On Thursday, Vice Motherboard reported that an unnamed source provided the site with 900GB of data hacked from Cellebrite, the well-known mobile phone data extraction company.

Among other products, Cellebrite's UFED system offers "in-depth physical, file system, password, and logical extractions of evidentiary data," and is often the go-to product for law enforcement to pull data from seized phones and other devices.

In a statement, Cellebrite called this hack "illegal" and noted that "the company is not aware of any specific increased risk to customers as a result of this incident; however, my.Cellebrite account holders are advised to change their passwords as a precaution."

In addition, the trove of materials contains “customer support tickets” showing that the Israeli company sells its services to countries with questionable human rights records, including Turkey, Russia, and the United Arab Emirates.

Cellebrite’s own website shows that the company works with numerous local, state, and federal law enforcement agencies, ranging from the Hartford, Connecticut police to the North Wales police in the United Kingdom. (The company reportedly aided the FBI to unlock the seized San Bernardino iPhone that became the center of a protracted legal battle.)

However, little is known about the company’s business in many parts of the world.

This would not be the first time that a digital surveillance company sold to unsavory regimes. In 2015, data dumps from Hacking Team showed that it sold exploits to Egypt, Russia, Saudi Arabia, Bahrain, and the United Arab Emirates.

Similarly, in 2014, documents leaked online showing that software created by the controversial UK-based Gamma Group International was used to spy on computers that appeared to be located in the US, the UK, Germany, Russia, Iran, and Bahrain. </s> Cellebrite, a digital forensics firm known for helping law enforcement crack into locked smartphones, has itself fallen victim to hackers.

Technology news website Motherboard said Thursday that it had obtained 900 gigabytes of data related to the Israel-based company. It said the trove of data includes customer information, databases and technical data about the company's products.

Cellebrite released a statement Thursday acknowledging that one of its external web servers had been hacked, adding that that it's investigating the extent of the breach.

Data dump

Motherboard journalist Joseph Cox said that an unidentified hacker gave him 900 gigabytes of data from Cellebrite's servers.

In a series of messages posted to Twitter, he said that most of the data consisted of technical information, evidence and log files but that some of the information contained customer data. In an article , Cox wrote that the trove contained messages from authorities in Russia, Turkey and the Arab Gulf.

Cellebrite could be in for more unwelcome attention. Cox said that Motherboard would "likely be doing more stories from the data."

According to Cellebrite, the server in question included a database backup of an old license management system. It said the hackers accessed basic user contact information and encrypted passwords for users who had not yet moved to the company's new system.

While Cellebrite says it's not aware of any risk to customers as a result of the breach, it's still advising them to change their passwords.

Hacking the hackers

Cellebrite, founded in 1999, has contracts with the FBI dating back to at least 2013. The firm makes devices that allow law enforcement to extract and decode data such as contacts, pictures and text messages from more than 15,000 kinds of smartphones and other mobile devices. It also makes commercial products that companies can use to help their customers transfer data from old phones to new ones.

The company found itself in the spotlight last year after some industry observers speculated that it might have helped the FBI hack into an iPhone used by one of the killer in the San Bernardino, California, mass shooting. That phone was the subject of a major legal fight between the FBI and Apple; the company refused to help break iPhone security. The FBI dropped its case after finding another way into the phone.

Cellebrite claims to do business with thousands of law enforcement and intelligence agencies, militaries and governments in more than 100 countries. But its involvement in the San Bernardino case was never proven. </s> Israeli mobile forensics firm Cellebrite has announced that it has suffered a data breach following an unauthorized access to an external web server.

“The impacted server included a legacy database backup of my.Cellebrite, the company’s end user license management system. The company had previously migrated to a new user accounts system. Presently, it is known that the information accessed includes basic contact information of users registered for alerts or notifications on Cellebrite products and hashed passwords for users who have not yet migrated to the new system,” the company stated, and added that it is still investigating the attack.

They are also notifying affected customers, and advising them to change their passwords.

The confirmation comes a few hours after Motherboard released general information about 900 GB of data that they obtained and has supposedly been stolen from the firm.

