CVE-2020-14474
📋 TL;DR
CVE-2020-14474 allows attackers to decrypt protected data from Cellebrite UFED physical devices by extracting hardcoded AES keys that are identical across all devices running the same software version. This affects all users of Cellebrite UFED physical devices versions 5.0 through 7.5.0.845 who rely on the device's encryption for data protection.
💻 Affected Systems
- Cellebrite UFED Physical
📦 What is this software?
Ufed Firmware by Cellebrite
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all encrypted data extracted from mobile devices, potentially exposing sensitive law enforcement, corporate, or personal information to unauthorized parties.
Likely Case
Unauthorized access to encrypted mobile device extractions, enabling data theft and privacy violations against investigation targets.
If Mitigated
Limited impact if devices are physically secured and encrypted data is stored separately with additional encryption layers.
🎯 Exploit Status
Exploitation requires access to encrypted files or the device, but the decryption process is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 7.5.0.845
Vendor Advisory: https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt
Restart Required: Yes
Instructions:
1. Contact Cellebrite support for updated software. 2. Install the latest version beyond 7.5.0.845. 3. Restart the UFED device. 4. Re-encrypt any previously extracted data using the updated software.
🔧 Temporary Workarounds
Additional Encryption Layer
allApply strong external encryption to all extracted data files before storage or transfer.
gpg --symmetric --cipher-algo AES256 extracted_data.db
🧯 If You Can't Patch
- Physically secure UFED devices and restrict access to authorized personnel only.
- Store all extracted data in encrypted containers with unique keys separate from UFED encryption.
🔍 How to Verify
Check if Vulnerable:
Check UFED software version via device interface. If version is between 5.0 and 7.5.0.845 inclusive, the device is vulnerable.Check Version:
Check version in UFED device settings or via 'About' section in software interface.Verify Fix Applied:
Verify software version is above 7.5.0.845 and test decryption of newly extracted data with old hardcoded keys (should fail).📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to encrypted extraction files
- Multiple failed decryption attempts followed by successful decryption
Network Indicators:
- Unusual transfers of encrypted .db files from UFED workstations
SIEM Query:
source="ufed_logs" AND (event="decryption_success" OR event="file_access") AND user NOT IN authorized_users🔗 References
- http://packetstormsecurity.com/files/158254/Cellebrite-EPR-Decryption-Hardcoded-AES-Key-Material.html
- http://seclists.org/fulldisclosure/2020/Jun/31
- https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt
- http://packetstormsecurity.com/files/158254/Cellebrite-EPR-Decryption-Hardcoded-AES-Key-Material.html
- http://seclists.org/fulldisclosure/2020/Jun/31
- https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt
