Anti-Forensics: Reverse Engineering a Leading Phone Forensic Tool
summary
Reverse engineering of Cellebrite UFED reveals practical weaknesses: encrypted extractor archives use AES-256-CBC envelopes that are peeled in three stages to yield ZIP payloads, and a custom decrypter is released (without keys) as proof of concept. Debugger bypass and local escalation via EternalBlue enable full access to the tool; investigators find three hard-coded adb keys plus a fourth bundled with a post-exploitation toolkit, letting anyone with the keys reattach to devices. A proof-of-concept app (Lockup) and LineageOS patches are built; reported flaws receive vendor patches.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:05Forensic tool overview
- 2:04Market and ethical concerns
- 3:45Acquiring forensic hardware
- 4:48Capabilities of forensic tools
- 6:44Debugging the UFED device
- 7:46Privilege escalation
- 8:56Bypassing anti-debugging
- 10:07Decryption of archives
- 13:02Forensic tool vulnerabilities
- 13:50Reverse engineering toolkit
- 15:56ADB key vulnerabilities
- 18:35Public risk and policy
- 20:44Disclosure and standards
- 22:19Justice and transparency
- 24:09Defensive mechanisms
- 26:15Defense demo
- 27:11Patching Android OS
- 28:25Conclusion and Q&A
related talks
38mReverse Engineering is not just for hackers
41mPrison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
29mA Day in the Life of a Mobile Malware Reverse Engineer
43mAttacking Android Applications
13mBeyond the Hype: Guanxing on Exploiting Crypto Phones and the Evolution of Security Research
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
47mAttacking Android Applications
32mExplore Adventures in the Underland: Forensic Techniques against Hackers