delays imposed prior to complete lockout.

The company warns that the process can be very time-consuming, with one example in the user guide referencing a rate of a little over 100 attempts per day.

However, the kit does allow users to enter any personal data they have for the phone’s owner, such as date of birth, and other important dates, such as a significant other’s birthday. They will then be used for initial attempts before resorting brute force. This information serves to underline the importance of protecting even relatively trivial personal data.

Autonomous mode

Cellebrite brute-force unlocking used to require the phone to be left connected to the kit until it succeeded. Cellebrite Premium, however, provides an autonomous mode, where the phone can be disconnected once the attack is underway. This is because the kit manages to install the software running the attack directly on the iPhone itself, even though the phone is locked.

Cellebrite uses Cellebrite to run an automatic dictionary attack on target devices. Cellebrite Premium can disconnect the target device from Cellebrite Premium so that the automated bruteforce process runs on multiple devices at once.

It is worth noting that Cellebrite attacks need physical access to your phone. This is in contrast with NSO Pegasus spyware which can be remotely deployed, and includes zero-click options.

Turns to be able to only use one line of text for a Magic: The Gathering card. This will allow you some serious shenanigans. Among the cards released in Magic‘s newest set, Streets of New Capenna, a certain six-mana green artifact has deck-builders buzzing with its potential to take over games and promote table-flipping reactions. Allow me to introduce you to Bootlegger’s Stash.

Image: Wizards of the Coast

Image: Wizards of the Coast

Before exploring some of the specific applications that Bootlegger’s Stash has, let’s clarify why this card’s ability is noteworthy in the first place. In short, by granting all your lands the ability to produce treasures, this card generates value in the form of a concept Magic players sometimes refer to as “material.”

Consider your everyday Magic cards: lands and spells. When you have creatures or lands, one card in your hand can put one permanent or object on the battlefield. But common exceptions to this principle are cards that make tokens. Classic examples such as Thraben Inspector (which makes a clue) or Hordeling Outburst (which makes three goblins) will represent one card in hand but produce multiple permanents on the battlefield, here in the form of tokens. When Magic players refer to “material,” it’s usually this ability to create multiple permanents off one card.

Image: Wizards of the Coast

Image: Wizards of the Coast

Generally, token makers are no big deal. Practically every set has them, and the majority see relatively little play because the in-game value these cards produce isn’t powerful enough for competitive constructed formats such as Standard or Modern. But every once in a while, a unique new token maker breaks through because it’s easy to cast, annoying to deal with, and the tokens themselves are good enough to want multiples.

Older players might recall when Bitterblossom or Gideon, Ally of Zendikar were format-defining cards for their unique abilities to produce a steady stream of pesky creature tokens on otherwise hard-to-answer permanents. Even today in the Modern format, Ragavan, Nimble Pilferer is one of the most-played creatures thanks in part to its ability to generate ongoing treasure tokens on a cheap, aggressive body.

Image: Wizards of the Coast

Image: Wizards of the Coast

Image: Wizards of the Coast

Like previous token maker all-stars, Bootlegger’s Stash checks a critical box: It keeps producing material after it is played — treasure tokens, no less. These let you extend the range of your mana base beyond your land count and color restrictions. It’s fun to grab a few treasure tokens once in a while, but if you do it more than that three times in one game, your resource bank will be huge and could trigger other great synergies. By transforming your lands into token makers, the decks that maximize all these treasures will find themselves snowballing quickly with a variety of outlets that can exploit a never-ending supply of widgets.

Time Sieve

One of the scariest applications for Stash is the threat of enabling an infinite-turns combo when it’s on the board at the same time as a two-mana artifact called Time Sieve. The best part of all? It’s as simple as combining both of your cards.

Image: Wizards of the Coast

Since Time Sieve only requires five artifacts to activate, and Stash can enable at least six treasure tokens every turn, once the two artifacts are online simultaneously, your opponent better have some artifact removal handy or they’ll never take a turn again.

Academy Manufactor and Chatterfang

Among the limits to Stash’s potential is the fact that it only makes one type of token. Although having tons of mana through treasures can be very powerful, eventually you will need to have something to spend that mana. Stash is able to produce more material every time an activation occurs with the aid of token generators. The simplest one-two punch is to have Academy Manufactor on the board, which diversifies your material production into mana, card draw, and life gain effects. With Manufactor out, each treasure you make comes with a clue token and a food token, providing a built-in application for all the mana you produce. Crack the clues to draw through your deck and find a way to win, or pad your life total with some tasty food if opponents have you under pressure.

You can take this combo one step further by creating creatures in the process with Chatterfang, Squirrel General, the most adorable apex predator currently hiding out in the vast catalog of legal-to-play cards. Chatterfang can be used even without the Academy Manufactor, but it becomes stronger when you have more tokens. By themselves, Chatterfang and Stash produce an additional 1/1 squirrel with every treasure you make. At a minimum there are six squirrels for every treasure you make.

Things get really out of hand if you have Manufactor on the board, too, because now, every land you tap is making two extra artifact tokens along with three squirrel tokens. Assuming we’re still only working with the six lands you used to cast Stash, that means you can make up to 36 tokens every turn between squirrels and other widgets. So if you haven’t drawn a Time Sieve to take infinite turns, your practically infinite material should close out the game.

Streets of New Capenna is out now for Magic Online and Magic: The Gathering Arena, and is available for tabletop play starting April 29.