Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective

Celle­brite makes soft­ware to auto­mate physi­cally extrac­ting and inde­xing data from mobile devi­ces. They exist within the grey – where enter­prise bran­ding joins toget­her with the larce­nous to be called “digi­tal inte­lli­gence.” Their custo­mer list has inclu­ded autho­ri­ta­rian regi­mes in Bela­rus, Russia, Vene­zu­ela, and China; death squads in Bangla­desh; mili­tary juntas in Myan­mar; and those seeking to abuse and oppress in Turkey, UAE, and elsew­here. A few months ago, they announ­ced that they added Signal support to their soft­ware.

Their products have often been linked to the perse­cu­tion of impri­so­ned jour­na­lists and acti­vists around the world, but less has been writ­ten about what their soft­ware actu­ally does or how it works. Let’s take a closer look. In parti­cu­lar, their soft­ware is often asso­ci­a­ted with bypas­sing secu­rity, so let’s take some time to examine the secu­rity of their own soft­ware.

The back­ground

First off, anyt­hing invol­ving Celle­brite starts with some­one else physi­cally holding your device in their hands. Celle­brite does not do any kind of data inter­cep­tion or remote survei­llance. They produce two primary pieces of soft­ware (both for Windows): UFED and Physi­cal Analy­zer.

UFED crea­tes a backup of your device onto the Windows machine running UFED (it is essen­ti­ally a fron­tend to adb backup on Android and iTunes backup on iPhone, with some addi­ti­o­nal parsing). Once a backup has been crea­ted, Physi­cal Analy­zer then parses the files from the backup in order to display the data in brow­sa­ble form.

When Celle­brite announ­ced that they added Signal support to their soft­ware, all it really meant was that they had added support to Physi­cal Analy­zer for the file formats used by Signal. This enables Physi­cal Analy­zer to display the Signal data that was extrac­ted from an unloc­ked device in the Celle­brite user’s physi­cal posses­sion.

One way to think about Celle­bri­te’s products is that if some­one is physi­cally holding your unloc­ked device in their hands, they could open whate­ver apps they would like and take scre­ens­hots of everyt­hing in them to save and go over later. Celle­brite essen­ti­ally auto­ma­tes that process for some­one holding your device in their hands.

The rite place at the Celleb…­rite time

By a truly unbe­li­e­va­ble coin­ci­dence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enter­prise type­face slowly came into focus: Celle­brite. Inside, we found the latest versi­ons of the Celle­brite soft­ware, a hard­ware dongle desig­ned to prevent piracy (tells you somet­hing about their custo­mers I guess!), and a bizar­rely large number of cable adap­ters.

The soft­ware

Anyone fami­liar with soft­ware secu­rity will imme­di­a­tely recog­nize that the primary task of Celle­bri­te’s soft­ware is to parse “untrus­ted” data from a wide vari­ety of formats as used by many diffe­rent apps. That is to say, the data Celle­bri­te’s soft­ware needs to extract and display is ulti­ma­tely gene­ra­ted and contro­lled by the apps on the device, not a “trus­ted” source, so Celle­brite can’t make any assump­ti­ons about the “correct­ness” of the format­ted data it is recei­ving. This is the space in which virtu­ally all secu­rity vulne­ra­bi­li­ties origi­nate.

Since almost all of Celle­bri­te’s code exists to parse untrus­ted input that could be format­ted in an unex­pec­ted way to exploit memory corrup­tion or other vulne­ra­bi­li­ties in the parsing soft­ware, one might expect Celle­brite to have been extre­mely cauti­ous. Looking at both UFED and Physi­cal Analy­zer, though, we were surpri­sed to find that very little care seems to have been given to Celle­bri­te’s own soft­ware secu­rity. Industry-stan­dard exploit miti­ga­tion defen­ses are missing, and many oppor­tu­ni­ties for exploi­ta­tion are present.

As just one exam­ple (unre­la­ted to what follows), their soft­ware bund­les FFmpeg DLLs that were built in 2012 and have not been upda­ted since then. There have been over a hundred secu­rity upda­tes in that time, none of which have been applied.