“The data appears to have been taken, at least in part, from servers related to Cellebrite’s website. The cache includes alleged usernames and passwords for logging into Cellebrite databases connected to the company’s my.cellebrite domain,” the publication noted. “The dump also contains what appears to be evidence files from seized mobile phones, and logs from Cellebrite devices.”

The hacker that shared the data with the publication and is apparently behind the breach also noted that access to the compromised servers has been traded among hackers in IRC chat rooms, so it’s possible that other persons have exfiltrated potentially sensitive data.

“The Cellebrite breach shows that anyone can be hacked, even firms whose bread and butter is data exfiltration. And Cellebrite isn’t the first organization of this type to be targeted – Hacking Team and Gamma International have both experienced similar attacks by groups opposed to government surveillance,” Tony Gauda, CEO of ThinAir, commented for Help Net Security.

“While the 900 GB of data hasn’t been released publicly, it’s safe to assume that the information is highly sensitive. Besides customer information, the hackers managed to retrieve technical data, which could have serious repercussions if it were to fall into the wrong hands. Incidents such as this are the cyber equivalent of robbing a gun store, and I wouldn’t be surprised if the proprietary info stolen eventually made its way online. Demand for advanced hacking tools and techniques has never been higher and until these firms start securing their digital arsenals with technology capable of rendering data useless when it’s compromised, they will continue to find themselves in the crosshairs of hackers.”

Cellebrite’s name has become widely known after reports that the company has been asked for help to exfiltrate data from the locked iPhone belonging to Syed Farook, one of the San Bernardino shooters. </s> This is part of an ongoing Motherboard series on the proliferation of phone cracking technology, the people behind it, and who is buying it. Follow along here.



The hackers have been hacked. Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite's products.

The breach is the latest chapter in a growing trend of hackers taking matters into their own hands, and stealing information from companies that specialize in surveillance or hacking technologies.

Cellebrite is an Israeli company whose main product, a typically laptop-sized device called the Universal Forensic Extraction Device (UFED), can rip data from thousands of different models of mobile phones. That data can include SMS messages, emails, call logs, and much more, as long as the UFED user is in physical possession of the phone.

Cellebrite is popular with US federal and state law enforcement, and, according to the hacked data, possibly also with authoritarian regimes such as Russia, the United Arab Emirates, and Turkey.

The data appears to have been taken, at least in part, from servers related to Cellebrite's website. The cache includes alleged usernames and passwords for logging into Cellebrite databases connected to the company's my.cellebrite domain. This section of the site is used by customers to, among other things, access new software versions.

Read more: Backroom Trading of Phone Cracking Devices Is Sketchy As Hell

Motherboard verified the email addresses in the cache by attempting to create accounts on Cellebrite's customer login portal. In the majority of cases, this was not possible because the email address was already in use. A customer included in the data confirmed some of their details.

The dump also contains what appears to be evidence files from seized mobile phones, and logs from Cellebrite devices.

According to the hacker, and judging by timestamps on some of the files, some of the data may have been pulled from Cellebrite servers last year.

"Cellebrite recently experienced unauthorized access to an external web server," the company said in a statement on Thursday after Motherboard informed it of the breach.

"The company is conducting an investigation to determine the extent of the breach. The impacted server included a legacy database backup of my.Cellebrite, the company's end user license management system. The company had previously migrated to a new user accounts system. Presently, it is known that the information accessed includes basic contact information of users registered for alerts or notifications on Cellebrite products and hashed passwords for users who have not yet migrated to the new system," the statement continues.

Cellebrite advised customers to change their passwords as a precaution, and added that it is working with relevant authorities to assist in their investigation.

Access to Cellebrite's systems has been traded among a select few in IRC chat rooms, according to the hacker.

"To be honest, had it not been for the recent stance taken by Western governments no one would have known but us," the hacker told Motherboard. The hacker expressed disdain for recent changes in surveillance legislation.

In 2014 a hacker calling themselves "PhineasFisher" publicly released 40GB of data from surveillance company Gamma International. Gamma makes intrusion software that can remotely switch on a target's webcam, siphon off their emails, and much more. The following year, PhineasFisher targeted Italian company Hacking Team, and published a trove of emails and other internal documents from the company.

