I disagree with this. Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode.
I would be interested in seeing this go in front of a court because Signal isn't directly targeting any specific person, and the files are fine until they are processed through a specific broken pipeline.
If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. You cannot repackage vulnerabilities for police and then turn around and play coy because you're not able to keep your software up to date.
In the defense attorney section, the argument shouldn't be about the PoC but the fact that the PoC shows that Cellebrite's software is outdated and could be compromised. You can specifically ask for the backup that was extracted from the mobile device to be analyzed by third party software.
I would be interested in seeing this go in front of a court because Signal isn't directly targeting any specific person, and the files are fine until they are processed through a specific broken pipeline.
If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. You cannot repackage vulnerabilities for police and then turn around and play coy because you're not able to keep your software up to date.
In the defense attorney section, the argument shouldn't be about the PoC but the fact that the PoC shows that Cellebrite's software is outdated and could be compromised. You can specifically ask for the backup that was extracted from the mobile device to be analyzed by third party software.