Unsubstantiated claims about Cellebrite contradicted by Cellebrite

Rarry

I read preliminary investigation from Swedish police manage to unlock two Pixel 6a GrapheneOS version 2023030400 was confiscated in turned on mode, Police manage to unlock first Pixel 6a 2023/12/30 and second Pixel 6a 2024/01/15 date according to the preliminary investigation protocols The phones were in the on mode (AFU mode) unlocked but another Pixel 6a in the same case seized in the on mode date 2023/05/01 with GrapheneOS version 2023/05/0100 the Swedish police do not manage to unlock The police used the Cellebrite Physical analyzer version 7.66.0.9 with cable on and Cellebrite UFED

Edit by GrapheneOS: Appears to be a misinterpretation of the documents, which do not refer to GrapheneOS in any way. Cellebrite's official documentation says they can exploit all major Android OEM devices running the stock OS both BFU and AFU, but cannot do a brute force attack to get data from a BFU Pixel 6 or later (implying they can't currently exploit the Titan M2 even for out-of-date devices). Cellebrite's official documentation also says that they cannot exploit GrapheneOS either BFU or AFU unless the patch level is earlier than an unspecific late 2022 patch level.

de0u

Rarry Swedish police manage to unlock two Pixel 6a GrapheneOS version 2023030400 was confiscated in turned on mode, Police manage to unlock first Pixel 6a 2023/12/30 and second Pixel 6a 2024/01/15 date according to the preliminary investigation protocols The phones were in the on mode (AFU mode) unlocked but another Pixel 6a in the same case seized in the on mode date 2023/05/01 with GrapheneOS version 2023/05/0100 the Swedish police do not manage to unlock

I don't understand. "AFU" does not mean "unlocked", and if a phone is unlocked why does it take time to unlock it?

DeletedUser29

I would like to read that so please provide a link to the protocols.

Rarry

DeletedUser29 Where can they be uploaded?

Rarry

DeletedUser29 https://easyupload.io/m/l61bpx

Hathaway_Noa

Can you please upload the reports here:

https://easyupload.io

Thanks a lot!

Rarry

Hathaway_Noa https://easyupload.io/m/l61bpx

fid02

Is this the same case, or is it a different one? https://discuss.grapheneos.org/d/7658-seized-graph-phone-swe-police/33

Rarry

fid02 No Two different cases

[deleted]

Rarry source?

Aeon

de0u

AFU refers to After First Unlock.
BFU means Before First Unlock where your data is still fully encrypted at rest.

GrapheneOS

de0u The only functionality Cellebrite offers with GrapheneOS is performing a full filesystem extraction after the correct lock method is provided and the device is unlocked with it. The only working exploits they have since after the late 2022 patch levels are privilege escalation after being granted ADB access which is a very minor problem and not an impressive capability. For the stock OS, they say that they can exploit both BFU and AFU but cannot bypass the secure element brute force protection on the Pixel 6 or later even with the oldest Pixel 6 firmware without security patches. If people don't want to depend on them not successfully exploiting the secure element, they can use a random 6+ word diceware passphrase instead of a random 6-8 digit PIN.

flighty_sloth

Aeon I think they know that and were pointing it out to the other person, because the article seems to equate AFU mode with being unlocked.

de0u

Aeon The post I quoted wrote "(AFU mode) unlocked". If the device captured by the police was AFU and unlocked, then there was no unlocking to be done. If the device was AFU but locked, then "(AFU mode) unlocked" doesn't clearly represent the situation.

Xtreix

Aeon That's correct, but AFU does not mean the device is unlocked.

de0u Perhaps the report isn't very clear and confuses technical terms.

Rarry

de0u I'm getting a few words wrong

Aeon

I see. I misunderstood, I apologize :-) My understanding of English is not always 100%

Xtreix

Aeon Don't worry it's fine, your previous comment is technically correct.

de0u

Aeon That's ok! My understanding of English is not always 100%, and theoretically it's my native language. Meanwhile, my understanding of other languages isn't above 20% even on a good day, so I have plenty of opportunities to make mistakes.

Blastoidea

de0u
Don’t worry about it.

We have millions of native speakers who can’t construct a simple declarative sentence in grammatical English.

Your english is fine.

fid02

We will need a source, preferably the documents you are referring to, to be able to discuss this further.

Rarry

fid02 https://easyupload.io/m/l61bpx
All proton checks are in Swedish

Xtreix

Rarry Thanks, I don't understand swedish so for now, I look at the pictures.

On a friendly note, and I think everyone here will agree, don't behave like an idiot and do anything stupid that could harm you, don't assume you're above the law, GrapheneOS like other tools are there to help us regain a better control over our digital lives, not to help harmful behavior. I'm not talking about journalists, whistle-blowers and innocent people arrested unjustly.

JayJay

Rarry

This link contains 16pdf files. Could you please link us to which document and page you are referring to?

Its not easy to discuss foreign language files otherwise if we are supposed to translate and search in all 16 ourselves.

fid02

Rarry I can read Swedish, but you need to point to specific page numbers. The documents are 1000+ pages long.

In any case, the GrapheneOS account has already clarified the situation around Cellebrite.

[deleted]

I am not a private investigator and a language specialist. But many among us know what chances are of unlocking a Pixel 6+ in AFU even with 4+ sized PIN. Close to zero. Unless the poor sod chose something easy to guess.