Although the terms of this Cellebrite breach are somewhat different—the hacker has not dumped the files online for anyone to download—similarities seem to remain, especially in the hacker's vigilante motivation.

The hacker, however, remained vague as to the true extent of what they had done to Cellebrite's systems.

"I can't say too much about what has been done," the hacker told Motherboard. "It's one thing to slap them, it's a very different thing to take pictures of [their] balls hanging out."

Get six of our favorite Motherboard stories every day by signing up for our newsletter. </s> Everything is compromised. In the latest case of a hacking company being hacked, Israel's Cellebrite is the latest to have its internal data hauled off by hackers. Joseph Cox of Motherboard was given inside details by the crew that claims to have spirited away login info and other data from the cell phone-cracking company.

Included in the data haul are some other nifty surprises: evidence files from forensic searches of cell phones and logs from Cellebrite devices.

Cellebrite is a major supplier to US law enforcement, as well as to government agencies in countries with sketchier human rights records like Turkey, Russia, and the United Arab Emirates. In many ways, the company is similar to Italy's Hacking Team, which found itself hacked and its emailed dirty laundry aired by enterprising hackers unimpressed by the company's malleable morality.

What's truly interesting about this hack (and those similar to it) is that they go right to the heart of what's wrong with the DOJ's insistence that any "one-time" phone crack -- like the one they pursued in the San Bernardino mass shooting case -- would be safe as houses in the government's hands.

Riana Pfefferkorn -- who helped write an amicus brief on Apple's behalf (along with several other security researchers and professors) -- pointed out on Twitter that Cellebrite's hacking is exactly the sort of risk the government refused to seriously contemplate during its pursuit of an All Writs Order forcing Apple to open up the phone for the FBI.

If such a hack were created by Apple in response to a court order, there's no way for the FBI, Apple, or anyone else to plausibly claim it would be kept out of the hands of malicious actors. Companies in the business of breaking into devices aren't impervious to outside attacks. Neither is the US government, which has proven consistently weak when it comes to securing the massive amount of personally-identifiable information it collects from US citizens.

So far, the collected files haven't been shown to anyone but a few journalists, but Cox points out unauthorized access to Cellebrite isn't exactly a new thing.

Access to Cellebrite's systems has been traded among a select few in IRC chat rooms, according to the hacker. “To be honest, had it not been for the recent stance taken by Western governments no one would have known but us,” the hacker told Motherboard. The hacker expressed disdain for recent changes in surveillance legislation.

Cellebrite's response to the hack is to claim that the only thing affected was a legacy server for end user licenses. Customers are being encouraged to change their passwords, but that comes a little too late to do much good. That license server may be the only thing breached through unauthorized means, but the log files and obtained evidence the hackers appear to have could easily have been taken out of the front end with compromised credentials.

The underlying fact is this: breaking protections like encryption or purchasing exploits to defeat it is something the FBI and other law enforcement entities will continue to advocate for, even while aware that it's impossible to claim definitively that the tools used won't be hijacked by someone else with more malicious motives. The Shadow Brokers' heist of NSA exploits shows that even if the government takes steps to protect what it has stored on its own servers, it can't prevent a disgruntled analyst from leaving a blackhat toolbag behind for others to find once a surveillance job is finished. </s> investigators hunted for those behind an unprecedented cyber-attack that affected systems in dozens of countries, including at banks, hospitals and government agencies, as security experts sought to contain the fallout.

The assault, which began Friday and was being described as the biggest-ever cyber ransom attack, struck state agencies and major companies around the world — from Russian banks and British hospitals to FedEx and European car factories.

"The recent attack is at an unprecedented level and will require a complex investigation to identify the culprits," said Europol, Europe's police agency.

Europol said a special task force at its European Centre was "specially designed to assist in such investigations and will play an important role in supporting the investigation".

