It’s never been easier for the cops to break into your phone

Comments

• Chozo@fedia.io ⁨4⁩ ⁨months⁩ ago

  Without knowing how they got into his phone, this is a non-story that is just a retelling of older stories. For all we know they just took his dead finger and put it on the reader. Or maybe he used the same 4-digit PIN for his debit card or lock box or something else that they were able to recover. Maybe some detective just just randomly entered the shooter's birthday, only to say "Hey sarge, you're never gonna believe this... first try!"

  There's nothing useful that can be taken away from this story yet, until more details come out.

  source

  • 0x0@programming.dev ⁨4⁩ ⁨months⁩ ago

    they just took his dead finger and put it on the reader.

    My bet’s on this.

    source
  • glowie@h4x0r.host ⁨4⁩ ⁨months⁩ ago

    Or unknown NGO software was used. But you’re right. A nothing burger for now.

    source
  • SineNomineAnonymous@lemmy.ml ⁨3⁩ ⁨months⁩ ago

    Exactly. The article doesn’t shy away from a bit of free publicity for Cellerite. Which is nowhere near as much of a magic bullet as the “tech media” makes it out to be.

    How do I know it? By doing the most basic of research by heading to their website and looking at their manuals and documentation.

    And Cellerite won’t tell you this publicly because their bottom line depends on their ability to massively overprice their services which they sell to technically illiterate people.

    source
  • xnx@slrpnk.net ⁨3⁩ ⁨months⁩ ago

    Using a dead persons finger is not possible though

    source

    • Chozo@fedia.io ⁨3⁩ ⁨months⁩ ago

      I don't see why it wouldn't be. It just checks that the shape of the fingerprint is there, it doesn't check for a pulse or any sign of life. If you have a high-enough resolution image and printer, it's actually rther trivial to bypass most optical fingerprint readers.

      source
• TheReturnOfPEB@reddthat.com ⁨4⁩ ⁨months⁩ ago

  Our local sheriff is using some spy level shit in our county that he refuses to explain.

  He keeps “happening” upon crimes just on accident. yesterday it was “stopped to take a pee” and two days before that it was “just happen to follow and pull over a guy with lots of pounds of pot hidden in the car.”

  The US police are spying on Americans phones, internet, GPS, and everything with no judicial recourse because it is corporations spying and then “giving the info” to the police for money.

  The US law enforcement has gone full STAZI

  source

  • rottingleaf@lemmy.world ⁨4⁩ ⁨months⁩ ago

    Let’s all apologize to Stallman.

    source

    • demonsword@lemmy.world ⁨4⁩ ⁨months⁩ ago

      the man has rarely been proven wrong in anything tech related he has said

      source
    • corsicanguppy@lemmy.ca ⁨3⁩ ⁨months⁩ ago

      Let’s all apologize to Stallman.

      For the twice a day that broken toe-jam-eating watch is right?

      source
  • USSEthernet@startrek.website ⁨3⁩ ⁨months⁩ ago

    They’re probably just capturing SMS messages or regular calls. Which is still illegal without a warrant, but who watches the watchers? Use encrypted chats and encrypted calls if you’re worried.

    source
  • remer@lemmy.world ⁨4⁩ ⁨months⁩ ago

    “on accident“ 🤮

    source

    • corsicanguppy@lemmy.ca ⁨3⁩ ⁨months⁩ ago

      “on accident“ 🤮

      I know. Who SAYS that? It’s by accident. One doesn’t plan these things.

      source

      • -> View More Comments
    • PrimeMinisterKeyes@lemmy.world ⁨3⁩ ⁨months⁩ ago

      As venerable old neuromonkey once said:

      Welp. Just let the nukes fly, then. First it’s “on accident,” and before long you’ve got meth addicted baby prostitute warlords running the local Walmart.

      source
  • Maggoty@lemmy.world ⁨3⁩ ⁨months⁩ ago

    That’s also a red flag for a dirty cop getting information from criminal group A to go after competition.

    You should probably move.

    source
  • xnx@slrpnk.net ⁨3⁩ ⁨months⁩ ago

    Do you have an article on this?

    source
  • phoenixz@lemmy.ca ⁨4⁩ ⁨months⁩ ago

    Mind telling us which sherrif this is?

    source

    • Lumisal@lemmy.world ⁨3⁩ ⁨months⁩ ago

      I think it’s the one in New York named Spyder Mann

      source
• bdonvr@thelemmy.club ⁨4⁩ ⁨months⁩ ago

  Good chance it was just putting the dead dudes finger on the scanner lmao

  source

  • xnx@slrpnk.net ⁨3⁩ ⁨months⁩ ago

    Not how that works

    source

    • bdonvr@thelemmy.club ⁨3⁩ ⁨months⁩ ago

      Unless disabled by timeout, restart, or otherwise manually I’m curious to know why that would be?

      source

      • -> View More Comments
• uriel238@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

  It’s always a contest between security tools and penetration tools. The problem comes when law enforcement can do this without fair protections of privacy, say if they can easily establish probable cause ( My detection dog is signalling you have illegal data on your phone ) or they are allowed to get a warrant post-hoc for an otherwise illegal search.

