Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

"The company is telling law enforcement in these briefings that its technology can extract data from Pixel 6, 7, 8, and 9 phones in unlocked, AFU, and BFU states on stock software. However, it cannot brute-force passcodes to enable full control of a device. The leaker also notes law enforcement is still unable to copy an eSIM from Pixel devices. Notably, the Pixel 10 series is moving away from physical SIM cards."

"The Cellebrite table says that Pixels with GrapheneOS are only accessible when running software from before late 2022-both the Pixel 8 and Pixel 9 were launched after that. Phones in both BFU and AFU states are safe from Cellebrite on updated builds, and as of late 2024, even a fully unlocked GrapheneOS device is immune from having its data copied. An unlocked phone can be inspected in plenty of other ways, but data extraction in this case is limited to what the user can access."

"The original leaker claims to have dialed into two calls so far without detection. However, rogueFed also called out the meeting organizer by name (the second screenshot, which we are not reposting). Odds are that Cellebrite will be screening meeting attendees more carefully now. We've reached out to Google to inquire about why a custom ROM created by a small non-profit is more resistant to industrial phone hacking than the official Pixel OS."

Cellebrite's tools can extract data from Pixel 6, 7, 8, and 9 phones running stock software in unlocked, AFU, and BFU states. Those tools cannot brute-force passcodes to gain full device control or copy eSIMs. The Pixel 10 series is moving away from physical SIM cards. Pixels running GrapheneOS updated since late 2022 resist Cellebrite: BFU and AFU states remain inaccessible, and as of late 2024 even fully unlocked GrapheneOS devices cannot have their data copied. Unlocked GrapheneOS phones still permit inspection limited to data the user can access. Two calls were dialed into without detection during a briefing, with an attendee identified.

Read at Ars Technica