> The company claimed that the patches had “been released to address a recently identified security vulnerability. The security patch strengthens the protections of the solutions.” However, Vice also reports that the company did not “specifically say whether the addressed vulnerability is one and the same as the one disclosed by Marlinspike.”
IIRC Marlinspike didn't disclose one vulnerability, but a massive class of them: Cellebrite must process media in every possible format and thus relies on components from outside sources, FFmpeg being just one example. Cellebrite inherits security vulnerabilities from all those components, and doesn't appear to be diligent in keeping them patched (not that a perfect record of patching would protect them - the attack surface is enormous and probably most component developers don't provide sufficient security).
Integrating insecure code is likely a necessary decision for Cellebrite: Writing, maintaining, and updating their own code to process all types of media, and keep up-to-date with all changes to all those types of the media, seems impossible and certainly uneconomical. What could they do? Maybe they could sandbox each component but then they'd need a lot of horsepower in their device.
IIRC Marlinspike didn't disclose one vulnerability, but a massive class of them: Cellebrite must process media in every possible format and thus relies on components from outside sources, FFmpeg being just one example. Cellebrite inherits security vulnerabilities from all those components, and doesn't appear to be diligent in keeping them patched (not that a perfect record of patching would protect them - the attack surface is enormous and probably most component developers don't provide sufficient security).
Integrating insecure code is likely a necessary decision for Cellebrite: Writing, maintaining, and updating their own code to process all types of media, and keep up-to-date with all changes to all those types of the media, seems impossible and certainly uneconomical. What could they do? Maybe they could sandbox each component but then they'd need a lot of horsepower in their device.