  …Or they do the illegal search and then engage in parallel reconstruction e.g. make a fake story about following up on an informant.

  Once the police just seize and crack your phone on a whim, then the state no longer respects your privacy and autonomy, which means you can no longer consent to be governed, rather are controlled by gunpoint (surveillance and use of force). This is one of the critical ingredients to autocratic rule, since it does a lot to neuter the capacity of discontent turning into revolt.

  source
• anlumo@lemmy.world ⁨4⁩ ⁨months⁩ ago

  I’m pretty sure it used to be easier with phones that didn’t have full disk encryption.

  source
• umbrella@lemmy.ml ⁨4⁩ ⁨months⁩ ago

  stingrays, people.

  they sell the exploits and are all hush hush about it.

  source

  • GamingChairModel@lemmy.world ⁨4⁩ ⁨months⁩ ago

    Stingrays don’t do shit for this. That’s mostly real time location data focused in by tricking your phone into reporting its location to a fake cell tower controlled by an adversary. That doesn’t get into the data in your phone, and even if someone used the fake tower to man in the middle, by default pretty much all of a phone’s Internet traffic is encrypted from the ISP.

    The world of breaking disk encryption on devices is a completely different line of technology, tools, and techniques.

    source

    • umbrella@lemmy.ml ⁨3⁩ ⁨months⁩ ago

      stingrays can compromise a phone through modem exploits, and pull data from there.

      though not all of them are made equal, they are an entire category of devices.

      source

      • -> View More Comments
  • uriel238@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

    IMSI catching is a different thing.

    But yes, exploits are sold by gray hats rather than by white hats and closed. The NSA is supposed to be on top of this, but instead of closing exploits, they keep them to enhance their anti-terror spying, which they then trickle out to US Law Enforcement, especially if there’s loot (liquid assets) that are easy to seize.

    Law enforcement in the US is mostly a highway robbery racket.

    source
• 0x0@programming.dev ⁨4⁩ ⁨months⁩ ago

  The article does mention Cellebrite.

  source
• henfredemars@infosec.pub ⁨4⁩ ⁨months⁩ ago

  Easier is a very relative term. It’ll be really expensive to use a genuine zero-day to do it. Such exploits are few and far between.

  source

  • dwindling7373@feddit.it ⁨4⁩ ⁨months⁩ ago

    How is it expensive? It is if it eqates to the zero day becoming of public domain, and this is not the case here. they can say they guessed the password while in fact they exploited some unknown vulnerability…

    source

    • henfredemars@infosec.pub ⁨4⁩ ⁨months⁩ ago

      Zero days are extremely expensive costing in the millions of dollars even if you’re not publishing exploit details. Just using it is extremely costly because each attempt exposes your bug to the world, which is an opportunity that it could get caught and patched. Android and iPhone both have mechanisms to detect and report crashes which could easily cost you your bug. Plus, on the exploit markets, a bug that hasn’t been used is worth more because there have been literally zero days of opportunity to defend against it.

      There is definitely a cost to using something that expensive and that requires a necessary level of risk. You’ve got to be worth it, and the supply of such bugs is extremely low and sometimes zero depending on your exact software version.

      source

      • -> View More Comments
  • catloaf@lemm.ee ⁨4⁩ ⁨months⁩ ago

    But known exploits that have been patched, but not applied because they didn’t update their phone, are plentiful enough.

    Update your phones. Reboot them regularly, too.

    source

    • henfredemars@infosec.pub ⁨4⁩ ⁨months⁩ ago

      This is true, but becoming an increasingly less important factor because devices now ship with automatic updates enabled by default.

      Personally, if I had to guess as someone who studies exploits for a living, I’d wager the device isn’t the most recent model and is probably a few years old, so there are likely known unpatchable bootrom or firmware bugs that can be used from their private arsenal without having to risk an actual zero day exploit.

      source
• Maggoty@lemmy.world ⁨3⁩ ⁨months⁩ ago

  This is the would be assassin’s phone.

  They gave that to the NSA or FBI Counter Intel guys who are hooked in with NSA.

  Your phone is not going there.

