<story><title>Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer</title><url>https://signal.org/blog/cellebrite-vulnerabilities/</url></story><parent_chain><item><author>tGr5lGf7</author><text>Cellebrite doesn&amp;#x27;t even have a bug bounty programme or contact to report their bugs.&lt;p&gt;Last year I&amp;#x27;ve managed to gain partial access to one of their systems and it took me weeks emailing their internal email addresses to finally fix the bug. They were total ass about it.&lt;p&gt;Now I&amp;#x27;ve got complete access to their entire database and I don&amp;#x27;t know what do. Can HN advise?</text></item></parent_chain><comment><author>vorpalhex</author><text>Well definitely don&amp;#x27;t share it with DDOS secrets, news outlets or any other major company that would potentially report on it. That would be very bad press for Cellebrite, and if they connected it to you they could be very annoying - though again, they would need pretty good evidence connecting it to you and things like TOR and proper privacy practices would make that very difficult. So definitely don&amp;#x27;t do that, or use something like tails to post it to multiple SecureDrop outlets.</text></comment>
<story><title>Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer</title><url>https://signal.org/blog/cellebrite-vulnerabilities/</url></story><parent_chain><item><author>tGr5lGf7</author><text>Cellebrite doesn&amp;#x27;t even have a bug bounty programme or contact to report their bugs.&lt;p&gt;Last year I&amp;#x27;ve managed to gain partial access to one of their systems and it took me weeks emailing their internal email addresses to finally fix the bug. They were total ass about it.&lt;p&gt;Now I&amp;#x27;ve got complete access to their entire database and I don&amp;#x27;t know what do. Can HN advise?</text></item></parent_chain><comment><author>sneak</author><text>This definitely isn&amp;#x27;t a trap.</text></comment>