{"id":14129,"date":"2025-10-31T10:49:13","date_gmt":"2025-10-31T17:49:13","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=14129"},"modified":"2025-11-23T12:21:38","modified_gmt":"2025-11-23T19:21:38","slug":"someone-snuck-into-a-cellebrite-microsoft-teams-call-and-leaked-phone-unlocking-details","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2025\/10\/31\/someone-snuck-into-a-cellebrite-microsoft-teams-call-and-leaked-phone-unlocking-details\/","title":{"rendered":"Someone Snuck Into a Cellebrite Microsoft Teams Call and Leaked Phone Unlocking Details"},"content":{"rendered":"\n<p>It would appear that Cellebrite can get into stock Android phones before first unlock and get some information, so they must be sitting on vulnerabilities they paid for, or Google included. With standard Android after first unlock they have Full File System access, FFS. Seems if you haven&#8217;t done the first unlock, disk decryption, all the Graphene OS devices with current updates are secure. The key takeaway being that you need to turn your Graphene OS device off before transitioning the border so they can&#8217;t get into it, or anywhere else where it might be confiscated. If you refuse to enter your PIN, they&#8217;ll keep it to make a copy of the SSD before returning it by mail (Graphene OS has a decoy PIN that enters into a minimal decoy account). I&#8217;d probably just use a burner if traveling outside the country and back with minimal information, wiping it before the border. Getting into your phone is an extreme violation of your privacy, gaining access to pictures, chats, logins, passwords&#8230; The other table entry appears to be BF, Brute Force, which can&#8217;t be done on any version.<\/p>\n\n\n\n<p><a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/www.404media.co\/someone-snuck-into-a-cellebrite-microsoft-teams-call-and-leaked-phone-unlocking-details\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/www.404media.co\/someone-snuck-into-a-cellebrite-microsoft-teams-call-and-leaked-phone-unlocking-details\/<\/a><\/p>\n\n\n<div class=\"wp-block-ub-divider ub_divider ub-divider-orientation-horizontal\" id=\"ub_divider_be924f96-24c6-4f48-a061-6e9061d9f423\"><div class=\"ub_divider_wrapper\" style=\"position: relative; margin-bottom: 2px; width: 100%; height: 2px; \" data-divider-alignment=\"center\"><div class=\"ub_divider_line\" style=\"border-top: 2px solid #ccc; margin-top: 2px; \"><\/div><\/div><\/div>\n\n\n<p>By Joseph Cox<\/p>\n\n\n\n<p>The leaked slide focuses on Google Pixel phones and mentions those running the security-focused GrapheneOS operating system.<\/p>\n\n\n\n<figure class=\"wp-block-image alignwide\"><img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20251030171434im_\/https:\/\/www.404media.co\/content\/images\/size\/w2000\/2025\/10\/cellebrite-youtube.png\" alt=\"Someone Snuck Into a Cellebrite Microsoft Teams Call and Leaked Phone Unlocking Details\"\/><figcaption class=\"wp-element-caption\">Screenshot from Cellebrite&#8217;s YouTube.<\/figcaption><\/figure>\n\n\n\n<p>Someone recently managed to get on a Microsoft Teams call with representatives from phone hacking company Cellebrite, and then leaked a screenshot of the company\u2019s capabilities against many Google Pixel phones, according to a forum post about the leak and 404 Media\u2019s review of the material.<\/p>\n\n\n\n<p>The leak follows others obtained and verified by 404 Media over the last 18 months. Those leaks <a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/www.404media.co\/leaked-docs-show-what-phones-cellebrite-can-and-cant-unlock\/\"><u>impacted both Cellebrite<\/u><\/a> <a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/www.404media.co\/leaked-documents-show-what-phones-secretive-tech-graykey-can-unlock-2\/\"><u>and its competitor Grayshift<\/u><\/a>, now owned by Magnet Forensics. Both companies constantly hunt for techniques to unlock phones law enforcement have physical access to.<\/p>\n\n\n\n<p>\u201cYou can Teams meeting with them. They tell everything. Still cannot extract esim on Pixel. Ask anything,\u201d a user called rogueFed <a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/discuss.grapheneos.org\/d\/27698-new-cellebrite-capability-obtained-in-teams-meeting?ref=404media.co\" target=\"_blank\" rel=\"noreferrer noopener\"><u>wrote on the GrapheneOS forum<\/u><\/a> on Wednesday, speaking about what they learned about Cellebrite capabilities. GrapheneOS is a security- and privacy-focused Android-based operating system.<\/p>\n\n\n\n<p>rogueFed then posted two screenshots of the Microsoft Teams call. The first was a Cellebrite Support Matrix, which lays out whether the company\u2019s tech can, or can\u2019t, unlock certain phones and under what conditions. The second screenshot was of a Cellebrite employee.