Slashdot Mirror
BlackBerry's Encryption Hacked; Backups Now a Risk
GMGruman writes "InfoWorld blogger Martin Heller reveals that a Russian passcode-breaker developer has broken the encryption used in BlackBerry backups. That can help recover data when passwords are lost, but also gives data thieves access to a treasure trove of corporate secrets. And the developer boasts that it was easier to crack the BlackBerry encryption than it was to crack Apple's iOS."
"Told ya' so" moment occurring within RIM right now.
Notice how the blackberry adds have shifted from being about business apps and security to how cool it is that you can edit a MP3 playlist.
Whole thing smacks of desperation.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Back up to a non-encrypted IPD file and put it into a TrueCrypt volume--or better yet, don't back up to an insecure machine! This story would have been much more newsworthy if they had broken the actual phone's encryption, AES and elliptic curve D-H.
"Politicians and diapers must be changed often, and for the same reason."
What was the code? 1, 2, 3, 4, 5?
was the encryption scheme weaker, or were disgruntled RIM employees more willing to hand over the keys than disgruntled apple employees?
Solution - no more backups!
Did you mean to say "backups at risk"?
Does this solve that encryption complaint the UAE, Saudis and others had about Blackberry?
Home of The Suki Series
If only the article had the above information on page 2, you'd have the answer to your question. If only.
no since, only the backups encryption is broken, and it still takes 3 days to crack a 7 mixed case password
Jehovah be praised, Oracle was not selected
The encryption itself is just fine (at least, for now). While it's interesting that the data is transmitted in the clear and then encrypted by the backup software, they don't propose exploiting this (which would be an inconvenient attack).
This is simply a brute-force password cracker that's specific to BlackBerry backups. It's not particularly specific, either, as the backups are encrypted with AES and the key is derived from a password using the standard PBKDF2. There are tons of PBKDF2-crackers out there (like coWPAtty). The surprising thing is that they only use single-iteration PBKDF2, which is a joke.
This, incidentally, is what is meant by the statement in TFS that cracking BlackBerry backup passwords is easier than cracking iOS passwords. Difficulty in password cracking (amount of computational time per password) for PBKDF2 is roughly proportional to the number of iterations. IIRC, WPA uses 4096, Apple's FileVault uses 1000, and BlackBerry backups apparently use 1.
So, if I read the article correctly, it hasn't been hacked so much as improperly implemented on blackberry's part. Honestly, the title made me think AES had been cracked which... yeah, that would be bad.
RIM headquarters.
This "weakness" seems a little silly.
You typically make your backups on your office desktop PC, and leave them there. But all the sensitive data in the backup file was already there on that same PC, in your corporate mailbox, completely unencrypted.
Cracking a Blackberry backup file would be the hardest way to get access to that data.
I just finished entering my March 2011 Short on this stock. I'm not sure if I should buy a Ferrari or a Masserati with the profits.
Maybe you guys can help me decide?
The NSA announced today that they are offering secured online backup for all Blackberry users. RIMM responded saying they were surprised how quickly the DNS poison spread but wish the NSA well in their user friendly backup service. Many Middle East governments are also now offering the easy secure backup service as well.
Soooo, the spat between UAE, Saudi, India and Blackberry is now moot...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
...it's just full of 200 fart apps anyway.
"I hope you know how very lucky you are to know me, because I am so incredibly incredible."
I can't believe anyone uses crackberries. We used them for a year and everyone has hated them. We bought Droid Incredibles for our office and love them so far. The only thing keeping blackberries around I would guess is the ability to lock them down with the BES server I believe its called. But they still suck....
Down with Blackberry, Windows Mobile, etc hale to iOS and Android!!
