A hacker is now dumping a large size of sophisticated cracking tools that are said to have been stolen from Cellebrite, the Israeli-based smartphone cracking company. The anonymous hacker has been dumping files from what has been described as a 900 GB sized trove stolen from Cellebrite.
About a month ago, it was reported that a hacker had successfully breached the security systems of Cellebrite and stolen a large amount of highly sensitive data from the servers of the company. It was not clear how the hacker had managed to pull off the feat but what was clear was that the hacker was motivated by the desire to hack into the systems of Cellebrite and expose the inner workings of the much-feared phone hacking company.
According to MotherBoard’s report, the files that the hacker is currently dumping on the dark web contain various hacking and cracking tools that Cellebrite has been using to crack into the security features of older versions of iPhones and phones operating on other operating systems such as Android and Blackberry OS.
It is reported that the hacker pointed out the need for governments and other institutions to learn that hackers can easily expose the goings on in companies such as Cellebrite that help governments across the world to spy on their citizens.
‘As we move towards a highly authoritarian society, it is important to note that the debate about the use of backdoors by government institutions will only get stronger as time goes by,’ the hacker added.
The leaking of the files coincides with the recent political developments in various countries in the world. Various countries have already put in place legislations that allow government agencies to use backdoors to surreptitiously monitor what individuals do when they are online.
Interestingly, in the United States, the debate over digital privacy is set to get more intense, with the new Trump-led administration now in place.
It has been reported that the dumped data was accessed from a remote Cellebrite server that is connected to the Universal Forensic Extradition Device (UFED). The UFED is a flagship device of Cellebrite that the company uses to rip data from nearly any mobile device in the world.
A person using the UFED has to get physical access to the phone before accessing all the data from the phone by using the UFED. The data that the hacker is dumping contains files that are used to jailbreak into the old versions of the iPhone and expose the PIN number as well as other personal details of the user. It is reported that the dumped data also includes code that can be used to rip off data from a BlackBerry device.
According to the hacker, the entire code that has been dumped can be effectively used to access nearly any type of Blackberry device.
‘This python script has been ripped and can be used to effectively access any BlackBerry device,’ the hacker wrote in one of the README files attached to the dumped data. However, some observers have pointed out that some of the leaked tools may not necessarily be genuine. According to Jonathan Zdziarski, a forensic researcher, some of the dumped tools look like those used by other groups of hackers to attempt to jailbreak into some versions of the iPhone.
Tony Gauda, CEO of ThinAir said that “The breach at Cellebrite is a privacy advocate’s nightmare come true. And, while the legitimacy of the files leaked today hasn’t been confirmed, this incident is a clear example of why backdoors are seen as a double-edged sword by members of the technology community. Software exploits that allow law enforcement to exfiltrate data during criminal investigations become extremely dangerous when in the wrong hands, and firms such as Cellebrite must acknowledge the huge target they have on their backs. Data exfiltration tools will never be phased out completely, but the developers responsible for their creation must go to every length possible to ensure they aren’t compromised. Until these digital arsenals are secured with the same level of rigor as physical weaponry, breaches such as this one will persist.”
Cellebrite has maintained that the dumped data does not contain any of its proprietary tools and that the information that the hacker is currently leaking was fabricated.
Source: MotherBoard
DDoS attacks are increasing, calculate the cost and probability of a DDoS attack on your business with this DDoS Downtime Cost Calculator.
