Cellebrite Premium July 2024 documentation

bladeebrown

Second point I missed - extraction through a zero click through whatsapp primarily does not make sense, and even if it did would almost certainly not be forensically sound as it would require an internet connection and initial access to the device. This would quite possibly be more complex than finding a secure enclave exploit.

bladeebrown

Final point to clear up any confusion :

It could be easy to conflate the ACE-3 vulnerability with CVE-2025-24200, which is what GK and cellebrite were using to bypass USB RM and SDP. It was "patched" in ios 18.3.1 but I am sure they may have found a workaround by now. These are not the same, and are completely unrelated. CVE-2025-24200 is a relatively simple exploit using a malicious USB controller, whereas the ACE-3 vulnerability is, as apple says, highly sophisticated. Furthermore, CVE-2025-24200 was back ported to earlier devices without ACE-3. Quarkslabs did a great writeup here: https://blog.quarkslab.com/first-analysis-of-apples-usb-restricted-mode-bypass-cve-2025-24200.html

JackOfSomeTrades

I'm really not tech savvy so I need some help here. I have an old iPhone XS, and I'm trying to get into it (it isn't stolen, I wouldn't stoop that low). Is it really possible to get into it?

n3t_admin

JackOfSomeTrades no.

JackOfSomeTrades

n3t_admin then what is this whole thing?

n3t_admin

JackOfSomeTrades something you won't have access to. If you have a few million dollars stuck behind the couch cushions and an established organization (they choose carefully who to conduct business with) - you can most probably get into your Xs. Otherwise - no.

JackOfSomeTrades

n3t_admin ok.... but I was asking what this entire thread is exactly

n3t_admin

JackOfSomeTrades it's discussing which phones/operating systems can be unlocked via Cellebrite software. And there doesn't seem to be an exploit for GrapheneOS since 2022, which is why the team kind of flew it as a banner of honor.

HarryLion

GrapheneOS
Unfortunately, I live in a country where Pixel phones aren't available.
I use an Android phone. I know Android phones are vulnerable to unlocking. Could you elaborate on USB protection?
Is it possible to unlock my phone using the Cellbrite tool when the USB protection feature is currently disabled?
Doesn't the Z Fold 7 offer 'Android 16 opt-in advanced protection'? Is the Z Fold 7 safe?

GrapheneOS

HarryLion

Is it possible to unlock my phone using the Cellbrite tool when the USB protection feature is currently disabled?

Cellebrite Premium can very likely successfully exploit it while locked. If it's in the After First Unlock state, it can extract nearly all the data. If it's in the Before First Unlock state, they can attempt to brute force the lock method and can likely bypass secure element throttling in practice based on the available information. It's a new generation device so they may not have added support for it yet, we don't know that.

Doesn't the Z Fold 7 offer 'Android 16 opt-in advanced protection'?

This doesn't provide much protection against exploitation overall. It does support partially disabling USB via the device protection toggle when locked. This may stop current Cellebrite Premium exploits. It does not fully disable USB as GrapheneOS does by default while locked.

Is the Z Fold 7 safe?

It's not as safe against attacks as an iPhone or stock OS Pixel even with the oldest fully supported models of those (such as a Pixel 6). It's far less secure than an iPhone 17 or a GrapheneOS Pixel 8+ which are the most secure available smartphones by far.

phone-company

Samsung is easy going with cellebrite

https://osservatorionessuno.org/blog/2025/03/a-deep-dive-into-cellebrite-android-support-as-of-february-2025/

Browse2

phone-company My Samsung Galaxy S22 was confiscated as part of an ongoing investigation. It had a 13-digit PIN and was in AFU mode at the time. After a year, I was granted access to the investigation files, which included a note that read, "Device could not be read out technically at this time." This seems strange to me because the investigating authorities in my country use Cellebrite Premium and have licenses for it. This suggests that, while it may be possible to read many devices, it may not be possible to read all of them, even if they are marked as supported in the support matrix. Honestly, I was shocked by the result and thought they hadn't done their job properly. However, I must also note that the police here do a poor job of confiscating cell phones. In most cases, the confiscated devices are neither placed in a Faraday cage nor charged. Sometimes, the devices lie around for weeks in a police station before being picked up and sent to the relevant department for evaluation. This entire process takes months in my country.

This is just my experience, though, so take this information with a grain of salt.

Adxm

So any Android device with a strong alphanumeric password is safe from extraction in BFU?

23Sha-ger

Adxm
The opposite of the support matrix says. BFU yes - means it's possible to extract data.

Browse2

Adxm Yes, if you have a strong password and the device is in BFU. However, if your smartphone is in AFU, they might be able to access it depending on the device.

I recommend using Advanced Protection Mode, which is now available for Samsung devices with One UI 8 (since you mentioned having a Samsung device). APM enables an automatic reboot, so if your phone is locked for three days, it will restart and return to BFU.

Cellebrite Premium can reportedly brute-force Samsung devices, so if your PIN or password is weak, they might be able to access your phone. However, if your passphrase is six or seven words long and your device is in BFU, Cellebrite Premium will not be able to brute-force the password in a reasonable amount of time. In fact, a 13-digit PIN is safe enough unless you're a high-value target since it has 10 trillion possible combinations, which is difficult to brute-force if you can't bypass the hardware key derivation. Still, it's better to set a seven-word Diceware passphrase; it's future-proof, even against sophisticated attackers.

23Sha-ger

Browse2
I think your adversary, i.e. local PD, just didnt have Cellebrite Premium. Can be cracked like peanuts on Samsungs with latest edition, including S25. Or simply your case wasn't solid to make it to court. A PD with Cellebrite Premiun can acquire your data if they wanted to. And I know internally how it works. Ex contractor and still have few friends working there.

Browse2

23Sha-ger But is it known how fast Cellebrite Premium's brute force speeds are on Samsung?

23Sha-ger

Sean

Browse2

It takes no more than a week. While the "suspect" is in custody and not cooperating, you submit the data directly to Cellebrite.
There is a mechanism I can't specify, but eventually will get it.
For this extraction there is special fee.
Eventually we get them all.

Browse2

23Sha-ger I'm wondering what data you mean that is sent to Cellebrite? As far as I know, every authority has its own workstations for Cellebrite Premium where several devices can be connected at the same time. And you can't say in general how long it takes to brute force. Some users only have a 4-digit PIN on their cell phone, but others have a complex password. In cases like this with complex passwords, it would take years to brute force the password in the BFU state...

Gosuser109

Hello @GrapheneOS, do you have contacts in all the law enforcement services in the world to affirm that pixels, iPhones or GrapheneOS are the most secure things? If the answer is no, please do not mislead people.

final

Gosuser109 Law enforcement are not qualified to affirm such a thing. They are not vulnerability researchers or exploit developers, they're cops. They are just consumers of the work of other people / organisations, including exploit tools like Cellebrite Premium, GrayKey, and XRY Pro. This thread is about documents from one of the most prolific, capable and budgeted exploit tool developers (Cellebrite) and their lack of capabilities of GrapheneOS in their own docs. These people are far more qualified to make such a statement, and they have done so.

« Previous Page