Gives new meaning to the term "Crackberry"
Why not just use the encryption based on gpg or some other existing open source encryption method? Anytime you give a bunch of programmers a chance to reinvent the wheel, you need to go through the exact same evolutionary process that the existing wheels went through. So why is it that companies keep doing so and ending up shooting themselves in the foot?
boycott slashdot February 10th - 17th check out: altSlashdot.org
instead of calling them backups shouldnt they be called BLACKUPS?
they say it is often more relevant then the comment above, all we know is its called the Sig!
How long after the code was given to the Indian government that now it is in the wild with all sorts of hacks,
atleast we know who we can point the finger at, and hopefully learn from this, that in future when they ask for code,
just say "NO, dat is not vedy vedy nise!"
In Soviet Russia, passcodes break YOU.
This is one of the biggest things people forget about with data security and one my professors at school were constantly mindful of. Sure, 2048 bit keys and most modern cryptography is secure right now; but if you have really sensitive data - data about banking accounts, transaction records that your business depends on keeping secret for competitive reasons, voting records, etc - you need that to remain secure for the life-time of the person - or even longer. This is MUCH harder - especially if the advent of quantum computer decryption around the corner. What if all your bank transactions and records for this point up till now became as easily readable as a zip file? What if you live in a country that when the regime changes, those associated with the old regime get 'purged'? Your records are your life in such situations.
Remember, people can be storing up all those encrypted transactions you're sending around - and when the machines are fast enough - unencrypt them years or even decades later to reveal everything you said, did, bought/sold/voted on/etc during those times. This is a perfect example of why you need to take into the account the *lifetime* sensitivity of the data your encrypting, or you could easily face serious consequences.
Remote Application Deployment from BES
Application Policies
Applications can be installed from PCs or BES, not just The Apps Steve Likes
They sell an integrated keyboard, or a narrow-factor phone, not just The Touchscreen Steve Likes
But then access to a Wintel box is trivial these days, especially with Adobe helping out.
I administer 130 blackberrys and there isn't an IPD file in the entire outfit - that's what BES and its backups are for.
I'm not sure if I should buy a Ferrari or a Masserati with the profits.
Sounds like penis enlargement pills would be a good choice for you.
RIM has been under pressure to open up backdoors for its user data to governments. This is against its official policy and promise. If it does not comply, it risks losing business in foreign markets. Now it can do so more easily because it's already leak^^^^hacked.
So, it takes 3 days to crack the 7 character password. Adding 8 characters to the set (say, !@#$%^&*) would then increase that 3 days to...
2^21 more effort. Or, roughly 3 to 4 million days. Seems from the discussion that elcomsoft was able to brute force quickly (millions of passwords per second).
Add a few more characters and the effort to brute-force the thing goes up... exponentially. Unless, of course, elcomsoft has actually "cracked" the encryption, and not simply reduced the time to try a key.
What I would warn about is my "usual" advice for password generation (optional random character) word (optional random character) word (optional random character), because, as far as I can tell, that can be now be broken by elcomsoft in 2 to 3 days (assuming they know that this is the pattern used, which we have to).
Very curious to see a review of this (before panic sets in).
ratboy666
Just another "Cubible(sic) Joe" 2 17 3061
>Apple devices act differently; the data is encrypted on the device and never leaves it in an unencrypted form. The Apple desktop software (iTunes) acts only as a storage and never encrypts/decrypts backup data.
The article says that but I was under the impression that the iPhone encryption was worthless because it never lets you access data in an encrypted format. What I mean is there was a race condition where you could have an iPhone plugged into a computer and turned off and when you turn the phone on it would allow you to mount the device before it activated the security and the phone would unencrypt the data as it was accessed. Also if you use a jailbreak attack you can dump the phone in its unencrypted format.
Was this patched, or is the article wrong?
Business users identify with luxury goods. There's a crossover point between cool, high tech, trendy and luxury goods that attracts business people. The iPhone is seen as high end, and this naturally draws in business people.
Both the headline and the article are overheated.
The "crack" requires that
More than a bit of a stretch.
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
The last digit of pi is "i".