Unlocking a phone is ‘just a matter of time and resources’ (Q&A)
The FBI’s rumble in the legal jungle with Apple ended with a whimper.
The bureau on Monday, claiming to have accessed the locked iPhone 5C of San Bernardino, Calif., shooter Syed Rizwan Farook with the help of an unnamed third party, backed away from its demand that Apple create a government backdoor to iOS.
Although law enforcement officials wouldn’t confirm who the third party aiding the FBI was, speculation centered not on another U.S. government agency like the NSA or CIA, but on Cellebrite, an obscure Israeli computer security forensics and data analysis company that touts its ability to retrieve data on locked and damaged iPhones.
Last week, Israeli computer security expert Itzhak “Zuk” Avraham, founder of smartphone security company Zimperium, told the Associated Press that he had no doubt the Farook’s iPhone could be hacked. He speculated that Cellebrite, a company he’s been following since 2009, has the technology to prevent an iPhone’s locking feature from engaging upon startup.
More FBI vs Apple coverage
- How an FBI win against Apple could hurt my company
- Why Apple says the Constitution is on its side
- How to FBI-proof your Android
- How to FBI-proof your iPhone
- What happens if the FBI wins its iPhone fight?
- A $20 tool could have prevented the FBI’s iPhone fight
Cellebrite fits security expert expectations of what a private company aiding law enforcement would look like. Founded in Israel in 1999, and owned by the Japan-based Sun Corp., Cellebrite says it works with “thousands” of government agencies, including military and intelligence units, as well as businesses, in more than 100 countries. It says it can retrieve and decode protected data from more than 15,000 kinds of mobile devices. And it makes commercial software, used in some Apple retail stores, that aids in transferring data from older phones to newer models. Cellebrite has worked with the FBI at least since 2013.
Cellebrite declined to comment. The FBI and Apple did not return requests for comment.
Avraham, born in 1988, has been involved in computer security since being assigned to the Israeli Intelligence Corps as a security researcher at 18. His manager at Citadel Technologies described him on LinkedIn as “one of the best hackers [he’s] ever met.” His work at Samsung included demonstrating security vulnerabilities in the ARM computer chips used ubiquitously in mobile devices. And his work at the San Francisco office of Zimperium, which won Israel’s prestigious Mobile Startup of the Year Award in 2013, gives him keen insight into the American and Israeli security worlds.
The Parallax caught up with Avraham, whose Israeli accent remains strong, just as the FBI dropped its case against Apple on Monday. Here is an edited transcript of our conversation.
Itzhak “Zuk” Avraham/Zimperium
Q: Let’s take a look at the differences between how Israel and the United States have reacted to the development of widespread encryption. The FBI wants “backdoor” access to security code. How about Israeli government agencies?
A: I think you should ask this question to the Israeli government. In the army, they have their own encryption experts who are developing their own encryption. They’re not encouraging the private sector to help on encryption matters, and they’re not putting out requests, to my knowledge.
If the Israeli government doesn’t see it as a barrier, is the current debate in United States just politics?
You said it. I don’t think the FBI needed Apple’s help in the first place. Maybe they need it for marketing reasons.
So if it’s not a barrier, why does the Israeli government support security companies? Does it get access to their technology or mandate backdoors?
Some programs from the government support cybersecurity companies. Zimperium hasn’t used them at all. I don’t know anyone who has because it comes with a lot of caveats. One of them is that if you get funded by the government, investors from outside the country are usually not intrigued.
What about government-mandated backdoors?
I hope not, and I believe not. We haven’t had any requests from the United States, not from Israel, not from anyone else. It’s not something the world should have.
If we get a request to build such technology, we’d consider moving out of the country rather than complying. I don’t see that it would be helpful to make these requests; they would backfire.
Let’s talk about Cellebrite and the FBI’s iPhone problem. Why did Cellebrite think it could get into that phone?
It specializes in forensics. It works with law enforcement agencies on captured phones, just like the FBI has. It can extract SMS, MMS, calls, call logs—things like that. In some cases, it can even restore deleted SMS messages.
Basically, Cellebrite uses a vulnerability that allows it to bypass the boot level locking mechanism and the timeout. [Farook’s iPhone was set to delete data after 10 failed login attempts.] It has likely used this method in past cases.
Israel is the birthplace of many tech security companies like yours and Cellebrite. Is there a cultural drive founding them? It it the threat of terrorism?
It must be something in the water! There are a lot of startups in Israel—and a lot of competition. Many companies that get funded in the United States wouldn’t get funded in Israel. There’s a lot of innovation, so you need to get creative to stand out.
Israel has a very different approach to cybertechnologies. Like the Swiss do chocolate and watches, Israel does cyber. But Cellebrite’s technology could have come from anywhere.
Do you think your team at Zimperium could break into a locked iPhone?
It’s just a matter of time and resources. If you have enough, anything is possible.