3

I was very disappointed to hear that my friend, who had his Android phone seized not too long ago, has had his phone broken by police forensics.

As far as I know, it was a few years old, Samsung, and had a 20-digit password.

It seems that encryption meant nothing, however, as he has received court documents notifying him that the police used Cellebrite to perform a 'full file disk extraction'.

It seems that the encryption on his fully updated phone has been broken.

Questions:

  • With this type of extraction, can forensic analysts get his device password from the dump, in plain text?

  • Full file disk encryption means more than just an image of the device, right? Everything should be assumed to be compromised at this point, correct?

7
  • This is a much better question, thank you.
    – schroeder
    Dec 6, 2023 at 8:17
  • "it was a few years old" -- the age and version of Android will really matter in an answer. A phone can be "fully updated" and still "out of date". Can you provide details on the Android version?
    – schroeder
    Dec 6, 2023 at 8:19
  • There are some recent articles about Cellebrite. Have you looked this kind of thing up? tech.hindustantimes.com/tech/news/… and phonearena.com/news/… ?
    – schroeder
    Dec 6, 2023 at 8:32
  • In fact, what Cellebrite can do is covered by the wiki article on the subject: en.wikipedia.org/wiki/Cellebrite_UFED and since an answer is found on wiki, and any answer will just be quoting public sources, I'll close this question and hope that the wiki link gives you the answer you were looking for.
    – schroeder
    Dec 6, 2023 at 8:41
  • I’m voting to close this question because the answer can be found on Wikipedia.
    – schroeder
    Dec 6, 2023 at 8:43

1 Answer 1

0

Android does not store lock screen credentials at all. This is the cryptographic relationship between authentication of lock screen credentials and File Based Encryption. File Based Encryption encrypts /data partition in android. This is what they mean with full file disk encryption. They still refer to the legacy and deprecated Full Disk Encryption term which is a predecessor of File Based Encryption. Breaking encryption of /data partition does not imply compromise of system partitions. System partitions are not encrypted. They don't have to be. They just have to be integrity protected. Android protects integrity of system partitions by enforcing Android Verified Boot and dm-verity.

However, how the device encryption was broken could indicate that they are capable of compromising integrity of system partitions as well but they are not mutually inclusive. To break device encryption, what they need are attack vectors and entrypoints whose feasibility and availability depend on in which state the phone was in when it was seized.

If it was in After First Unlock State, they can:

  1. Bypass lock screen using privilege escalation.
  2. Compromise kernel to request decryption of data and have it exfiltrated from the device.
  3. Compromise Trusted Execution Environment to decrypt File Based Encryption keys.

If it was in Before First Unlock State, they have to compromise Trusted Execution Environment to bypass cooldown timer in order to brute force lock screen credentials. There is no other way to get around it. However, your phone is less likely to be in Before First Unlock state unless it was shut down either by you or by the adversary or if its battery died.

None of the attack vectors mentioned above are practically feasible by design. No known vulnerabilities will work on a fully updated device. So, spyware agencies research on crafting critical severity exploits that use 0-day vulnerabilities for specific device models and they should at least work through charging port as an entrypoint which is what Cellebrite is doing.

Not the answer you're looking for? Browse other questions tagged .