The FSB can restore even deleted data on your phone. How to protect against it

The Russian who returned from emigration told the publication "Kholod" that on the border during the interrogation, the FSB officers were able to unlock his phone and restore all the remote data. North. Realities explains how it is possible and what can be done to protect yourself.

Employees of law enforcement agencies use at least two programs: one belongs to the Israeli company CELLEBRITE , which came up with a portable software system for hacking UFED, the other is the Russian development of Oxygen Soft Crime - Mobile Criminal .

UFED copes with password hacking, Face ID and Touch ID. The advantage of the UFED is in the simplicity of its use, which even a "kettle" can handle it.

CELLEBRITE complexes were officially delivered to Russia until 2021, but supplies ceased under the pressure of the public and human rights activists. True, by that time the special services had already acquired a sufficient number of UFED complexes, and they still receive updates to them.

How often the security forces used UFED, you can judge by the application of the Investigative Committee. In July 2020, the head of the department, Alexander Bastrykin, said that UFED was used 26 thousand times only in 2019.

There are no doubts that the Russian security forces have the latest UFED models, because in criminal cases data on the hacking of the phones that came out after the Cellebrite departure from Russia are constantly appearing in criminal cases, human rights activists surveyed by the editors say.

The Russian program "Mobile foreseen" copes with the same tasks, but, according to experts, is inferior to Israeli in the speed of work. Since 2012, the product has been purchased by both the Investigative Committee and the Ministry of Internal Affairs.

What can be hacking using these programs

Smartphones

Law enforcement officers can bypass the code blocking, Face ID and Touch ID. Make information from the phones on Android, iOS, Blackberry, Windows Phone. Including - remote.

“If the operatives have an open phone, that is, the one that you gave them by saying a password, then getting information from it is not difficult due to the features of the work of flash drives (phone memory). In order to extend their service life, the information from them is not removed at least three stages,” the North Cyber safety expert told the editorial office of anonymity.

First, when removing something by a user or program, it does not matter if you delete a message or the entire program, the operating system will only marry the necessary sectors "free after removal".

New information is recorded on free memory sectors, and there can be many. Only then the information will be recorded on the sectors that are freed after the removal of the information. So, in fact, until the SSD is overflowing again, you can’t be sure that all sectors that were free after removal are re -registered.

“Therefore, it is not difficult to restore the information even by civil utilities, and even more specially configured cybercriminal programs,” the expert says.

Cloud services

Programs allow you to receive information from cloud services - Google, Apple, Yandex, Microsoft, Samsung and WhatsApp. Employees will be able to authorize in your account and even bypass two -factor authentication.

Messengers

Programs can extract information from Apple, Google, Yandex, ICloud, WhatsApp, Viber and Telegram and others. Programs can also extract and decrypt backups.

Personal computers

In the case of the PC, letters and contacts from the postal agents Mozilla Thunderbird, Microsoft Outlook, Microsoft Mail, Browsers Google Chrome, Mozilla Firefox, Opera, Microsoft Edge, Internet Explorer.

The programs also collect all calls and messages from all devices, including from instant messengers, combine contacts on individual settings, and can explore communications between several devices.

How to protect yourself?

The only reliable way if you go to Russia is not to take with you devices that have sensitive information. Removing all information from the phone, resetting it to factory settings will not help, because in their memory the data is stored much longer than the user can imagine.

Theoretically, according to experts surveyed, paid data deletion programs can help, but they greatly reduce the life of the devices. It is important to take into account that often among such programs, fakes may come across, so it is more reliable to have two devices and distinguish between them streams of information. For example, only with one to correspond with relatives and friends, without discussing sensitive topics, but from the other to subscribe to political publics and watch a video in Yetube.

If you live in Russia, then the recommendations are similar, only the second device should be stored in an inaccessible place for security forces if you suspect that you can come to you with a search.