&nbsp;<\/p>\n\n\n\n<p>According to another of rogueFed\u2019s posts, the meeting took place in October. The meeting appears to have been a sales call. The employee is a \u201cpre sales expert,\u201d according to a profile available online.<\/p>\n\n\n\n<p>The Support Matrix is focused on modern Google Pixel devices, including the Pixel 9 series. The screenshot does not include details on the Pixel 10, which is Google\u2019s latest device. It discusses Cellebrite\u2019s capabilities regarding \u2018before first unlock\u2019, or BFU, when a piece of phone unlocking tech tries to open a device before someone has typed in the phone\u2019s passcode for the first time since being turned on. It also shows Cellebrite\u2019s capabilities against after first unlock, or AFU, devices.&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"855\" src=\"https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2025\/10\/image-57-1024x855.png\" alt=\"\" class=\"wp-image-14507\" srcset=\"https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2025\/10\/image-57-1024x855.png 1024w, https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2025\/10\/image-57-300x251.png 300w, https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2025\/10\/image-57-768x641.png 768w, https:\/\/jasonsblog.ddns.net\/wp-content\/uploads\/2025\/10\/image-57.png 1170w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The Support Matrix also shows Cellebrite\u2019s capabilities against Pixel devices running GrapheneOS, with some differences between phones running that operating system and stock Android. Cellebrite does support, for example, Pixel 9 devices BFU. Meanwhile the screenshot indicates Cellebrite cannot unlock Pixel 9 devices running GrapheneOS BFU.<\/p>\n\n\n\n<p>In a statement, Victor Cooper, senior director of corporate communications and content strategy at Cellebrite, told 404 Media \u201cWe do not disclose or publicize the specific capabilities of our technology. This practice is central to our security strategy, as revealing such details could provide potential criminals or malicious actors with an unintended advantage.\u201d Google did not immediately respond to a request for comment.<\/p>\n\n\n\n<p>GrapheneOS is <a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/grapheneos.org\/?ref=404media.co\" target=\"_blank\" rel=\"noreferrer noopener\"><u>a long running project<\/u><\/a> which makes sizable security changes to an Android device. \u201cGrapheneOS is focused on substance rather than branding and marketing. It doesn&#8217;t take the typical approach of piling on a bunch of insecure features depending on the adversaries not knowing about them and regressing actual privacy\/security. It&#8217;s a very technical project building privacy and security into the OS rather than including assorted unhelpful frills or bundling subjective third party apps choices,\u201d the project\u2019s website reads.<\/p>\n\n\n\n<p>As well as being used by the privacy and security conscious, criminals also turn to GrapheneOS. After the FBI <a href=\"https:\/\/web.archive.org\/web\/20251030171434\/https:\/\/www.hachettebookgroup.com\/titles\/joseph-cox\/dark-wire\/9781541702707\/?lens=publicaffairs&amp;ref=404media.co\"><u>secretly ran its own backdoored encrypted phone company<\/u><\/a> for criminals, some drug traffickers and the people who sell technology to the underworld shifted to using GrapheneOS devices with Signal installed, according to interviews with phone sellers.<\/p>\n\n\n\n<p>In their forum post, rogueFed wrote that the \u201cmeeting focused specific on GrapheneOS bypass capability.\u201d<\/p>\n\n\n\n<p>They added \u201cvery fresh info more coming.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It would appear that Cellebrite can get into stock Android phones before first unlock and get some information, so they must be sitting on vulnerabilities they paid for, or Google included. With standard Android after first unlock they have Full File System access, FFS. Seems if you haven&#8217;t done the first unlock, disk decryption, all [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-14129","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=14129"}],"version-history":[{"count":6,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14129\/revisions"}],"predecessor-version":[{"id":14508,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/14129\/revisions\/14508"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=14129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=14129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=14129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}