Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Israeli Firm Can Steal Phone Data in Seconds

Petah Tikva, Israel – It only takes a few seconds for an employee of one of the world’s leading hacking companies to take a locked smartphone and pull the data from it.

Petah Tikva, Israel – It only takes a few seconds for an employee of one of the world’s leading hacking companies to take a locked smartphone and pull the data from it.

Israeli firm Cellebrite’s technology provides a glimpse of a world of possibilities accessible to security agencies globally that worry privacy advocates.

The company has contracts in more than 115 countries, many with governments, and it shot to global prominence in March when it was reported the FBI used its technology to crack the iPhone of one of the jihadist-inspired killers in San Bernardino, California.

There have since been reports that Cellebrite was in fact not involved, and the company itself refuses to comment.

Regardless, it is recognized as one of the world’s leaders in such technology.

It can reportedly take a wide range of information off devices: from the content of text messages to potentially details of where a person was at any given moment.

Even messages deleted years before can be potentially retrieved.

“There are many devices that we are the only player in the world that can unlock,” Leeor Ben-Peretz, one of the company’s top executives, told AFP in English.

But privacy and rights activists worry such powerful technology can wind up in the wrong hands, leading to abuses.

‘Cat and mouse’

Cellebrite’s technology is not online hacking. It only works when the phone is physically connected to one of the firm’s devices.

The company recently demonstrated its capabilities for an AFP journalist.

The password on a phone was disabled and newly taken photos appeared on a computer screen, complete with the exact location and time they were taken.

The phone in the demonstration, an LG G4 run on Google’s Android operating system, is a model Cellebrite had already cracked, so the extraction did not take long.

The real challenge, Ben-Peretz agrees, is staying in the lead in a race where phone manufacturers constantly launch new models and update software with ever more complicated security.

In the firm’s lab they have 15,000 phones — with around 150-200 new models added each month.

When a new phone is launched, Ben-Peretz said, their 250-person research team races against competitors to find a chink in its armor, a process that can range from a few days to months.

iPhones present a particular challenge because, unlike many firms, Apple designs everything from the device’s hardware to software, making its technology particularly difficult to hack, explained Yong Wang, a professor at Dakota State University in the United States.

Ben-Peretz remains confident his company can crack even the newest iPhones.

“iOS devices have strong security mechanisms that give us a challenge, but if anyone can address this challenge and provide a solution to law enforcement, it is Cellebrite,” he said, referring to Apple’s operating system.

Legitimate means?

According to Ben-Peretz, there is no phone on the market that is impossible to crack.

“Yes it is getting harder, it is getting more complex,” he said. “But we still deliver results and they are results on the latest devices and latest operating systems.”

Among the data the firm claims to be able to access are text messages deleted years previously.

“In some devices even if you would format the device and you would believe the data is deleted, still a significant portion of it exists,” Ben-Peretz added.

The company sells its products largely to police and law enforcement agencies across the globe, though also increasingly to private firms doing corporate investigations.

It has seen particularly high growth in Asia, multiple times the 15 percent global growth rate, Ben-Peretz said without providing specific numbers.

Rights groups worry that the technology can be used by dictatorial regimes to abuse peoples’ privacy.

“Any company, including Cellebrite, has a responsibility to ensure their business activities don’t contribute to or benefit from serious human rights violations,” said Sari Bashi, Israel advocacy director at Human Rights Watch.

Ben-Peretz said the company vets clients and always respects local laws, but the governments are primarily responsible.

“Take a look at any regime, potential regime around the world: Could you do anything to deprive them from throwing a stone at someone or from driving a car and running over people?

“You can’t blame the car manufacturer at that point for delivering a car that was utilized to commit that kind of crime,” he said.

Bashi called the comparison misleading as cars are mass-produced.

“A surveillance contract is a bit different. You have a small number of clients and there is an opportunity to ask questions or to ask for a commitment that the technology will not be used for X, Y and Z.”

Written By

AFP 2023

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

The February 2023 security updates for Android patch 40 vulnerabilities, including multiple high-severity escalation of privilege bugs.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

South Dakota Gov. Kristi Noem says her personal cell phone was hacked and linked it to the release of documents by the January 6...