The attacks used ransomware that apparently exploited a security flaw in operating systems, locking users' files unless they pay the attackers a designated sum in the virtual currency

Images appeared on victims' screens demanding payment of $300 in Bitcoin, saying: "Ooops, your files have been encrypted!"

Payment is demanded within three days or the price is doubled, and if none is received within seven days the files will be deleted, according to the screen message.

But experts and government alike warn against ceding to the hackers' demands.

"Paying the ransom does not guarantee the encrypted files will be released," the US Department of Homeland Security's computer emergency response team said.

"It only guarantees that the malicious actors receive the victim's money, and in some cases, their banking information."

Experts and officials offered differing estimates of the scope of the attacks, but all agreed it was huge.

Mikko Hypponen, chief research officer at the Helsinki- based cyber security company F-Secure, told AFP it was the biggest ransomware outbreak in history, saying that 130,000 systems in more than 100 countries had been affected.

He said and India were hit particularly hard, largely because Microsoft's Windows XP — one of the operating systems most at risk — was still widely used there.

French police said there were "more than 75,000 victims" around the globe, but cautioned that the number could increase "significantly".

The virus spread quickly because the culprits used a digital code believed to have been developed by the US National Security Agency — and subsequently leaked as part of a document dump, according to researchers at the Moscow-based computer security firm Kaspersky Lab. </s> Technology companies could be ordered to release vital electronic data, such as emails and text messages, to law enforcement agencies in as little as six hours under proposed European Union rules aimed at speeding up access to electronic evidence on crimes such as terrorist plots.

Judges would get the right to directly request key data regardless of where it is stored, with a deadline to respond within 10 days, or six hours in case of an emergency, the European Commission said on Tuesday. The proposals are aimed at replacing an unwieldy system that too often slows down investigations due to the difficulties to access this data.

"While law enforcement authorities still work with cumbersome methods, criminals use fast and cutting-edge technology to operate,” EU Justice Commissioner Vera Jourova said in a statement on Tuesday. “We need to equip law enforcement authorities with 21st century methods to tackle crime, just as criminals use 21st century methods to commit crime.”

Police investigations into the terror attacks in Belgium’s capital Brussels just over two years ago connected the main suspect to a cell involved in other European attacks, which the police suspected communicated mainly through email drafts. Under current rules, access to one particular email stored on a Microsoft Corp. server in Ireland would take about a year, by which time data risks being deleted, according to the commission.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice,” Frans Timmermans, first vice-president at the commission said. The new plans would give authorities “unprecedented tools” to access electronic evidence “quickly, efficiently across borders.” </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users’ data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the European Union yesterday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The EU executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

“Electronic evidence is increasingly important in criminal proceedings,” said European Commission Vice President Frans Timmermans.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.”

On the frontline of the ongoing investigation into claims that Cambridge Analytica may have illegally harvested Facebook data for political ends, former CA boss Alexander Nix has refused to appear for a second grilling by British lawmakers, the MPs’ scrutiny panel investigating him said yesterday.

The ex-CA chief executive was due to appear today before parliament’s culture, media and sport committee over the British political consultancy firm’s highly controversial work. They wanted to probe inconsistencies in the testimony he gave before the committee on February 27.

Digital borders are a growing global issue in an era where big firms operate so-called cloud networks of giant data centers, which means that an individual’s data can reside anywhere.

Technology companies have found themselves torn between protecting consumers’ privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that US judges could issue warrants for data held abroad while giving firms an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement. </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

They will also be able to ask companies to ensure electronic evidence is not deleted while they prepare their so-called production order.

Fraught with complexity

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

CCIA, a tech association that includes Google and Facebook, welcomed the proposal but said it only offered a limited mechanism for addressing the risk that companies find themselves torn between two conflicting national laws.

"We welcome today's proposals, which can help authorities obtain digital evidence more effectively and with more transparency and legal clarity," said Alexandre Roure, CCIA Europe's senior manager.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-US coordinated approach instead of a French-US approach, a Belgian-US approach because that leads to fragmentation," a Commission official said.
Cellebrite, a data extraction company used by U.S. law enforcement, is hacked leaking 900 GB of confidential data from its servers.