Hello everyone,
I’m writing this post because I’ve been interested in Samsung devices for a long time. I’ve spent many hours looking into the topic, reading endless tech articles, product sheets, and whitepapers. At its core, the issue is that Samsung has been vulnerable to Cellebrite for years, while other manufacturers like Apple and Google are actively addressing this problem and introducing countermeasures. These measures are not perfect solutions, but they are showing results.
If we look at Cellebrite’s support matrix, we see that with Samsung devices, Cellebrite has every possible way to exploit them. It doesn’t even matter if the device is in AFU (After First Unlock) or BFU (Before First Unlock) mode. In BFU mode, Cellebrite can simply brute-force the PIN code. In AFU mode, this isn’t even necessary—Cellebrite can just bypass the lock screen using zero-day exploits.
What I found particularly shocking is that Cellebrite can brute-force Samsung devices in BFU mode, even with new models released just a few months ago. This means that Samsung practically offers no protection against these attacks. Samsung itself advertises “Knox Vault,” a secure element that is supposed to ensure all cryptographic operations are handled in a separate chip. Secure elements do work effectively—in Google’s Pixel devices, for example, we see that Cellebrite has no way of brute-forcing a Pixel 6 or newer. The same effect can be observed with Apple devices. But Samsung continues to remain vulnerable, despite having a secure element that should actually help prevent such attacks.
But that’s not my only criticism of Samsung regarding security. I also find it extremely concerning that security updates often take weeks or even months to reach end users, even when they address critical vulnerabilities. On top of that, the sheer amount of bloatware on Samsung devices is a nightmare—many preinstalled apps that nobody really needs, which only add more attack surface.
I don’t see any progress from Samsung in addressing these problems, even though there have already been many critical media reports about how forensic tools like Cellebrite have been misused to violate human rights. Overall, I think it’s a real shame that there has been no development in this area for years.
I’m curious—what’s your opinion on this? How do you see it? Feel free to comment, I’m looking forward to discussion and feedback!
Glossary of Key Technical Terms
-
Cellebrite: A company that develops digital forensic tools used by law enforcement to extract data from smartphones, often exploiting vulnerabilities in device security.
-
AFU (After First Unlock): A device state after it has been unlocked at least once since boot. Some data is more accessible in this mode.
-
BFU (Before First Unlock): A device state before it has ever been unlocked after boot. Normally, strong security prevents access here, but brute-force attacks are sometimes possible.
-
Brute-forcing: A method of trying every possible password or PIN combination until the correct one is found.
-
Zero-day exploit: A previously unknown software vulnerability that attackers can exploit before the vendor has issued a fix.
-
Secure Element: A separate, tamper-resistant chip designed to handle sensitive operations like cryptographic key storage, improving overall security.
-
Knox Vault: Samsung’s implementation of a secure element, advertised as a defense against attacks on sensitive data.
-
Cryptographic operations: Processes involving encryption, decryption, or digital signatures that secure communication and stored data.
-
Attack surface: The total set of ways a system can be attacked, which increases with unnecessary software or services (e.g., bloatware).
-
Bloatware: Preinstalled apps on devices that are often unnecessary, take up storage, and can introduce additional security risks.