The exploits

Given the number of oppor­tu­ni­ties present, we found that it’s possi­ble to execute arbi­trary code on a Celle­brite machine simply by inclu­ding a speci­ally format­ted but other­wise inno­cu­ous file in any app on a device that is subse­quently plug­ged into Celle­brite and scan­ned. There are virtu­ally no limits on the code that can be execu­ted.

For exam­ple, by inclu­ding a speci­ally format­ted but other­wise inno­cu­ous file in an app on a device that is then scan­ned by Celle­brite, it’s possi­ble to execute code that modi­fies not just the Celle­brite report being crea­ted in that scan, but also all previ­ous and future gene­ra­ted Celle­brite reports from all previ­ously scan­ned devi­ces and all future scan­ned devi­ces in any arbi­trary way (inser­ting or remo­ving text, email, photos, contacts, files, or any other data), with no detec­ta­ble times­tamp chan­ges or check­sum failu­res. This could even be done at random, and would seri­ously call the data inte­grity of Celle­bri­te’s reports into ques­tion.

Any app could contain such a file, and until Celle­brite is able to accu­ra­tely repair all vulne­ra­bi­li­ties in its soft­ware with extre­mely high confi­dence, the only remedy a Celle­brite user has is to not scan devi­ces. Celle­brite could reduce the risk to their users by upda­ting their soft­ware to stop scan­ning apps it consi­ders high risk for these types of data inte­grity problems, but even that is no guaran­tee.

We are of course willing to respon­sibly disclose the speci­fic vulne­ra­bi­li­ties we know about to Celle­brite if they do the same for all the vulne­ra­bi­li­ties they use in their physi­cal extrac­tion and other servi­ces to their respec­tive vendors, now and in the future.

Below is a sample video of an exploit for UFED (simi­lar exploits exist for Physi­cal Analy­zer). In the video, UFED hits a file that execu­tes arbi­trary code on the Celle­brite machine. This exploit payload uses the Messa­ge­Box Windows API to display a dialog with a message in it. This is for demons­tra­tion purpo­ses; it’s possi­ble to execute any code, and a real exploit payload would likely seek to unde­tec­tably alter previ­ous reports, compro­mise the inte­grity of future reports (perhaps at random!), or exfil­trate data from the Celle­brite machine.

×<MEDIA>@https://signal.org

The copy­right

Also of inter­est, the insta­ller for Physi­cal Analy­zer contains two bund­led MSI insta­ller packa­ges named Apple­Ap­pli­ca­ti­ons­Sup­port64.msi and Apple­Mo­bi­le­De­vi­ce­Sup­port6464.msi. These two MSI packa­ges are digi­tally signed by Apple and appear to have been extrac­ted from the Windows insta­ller for iTunes version 12.9.0.167.

The Physi­cal Analy­zer setup program installs these MSI packa­ges in C:\Program Files\Common Files\Apple. They contain DLLs imple­men­ting func­ti­o­na­lity that iTunes uses to inter­act with iOS devi­ces.

The Celle­brite iOS Advan­ced Logi­cal tool loads these Apple DLLs and uses their func­ti­o­na­lity to extract data from iOS mobile devi­ces. The scre­ens­hot below shows that the Apple DLLs are loaded in the UFED iPhone Logi­cal.exe process, which is the process name of the iOS Advan­ced Logi­cal tool.

It seems unli­kely to us that Apple has gran­ted Celle­brite a license to redis­tri­bute and incor­po­rate Apple DLLs in its own product, so this might present a legal risk for Celle­brite and its users.

The comple­tely unre­la­ted

In comple­tely unre­la­ted news, upco­ming versi­ons of Signal will be peri­o­di­cally fetching files to place in app storage. These files are never used for anyt­hing inside Signal and never inter­act with Signal soft­ware or data, but they look nice, and aest­he­tics are impor­tant in soft­ware. Files will only be retur­ned for accounts that have been active installs for some time alre­ady, and only proba­bi­lis­ti­cally in low percen­ta­ges based on phone number shar­ding. We have a few diffe­rent versi­ons of files that we think are aest­he­ti­cally plea­sing, and will iterate through those slowly over time. There is no other signi­fi­cance to these files.

moxie0 on 21 Apr 2021

Rela­ted: No, Celle­brite cannot 'break Signal encryp­tion.'