Cellebrite Premium July 2024 documentation

ryrona

morapelor "Bro like if only bad people are targeted I don't see the issue". Astonishing and mind blowing someone can be so into personal information security to join a forum on a niche hardened build of Android and still go ahead and spout laughably naive line reads like that.

I belong to a minority that is viewed as bad by most in society. I am also an activist fighting for improving our situation. I don't think it was naive what I said, I know all about misuse of power, I know several people who have been arrested by the police while not having done anything wrong at all, including fellow activists. I also know several who have been victims of criminal acts, such as doxxing, harassment and violence. One woman I know ended up in hospital a few years ago, it is surprising she is still fighting.

Tools like GrapheneOS is important to us, to keep us and our contacts safe, and to allow us to continue fighting for improving our situation. Or we would be silenced. But the world we dream of, is one where we are safe and able to be ourselves openly. And that would be a world without any authoritarian power misuse and without any criminality.

DeletedUser313

BFU: Before First Unlock exploitation of OS
BF: Brute Force password after BFU exploitation, which requires bypassing secure element brute force protection if implemented
AFU: After First Unlock exploitation of OS
FFS: Full Filesystem Extraction from an unlocked device

Why does FFS only refer to unlocked devices? Is it completely impossible to have FFS from a BFU device?

IksNorTen It's still good if you're not at risk of being targeted by the government and works against petty thieves etc.

unrealnegan Do you have a source?

unrealnegan

DeletedUser313 Is in a trial report of a current German case. Source is https://alleantifa.noblogs.org/post/2025/05/26/21-05-2025-bericht-vom-17-prozesstag/

Is under point 5.

final

@DeletedUser313 You can't perform an FFS in BFU because in BFU device data is still encrypted by a credential. In BFU only a miniscule amount of operating system metadata is available.

You would need to brute force the device (not known to be possible on fully supported Pixels) or know the credential beforehand, but if you know the credentials then you are performing an Unlocked extraction, not an AFU or BFU extraction. AFU refers to locked devices in AFU state.

Motionsickness

Thank you so much for this information

Desertstorm

Hallo, did anyone of you see the video on tiktok of hi tech investigations where he shows a graykey report af a Iphone 15/16 in BFU state getting a full access on ios 18.2 apparently due to a persistent issue in the usb c connection

grayway2

Desertstorm never heard about and I don't use tiktok. Do you have other sources ?

Panda-na

https://thehackernews.com/2025/07/chinas-massistant-tool-secretly.html?m=1

China has a tool they call Massistant to breach the security of mobile devices. Needs to be physically connected to the device. It's a successor of MFSocket.

Made by SDIC Intelligence Xiamen Information Co., Ltd., which was formerly known as Meiya Pico.

Just wanted to post this here for information, and for folks to find it if they search the forum.

GrapheneOS

We have the latest documentation from June 2025 and there are no changes to their GrapheneOS support. Brute forcing remains unsupported for Pixel 6 and later. We can see if there's anything documented about it in the next Cellebrite Premium update for the stock Pixel OS based on the launch of Android 16 and the opt-in Advanced Protection enabling a weaker USB protection than ours while locked. Despite being weaker, we'd expect it still defeats their current exploits not targeting the lower level attack surface but rather only drivers.

Bozo

GrapheneOS

What was the summary of the iOS results?

unrealnegan

GrapheneOS Can you provide the current documentation?

other8026

morapelor No. It's perfectly reasonable for us not to publicly release things that might get people in trouble, maybe even very serious trouble.

I'd also point out that as a project dedicated to privacy and security, we of course will respect sources' requests to keep things between us if they share sensitive information with us.

morapelor gag order

I'm not a lawyer, but I don't think that this makes any sense because we still talk about it, like in this post here:

GrapheneOS We have the latest documentation from June 2025 and there are no changes to their GrapheneOS support.

morapelor no longer trustworthy.

You're free to think what you want, but it's not appropriate to share these kinds of made up theories with absolutely zero proof.

Edit: other relevant quotes from the official project account

GrapheneOS We don't plan to publish the documents ourselves anymore, but there was a user on our forum who published the extended documentation before and they may do it again.

GrapheneOS We have the latest January 2025 documentation, we just don't want to risk having the leak closed by continuing to publish it directly even as screenshots rather than only publishing the information.

GrapheneOS We have access to later documentation than July 2024, we just don't plan to publish it anymore to avoid the leaks to us being closed.

^ It's been clear from the beginning that the project doesn't want to continue publishing these kinds of documents leaked to us.

