Cellebrite, a digital forensics firm from Israel, is acquiring Corellium, a mobile testing startup, for US$170 million.

Corellium provides cloud-based virtual Android and iOS devices for app and security testing.

Cellebrite said the deal will boost its ability to detect mobile vulnerabilities.

The deal includes US$20 million in equity to be issued at closing.

It still needs approval from the US Committee on Foreign Investment due to national security concerns.

🔗 Source: TechCrunch

🧠 Food for thought

1️⃣ Mobile security consolidation highlights ethical tensions in digital forensics

Cellebrite’s $170 million acquisition of Corellium represents a significant consolidation in the mobile security testing industry, bringing together two companies with controversial histories 1.

Corellium, while positioning itself as a tool for legitimate security research, has faced scrutiny for its past interactions with government spyware makers including NSO Group and DarkMatter, according to leaked documents from Apple’s lawsuit against the company 2.

The acquisition strategically enhances Cellebrite’s capabilities in vulnerability research, a critical component for its digital forensics business that serves law enforcement and intelligence agencies seeking to access locked or encrypted devices 1.

This merger highlights the dual-use nature of mobile security tools: the same technology that helps identify vulnerabilities for legitimate security improvements can potentially be leveraged for surveillance or exploiting security gaps in consumer devices.

The integration of Corellium’s virtualization technology, which allows researchers to create virtual replicas of mobile devices for testing, will likely accelerate Cellebrite’s ability to discover and utilize new mobile vulnerabilities across both public and private sectors 1.

2️⃣ National security concerns drive increased scrutiny of cybersecurity acquisitions

The Cellebrite-Corellium deal must clear review by the Committee on Foreign Investment in the United States (CFIUS), highlighting how mobile security technologies are increasingly viewed through a national security lens 1.

This regulatory hurdle reflects growing government concerns about foreign ownership of technology that could potentially be used to exploit vulnerabilities in critical infrastructure or communications systems 3.