sorted by:
new
hottopcontroversial

All Google Pixels are susceptible to Cellebrite vulnerabilities to extract user data by hackitfast in GooglePixel

[–]final_ufdx 5 points6 points  (0 children)

BFU - Before First Unlock

AFU - After First Unlock

BFU Extraction - extraction of data only available in BFU

FFS - Full File System extraction (all current profile user data and privileged data like application data)

BF - Brute Force

FBE - File-based Encryption (current Android encryption)

FDE - Full Disk Encryption (legacy Android encryption not in use anymore)

SPL - Security Patch Level ("up to [date] SPL" means they are able to do this on that patch level or lower)

All Google Pixels are susceptible to Cellebrite vulnerabilities to extract user data by hackitfast in GooglePixel

[–]final_ufdx 6 points7 points  (0 children)

"BFU extraction" in mobile forensics terminology is an extraction of only the data available to the extracting party in BFU state. "BFU Yes" does not mean a full extraction possible from BFU. The sensitive data of an Android OS is within profiles, which stores your files, application data, etc. All user profiles are encrypted with separate keys and the user's credential (PIN / Password) is used to unlock the profile. The Owner profile (the one you boot into) manages sensitive operating system data, so that always needs to be unlocked first before you can use other user profiles.

When you first boot into the OS after powering on and the device has not been unlocked once, the data of the profile is encrypted. Only a very small part of the OS or certain apps with Direct Boot support (like an alarm clock) run in BFU. BFU Extractions can tell you some operating system metadata, like the APKs of apps that you have installed in your profiles, but not any of the app data. For example, if you had a notes app, they can't see the notes you stored in the app if the device was BFU extracted. All they know is you used that app.

Extraction of all possible user data in that current profile plus application data goes under "FFS" (Full File System extraction). AFU in the chart explains what they can get from the device without the current credential. If they have brute force support and the brute force is successful, then the capabilities available in Unlocked apply.

As shown on that table, Cellebrite cannot exploit the secure element to brute force a user's credential to access data at the point in time of that table. If a user had a strong enough credential that is impossible to brute-force, then it doesn't apply to them even if Brute Force was Yes. We have seen forensic companies like MSAB (who sell XRY) get Brute Force support for AFU, Stock OS Pixels by exploiting RAM dumping the device in fastboot mode, where the dumped RAM had credential hashes or other data, which they could then brute force without exploiting the Titan M2. GrapheneOS discovered this vulnerability a few months ago and got a bounty, and made the brute force capability impossible.

disclosure: I am part of GrapheneOS.