HarryLion

GrapheneOS
Unfortunately, I live in a country where Pixel phones aren't available.
I use an Android phone. I know Android phones are vulnerable to unlocking. Could you elaborate on USB protection?
Is it possible to unlock my phone using the Cellbrite tool when the USB protection feature is currently disabled?
Doesn't the Z Fold 7 offer 'Android 16 opt-in advanced protection'? Is the Z Fold 7 safe?

akc3n

unrealnegan Can you provide the current documentation?

No. We will not release any current or future documentation to avoid jeopardizing our sources. And nothing has changed in the last couple weeks from the time of the posted comment you are replying to:

the latest documentation from June 2025 and there are no changes to their GrapheneOS support

morapelor

akc3n Unfortunately this position that you don't need to show anybody anything despite being willing to prior just makes it a reasonably possible to believe that you've been served a gag order of some kind and are no longer trustworthy.

GrapheneOS

morapelor We have not been served with any gag order and we clearly explained why we're no longer going to be publishing the more recent documentation. The people providing us with access to the newer documentation do not want us to publish it because they believe Cellebrite could be adding metadata to the files to trace leaks. Therefore, we aren't going to publish it both out of respect for the wishes of the people providing it to us and because we do not want the leak to be traced and closed, potentially with serious consequences for the people leaking it. We already very clearly explained this a long time ago. You aren't going to get us to violate the agreement we made with the source providing it to stop directly publishing it by posting baseless conspiracy theories. The only way we'll publish it is if we can obtain multiple entirely separate sources and can confirm the files are identical across each source so we know it's not having any metadata inserted. We currently have one source for it and therefore can't compare the files.

Bimmy

other8026

I understand this position and consider it reasonable.

Another loosely related thought:
I wonder whether it might be the right time to unpin the thread at hand, now, and only bring it up, when there is something significantly new on the topic.

In this context and if you allow me some nitpicking: The thread is titled "[...] Juli 2024 documentation", so strictly speaking we drift more and more offtopic. (;-))

Consequently, this could pose another argument to unpin and rather create follow-up announcement threads, particularly when dealing with future leaks. (Maybe cross-reference to the 2024 thread.)

Or, if it's really intended to keep the thread at hand pinned up indefinitely, It should at least be renamed.

DeletedUser433

It's a relief to see that conspiracy theories don't get much momentum here unlike in many other sites

bladeebrown

Privacyfanatic

According to this reddit user who had his iOS devices, LE were able to exploit BFU on an iphone 13 and 14 without the passcode, or a bruteforce using "Cellebrite Premium modified especially for LE use".

@GrapheneOS What do you make about this, is it at all possible to ask your source to verify whether this can be done? I would hazard a guess that it's directly extracting the encryption key due to a memory leak, or exploiting the secure enclave. Many people come to GOS after bad run-ins of this sort to start with, and if true, this totally destroys the BFU + Alphanumeric preclusion. If you can verify this I'm sure it would cause a fair few more people to come to GOS sooner.

https://www.reddit.com/r/antiforensics/comments/1g60b2w/comment/lyldg2o/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

https://www.reddit.com/r/antiforensics/comments/1g60b2w/comment/lylgq7i/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

phone-company

I believe there is a vulnerability in the USB C interface that currently only affects Apple's iPhone. Another vulnerability was discovered in WhatsApp for iPhone that allows malicious code to be executed without confirmation. Could this be the cause in this case?

bladeebrown

phone-company

Hi-Tech investigations, which I believe is who you are referring to who posted about this on TikTok, stated that the passcode was acquired via spyware in reference to his video (he did however delete his comment, I assume to not jeopardise legal action). This makes sense, as the progress report he showed on the papers in his video appears to the likely process of a "passcode known" extraction. The ACE-3 USB-c interface is not used on the iphone 13 or 14, so this attack would be irrelevant to those devices. Furthermore, the ACE-3 exploit uses a side channel attack as can be seen here:

https://events.ccc.de/congress/2024/hub/en/event/ace-up-the-sleeve-hacking-into-apple-s-new-usb-c-controller/

This does provide an attack surface, and as the firmware can be dumped allows exploit development, but it may not be as simple as plugging in something like the GrayKey Iris connector which I believe is what they use to bypass USB RM and SDP. More intervention would likely be required.

bladeebrown

phone-company

Second point I missed - extraction through a zero click through whatsapp primarily does not make sense, and even if it did would almost certainly not be forensically sound as it would require an internet connection and initial access to the device. This would quite possibly be more complex than finding a secure enclave exploit.

« Previous Page Next Page »