Israeli digital intelligence company Cellebrite reported last week in a blog post that it can hack the app Signal installed on mobile devices and gain access to data with its Universal Forensic Extract Device (UFED) product.
The post was deleted, and technology experts quickly dismissed the company's claims. Specifically, they say that the cell phones of journalists and human rights activists are not at risk of being hacked when using Signal.
Signal was launched in 2010 by Moxie Marlinspike, an American entrepreneur and cryptographer who worked for tech giants Google, Facebook , and WhatsAppbetween 2012 and 2016.
The app has become a key tool for journalists and human rights activists, who typically use it to communicate with sources, believing the messaging service to be secure
Across the Middle East and elsewhere, governments have used technology – often developed in Israel – to hack phones through messaging apps.
While Facebook, WhatsApp, and Skype use Signal's code to encrypt their users' messages, Signal's app is known for its strong encryption, which adds an extra layer of security by encrypting the files and attachments users send. This way, it ensures users' safety from third-party software.
Etienne Maynier, a security researcher at Amnesty International, told MEE that Cellebrite’s technology is not “groundbreaking.” In order for the Israeli company to access data and perform forensic analysis, it needs full access to a mobile phone, via a passcode, Touch ID or facial recognition. This could be achieved in two ways: legally, by law enforcement asking the user to provide the passcode, or by a technical approach, which exploits security flaws in a device’s system.
Additionally, Maynier pointed out that once Cellebrite's product has full access to a phone's data, there's nothing technically preventing it from accessing Signal data. Maynier added that anyone who has access to an "unlocked" phone will then have access to Signal data and potentially other apps installed on the device.
Maynier emphasized that Signal guarantees security during communication through end-to-end encryption, explaining, however, that the security of data on a phone depends on the security of the system itself.
Founded in 1999, Cellebrite's technology is used in 154 countries, with the company noting that it has "enabled convictions in more than five million cases of serious crimes, including murder, rape, human trafficking and pedophilia.".
Cellebrite's UFED is a tabletthat plugs into a phone to access its data. It is already used by the FBI and other US law enforcement agencies.
Also, eight US public schools last week purchased "mobile forensics tools" from Cellebrite to access data on their students' phones, according to Apple Insider.
UEFD can "pull" SMS messages, call logs, Internet , and deleted data from phones.
As Middle East Eye reports, in January 2017, data stolen from the Israeli company was sold to Turkey, Saudi Arabia and the United Arab Emirates, countries known, among others, for imprisoning journalists and activists. It has also sold its products to repressive countries such as Venezuela, Belarus and Indonesia. In October, it stopped selling information technology to China and the Hong Kong administration, following international criticism.
Maynier stressed that Cellebrite must conduct human rights due diligence to ensure that their products are not used to violate them.
Researcher Richi Jennings conducted an in-depth analysis, which reports that Cellebrite did not actually manage to "break" Signal, but rather extracted messages from mobile phones to which it had physical access and knew the unlock password.
It is worth noting that many Israeli companies, whose founders and employees come from the intelligence and defense industries, have developed technologies to hack and spy on mobile phones. For example, Israel’s largest surveillance company, NSO Group, sold its software to several repressive Arab governments, such as Saudi Arabia, the United Arab Emirates, and Morocco, which used it to spy on journalists and activists.
