[Drip33]

My powered on phone was 0day'd by Cellibrite according to internal Law Enforcement emails in disclosure and my powered down phone was not supported at all.

Edit: The cracked phone has been in my possession for a while now and I've only powered it on twice for mere minutes since getting it back if there are any phone experts around that want to investigate.

[defen]

Mind sharing the phone make/model and when this happened?

[Drip33]

Galaxy S7 - online and cracked, Galaxy S4 - offline and not cracked ~2017-2019

[abstractbarista]

Seems to be a common thread - if you want your phone to remain secure, it must be powered off before seizure. This way, there is no encryption key in RAM. As long as the key is sufficiently strong (random passphrase, not a 4-digit PIN), you have a reasonable guarantee that they will fail to crack it.

[m463]

What about the iphone POWER+VOLDOWN thing that flushes the biometric keys and requires the pin?

[chenxiaolong]

Looking at the iOS platform security document ([0] page 68), apps use NSFileProtectionCompleteUntilFirstUserAuthentication by default, which keeps keys in memory after the first unlock, regardless of the Power + Volume Down lock. If an app opts into NSFileProtectionComplete, I believe the keys are purged from memory upon locking.

[0] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

[angry_octet]

More obscure phones might not have support, but that doesn't mean they can't be opened with more effort.

When off, you're relying on the strength of the FDE passphrase and whatever key strengthening they implemented, and that the OS didn't leave some key fragments somewhere (accidentally on flash, which would be very bad, or remanent in memory if it has only been off for a short period).

Using a long alphanumeric (>12 random, >20 passphrase), not installing random apps, keeping it patched and keeping it powered down is probably the best you can do. I wouldn't use the baseband comms if I could avoid it, just a huge 4G attack surface.

[Forbo]

Android has a 16 character limit for your password. Or at least it did as of Android 10, not sure if that's changed.

[marcan_42]

If you root your phone, you can set your FDE passphrase to whatever you want while keeping a usable shorter unlock code. My phone's FDE passphrase is 26 characters long.

[ActorNightly]

Even better, if you have a reasonable worry about losing control of your phone with data that is on there, you should just get a second one that contains nothing sensitive or personally identifiable, uses wifi only, no sim.

This is even good practice if you go to public places where you can get your phone stolen.

[bigiain]

What sort of complexity was the S7's passcode? 4 digit pin? more than 4 digits? short password? longer passphrase?

Also, which Android versions? Stock Samsung or an alternative rom? (My S6Edge is "stuck" on Android 7 without replacing the OS with a non Samsung alternative. My S4 is running a much newer Lineage Android version...)

[Drip33]

?l?d mask with I think 9 characters using default Android OS with updates. Both phones I think were minimum Android 5.0+ because that is when they switched to Scrypt to store password/encryption keys.

[bigiain]

Thanks.

[zionic]

What phone models?