What would the CIA do?

balanga said:
In my case I have an Xiaomi Redmi Note 10 which looks as though it boots up normally but none of the apps work. It receives incoming calls and texts but they can't be read and none of the data can be accessed.

Now if I had some top secret data on this phone which the CIA wanted to access, would they simply accept that it is not accessible or would they find some way to retrieve the data.
Click to expand...
CIA probably has easier methods, but I'd dump partitions with EDL if it's a Qualcomm model then go from there (userdata's likely ext4 encrypted)
 
DerTeufel said:
As long as the data is not encrypted, it is possible to solder out the flash storage and read it.
If the device itself is working, you can use ADP to boot another system, this is the same process as installation an alternative operating system.
Click to expand...
Not sure what ADP is, but has anyone successfully used it to boot another system?

How difficult is it to solder out flash storage and then read it?
 
balanga said:
What does any of that mean?
Click to expand...
Qualcomm SoC devices have a USB debugging mode (EDL) that allow low-level flashing and partition management (something like Odin/Hemidall for Samsung)

When a device is booted to EDL mode, on a PC it'll let you do stuff like formatting and dumping partitions. Android partitioning has user data on a userdata partition, and Google certification usually requires it encrypted. userdata's likely formatted ext4 or F2FS.

Theoretically dumping the device's userdata partition to a computer would give the raw disk image of it, and from there that disk image can be viewed or decrypted through usual means.

modem partitions usually aren't encrypted and might have interesting data. It'd be theoretically possible to hide stuff in partitions too (nobody's looking for something like YellowKey on some unmounted partition :cool:)
 
Espionage724 said:
Theoretically dumping the device's userdata partition to a computer would give the raw disk image of it, and from there that disk image can be viewed or decrypted through usual means.
Click to expand...
I don't see any way to dump the userdata partition since none of the apps on the phone can be activated AFAICS.
 
balanga said:
I don't see any way to dump the userdata partition since none of the apps on the phone can be activated AFAICS.
Click to expand...
EDL mode boots before the phone OS (phone apps/activation/bootloader status shouldn't matter)

I haven't tried dumping userdata, but dumped modem partitions (seems same would work with a partition name change)
 
DerTeufel said:
As long as the data is not encrypted, it is possible to solder out the flash storage and read it.
If the device itself is working, you can use ADP to boot another system, this is the same process as installation an alternative operating system.
Click to expand...
If you can identify the chip you can probably just put a clip connector on the back of it without even removing it from the board.
 
Is the playstore working, or can you install apps from apk files? If you can get something like termux installed, you can then run sshd in termux and ssh into the phone from another machine, and try accessing the rest of the filesystem. Termux has some addons that allow you to access hardware features or do things like run a script when the machine boots https://wiki.termux.com/wiki/Addons
I'm assuming playstore doesn't work, but if you can get the apk onto the machine and run it, it should install. The android security police will stop you accessing privileged parts of the system, but you might be able to explore data, for example I can access the whatsapp section of the filesystem from a terminal by ssh'ing into the phone, using this method. Maybe something to try, if it will actually let you get that far, maybe it wont of course.
 
balanga said:
All the icons appear but they don't open.

When I select them I get
Click to expand...
So presumably it thinks booting has never completed, so it's blocking somewhere in the boot process. I wonder if something has got inadvertently deleted and it's trying to run something that isn't there. Em... filesystem corruption? This link talks about using adb to fsck the system partition in android. I'm just guessing now.

 
kent_dorfman766 said:
I have to wonder how long it will be before these new AI datacenters being built in the USA have govt contracts to provide massively parallel computing for the purpose of breaking encryption when asked by uncle Sam.
Click to expand...
This is a good argument.
I wonder what kind of emergency powers they have that we don't know about. Commandeer amazon cores for an hour or two....
Turns out Amazon didin't go down they just had a special request they can't talk about..
 
SirDice said:
BGA is quite common these days. No way you're going to "clip" anything onto that 😁
Click to expand...
They're a pig to desolder too! It can be done of course, if you've got the right tools. But it's getting more difficult to DIY. I dare say an organisation like the CIA has an electronics workshop buried away somewhere that could do that kind of job though. Or they can always send for Louis Rossman. :-)
 
You must log in or register to reply here.
Back
Top