  However I would be on the lookout for that tech coming down the pipelines.

  source

  • LodeMike@lemmy.today ⁨3⁩ ⁨months⁩ ago

    www.404media.co/leaked-docs-show-what-phones-cell…

    source

    • Facebones@reddthat.com ⁨3⁩ ⁨months⁩ ago

      Ayyyy graphene gang

      source
    • Liz@midwest.social ⁨3⁩ ⁨months⁩ ago

      The article is paywalled and the title doesn’t make it clear which list you’re talking about.

      source

      • -> View More Comments
• randomaccount43543@lemmy.world ⁨4⁩ ⁨months⁩ ago

  Do they say what phone it was?

  source

  • LodeMike@lemmy.today ⁨4⁩ ⁨months⁩ ago

    Yeah my guess is some shitty android.

    source

    • WallEx@feddit.de ⁨4⁩ ⁨months⁩ ago

      Oh, a shill in the wild.

      source

      • -> View More Comments
    • piracysails@lemm.ee ⁨3⁩ ⁨months⁩ ago

      Guys I think they meant from a bad OEM.

      source

      • -> View More Comments
• autotldr@lemmings.world [bot] ⁨4⁩ ⁨months⁩ ago

  This is the best summary I could come up with:

  ---

  Just two days after the attempted assassination at former President Donald Trump’s rally in Butler, Pennsylvania, the FBI announced it “gained access” to the shooter’s phone.

  Cooper Quintin, a security researcher and senior staff technologist with the Electronic Frontier Foundation, said that law enforcement agencies have several tools at their disposal to extract data from phones.

  The bureau famously butted heads with Apple in late 2015 after the company refused to help law enforcement get around the encryption on the San Bernardino, California shooter’s iPhone.

  Early in the following year, Apple refused a federal court order to help the FBI access the shooter’s phone, which the company said would effectively require it to build a backdoor for the iPhone’s encryption software.

  “The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor,” Cook wrote.

  Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory, said the Pensacola shooting was one of the last times federal law enforcement agencies loudly denounced encryption.

  ---

  The original article contains 1,208 words, the summary contains 180 words. Saved 85%. I’m a bot and I’m open source!

  source
• mechoman444@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Never keep anything on your phone that would require you to lock it.

  I’ve never locked my phone.

  source

  • explodicle@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    It’s true, I have their mom’s phone number.

    source

    • mechoman444@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Son of a bitch! Stop calling so late!

      source
• chemicalwonka@discuss.tchncs.de ⁨3⁩ ⁨months⁩ ago

  Can they access Pixel 8 with GrapheneOS? I think not

  source

  • UnsavoryMollusk@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Depends, is your bootloader unlocked ?

    source

    • Grippler@feddit.dk ⁨3⁩ ⁨months⁩ ago

      It shouldn’t be when using graphene OS, the installation guide even instructs you to lock it after you’re don’t installing it.

      source

      • -> View More Comments
    • chemicalwonka@discuss.tchncs.de ⁨3⁩ ⁨months⁩ ago

      no

      source
• sturmblast@lemmy.world ⁨4⁩ ⁨months⁩ ago

  Don’t do illegal things on your phone :)

  source

  • TheGrandNagus@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Just because of that I’m gonna do illegal things even harder

    source
  • dumbass@leminal.space ⁨4⁩ ⁨months⁩ ago

    YOU’RE NOT MY SUPERVISOR!

    source

    • ivanafterall@lemmy.world ⁨3⁩ ⁨months⁩ ago

      THAT’S MY PURSE! I DON’T KNOW YOU!

      source
  • uriel238@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

    Good luck with that. The CFAA was written when Reagan was spooked by Wargames in 1982. If you violate any TOS of websites you use (very easy to do) it can be prosecuted as a federal felony with a maximum sentence of 25 years imprisonment.

    If the police really want you to disappear into the penal system, they’ll make it happen. And they do, routinely.

    source
• communism@lemmy.ml ⁨3⁩ ⁨months⁩ ago

  For GrapheneOS full disk encryption, am I correct in understanding that the disk is encrypted when my phone is locked and decrypted when I unlock it? So I don’t need to turn it off for it to be encrypted, as long as it’s locked it’s encrypted?

  source

  • todd_bonzalez@lemm.ee ⁨3⁩ ⁨months⁩ ago

    The disk is encrypted when the phone is off, and it is decrypted after you turn it on and authenticate locally.

    source

    • communism@lemmy.ml ⁨3⁩ ⁨months⁩ ago

      Thanks, that makes sense.

      source
• sfxrlz@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Paid by everybodies taxes™️

  source
• TheReturnOfPEB@reddthat.com ⁨3⁩ ⁨months⁩ ago

  A 2020 investigation by the Washington, DC-based nonprofit organization Upturn found that more than 2,000 law enforcement agencies in all 50 states and the District of Columbia had access to mobile device forensic tools (MDTFs).

  source
• Sam_Bass@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Sif that hasnt been the case for 20 years? Heh

  source