{"id":7122,"date":"2020-12-23T14:03:32","date_gmt":"2020-12-23T14:03:32","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7122"},"modified":"2021-03-10T08:34:07","modified_gmt":"2021-03-10T08:34:07","slug":"cellebrites-signal-hack-claims-and-cybersecurity","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/cellebrites-signal-hack-claims-and-cybersecurity\/","title":{"rendered":"What Cellebrite\u2019s Signal Hack Claims Teach Us About Cybersecurity"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7122\" class=\"elementor elementor-7122\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">You may have seen the interesting tale of <\/span><a href=\"https:\/\/www.cellebrite.com\/en\/blog\/cellebrites-new-solution-for-decrypting-the-signal-app\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Cellebrite\u2019s Signal hack claims<\/span><\/a><span style=\"font-weight: 400;\"> that they cracked Signal\u2019s at rest encryption, giving them access to encrypted messages on the app when they are physically on the device. This claim was quickly ridiculed, Cellebrite had to roll back their blog giving away their secrets, and Signal\u2019s creator, Moxie Marlinspike <\/span><a href=\"https:\/\/twitter.com\/moxie\/status\/1337434126186553345?s=20\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Tweeted<\/span><\/a><span style=\"font-weight: 400;\"> \u201cThey could have also just opened the app to look at the messages\u201d.<\/span><\/p>\n<p style=\"font-weight: 400;\">\n<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">However what this story of Cellebrite\u2019s Signal hack claims does teach us is the tenacity with which hackers of all colours (both \u2018good\u2019 and \u2018bad\u2019) will pursue the challenge of breaching security defences of, well, everyone.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Cellebrite cracked the uncrackable &#8211; or did they?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Signal is universally regarded as the most secure publicly available messenger service. Their&nbsp; proprietary end-to-end encryption system is considered to be impossible to break, keeping all conversations secure. Additional security features include encrypting messages at rest (on your device) so that they can\u2019t be read if the phone is hacked, and disappearing messages. As a result Signal (and other encrypted apps like it) have become popular with people who do not want their messages to be read by others.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"word-spacing: normal;\">Cellebrite\u2019s announcement says that they have found a way to access the decryption key used to decrypt at rest messages on a user\u2019s device. So far so good. However their initial blog set out how they can access this decryption key <\/span><i style=\"word-spacing: normal;\">if they have the device itself unlocked and in their possession<\/i><span style=\"word-spacing: normal;\">. As Moxie says &#8211; once you have the device in your hand, you can just open the app and read the messages that way &#8211; a whole lot quicker, and easier.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Signal users everywhere breathed sigh of relief at this point. Cellebrite can\u2019t do anything they can do themselves. They still can\u2019t intercept messages in transit, and they can\u2019t access deleted messages.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">What does this mean for Signal?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">While Signal, the media, and commentators everywhere have quickly and correctly pointed out that this doesn\u2019t change anything for users, this news is a precedent that Signal do not want to continue to experience.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">While practically speaking it doesn\u2019t look as though Cellebrite\u2019s Signal hack achieved too much, the question is where will this lead next? Where will it stop &#8211; can a hacker who has access to the device remotely access the key and then exploit it? For Signal, these are questions that they should be considering now because hackers now have them in their sights.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Beneath the ridicule, this story does demonstrate that everything is hackable with enough effort &#8211; even the most encrypted of apps. In this case, Cellebrite sees this activity as ethical &#8211; their motivation is to support their customers, law enforcement agencies around the world, in their efforts to catch criminals who communicate with their networks via an encrypted chat app.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">However many hackers have a different motivation entirely &#8211; causing disruption, making money, or plain old <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/\"><span style=\"font-weight: 400;\">cyberespionage<\/span><\/a><span style=\"font-weight: 400;\">. If they decide that the benefits they can extract from hacking Signal is worth more than the effort in doing it, they will continue to do so.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Signal will also encounter a very common outcome of any kind of news they have been compromised &#8211; that of user confidence. As mentioned above, Signal users include politicians, journalists, business men, and other people for whom it is vitally important that their chats remain secret. Those users will be watching this news with nervousness, even as Signal, the media, and everyone else assures them that their messages are safe.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Cellebrite\u2019s Signal hack claims &#8211; what really happened?<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">On the surface, one company (let\u2019s call them company A) claimed that they had made a major breakthrough in breaking the defences of one of the world\u2019s most secure applications (company B). This claim drew a lot of attention which then seemed to show that in reality, company A had greatly exaggerated their claims, and that company B was in fact as secure as ever. But taking the PR own goal away, the story of Cellebrite\u2019s Signal hack has cybersecurity implications.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Everyone can be hacked to some extent or another, no matter how security conscious they are. The most determined hackers will continue to hack away (pun intended) on every security element, no matter how insignificant, until they reach their goal. For cybersecurity professionals and security conscious organisations, this means they have to be constantly on guard, <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\"><span style=\"font-weight: 400;\">improving cybersecurity defences<\/span><\/a><span style=\"font-weight: 400;\">, and ensuring that they are on top of their cybersecurity posture.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">This lesson is an important one to take into 2021, a year in which cybersecurity professionals expect the security defences of every organisation to continue to be attacked.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Have a merry Christmas, and a safe and healthy new year.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>You may have seen the interesting tale of Cellebrite\u2019s Signal hack claims that they cracked Signal\u2019s at rest encryption, giving them access to encrypted messages on the app when they are physically on the device. This claim was quickly ridiculed, Cellebrite had to roll back their blog giving away their secrets, and Signal\u2019s creator, Moxie&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7127,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7122"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7122"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7122\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7127"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}