Slashdot Mirror
Russian Software Company Says Its App Can Crack BlackBerry Security
AZA43 leaps into the ranks of accepted submitters, writing "Russian security software vendor Elcomsoft has released an app that it claims can determine BlackBerry handheld passwords. The software supposedly hacks the BlackBerry password via an advanced handheld security setting that's meant to encrypt data stored on a user's memory card. And a hacker doesn't even need to have the BlackBerry to determine a password, just the media card."
...software cracks YOU!
It seems like the only time I read about anything Russians do with computer tech, it involves botnets, stealing passwords, and ripping off peoples bank accounts. Are there any Russians that contribute something positive to the world of software?
If you actually read this one you'll realize it's useless if the card isn't encrypted (ironically) or the user chose one of the other 3 options. Plus this option is designed to be less secure so you can put the card in another device and decrypt it with just a password. I also wonder what character set is included in their claim of cracking a 7 character password in just hours. http://xkcd.com/936/
They're brute forcing it
news at 11...big freaking deal...
You act like this is either unimportant or not news. I'm not sure which.
Fact is while there's a lot of FUD floating around regarding things like RIM "caving in" and dropping BIS servers in questionable countries, there haven't actually been very many actual real-life exploits for the phones or their communications. Blackberry phone remains the only ones on the market that encrypt all data traffic by default and that encryption can't be disabled. If you're on BIS or if you're on BES, your unencrypted web traffic, e-mail traffic (even POP3) is encrypted at the device. That's still worlds ahead of the other devices.
There's reports that one exploit exists that can decrypt Password Keeper data from a phone backup on a PC. There's this report that discusses recovery of phone unlock passwords. There's the widely discussed and misunderstood reports about RIM dropping BIS MDS servers in unfriendly countries and what that allows (hint: it has zero to do with Blackberries not in those countries).
RIM's stuff is by and large still very, very secure by any comparison and their phones are unique in that regard. So the way I see it, this is both news (being a genuine security hack) and relevant (these phones being the best on the market).
So stuff your ignorant sarcasm.
"Oh no... he found the
Russians are good at cracking software. It is a puzzle that they are so bad at creating it.
an ill wind that blows no good
The password is not stored in any form, of course. But if there's encrypted data on the card, and that data can be decrypted using only the password, then you can just try every possible password until you find one that doesn't result in gibberish. This is called a known-plaintext attack.
Kaspersky?
Talk about getting pwned.
Boot Windows, Linux, and ESX over the network for free.
Very well said. Though, I really hope this gets addressed, because I don't feel comfortable with having to make a choice between potentially exposing my device password or contents of my SD card..
Bow before me, for I am root.
In other news "Other Russians Say They Cracked BlackBerry Years Ago" but kept mum about, for "financial and business reasons". ;)
Dunno. Here in South Africa, everybody has a BB. In an average week I probably see 3 people posting their new BBM number on facebook. Just because the US all went iPhone doesn't mean the rest of the world particularly agrees.
Help I am stuck in a signature factory!
Pure speculation here:
Since this only works with media encryption enabled, I'm guessing this is an alternative cipher attack. They can't directly obtain the Blackberry device password, but they can break the media encryption (perhaps because it is a much weaker cipher). The media encryption key is likely the same as or derived from the device password, allowing an expedited attack on that.
Moral of the story: If you derive a key for a weak cipher from a key used for a strong one, make sure you use an irreversible function to do so.
would you even care?
Yes.
just trying to inform the likes of ya.
Inform away. So far you've got zero information content in either of your posts. Mine summarizes the known exploits and security topics. Yours don't. Feel free to drop the newsburger edgestuff at 11 nonsense and communicate with us. Drop down to the lesser language of English and educate me.
"Oh no... he found the
Pics. Or it didn't happen.
Slapping your epenis around with ol Psycho isn't terribly entertaining. You know something? Tell us.
Faster! Faster! Faster would be better!
RIM stuff is largely security by obscurity at this point however, very few people have seemingly tried to pull their stuff apart, and the few that have didn't find good things, see the pwn2own contest from this year for one such example.
Android, iphone and even windows mobile devices are much easier to target because they are largely based on existing systems which are well understood... RIM are using a totally obscure black box that requires significant investment of time to reverse engineer. This doesn't mean it's secure, it just means that hackers will need to spend more time to find holes in it. On the other hand, it means that whitehats will also require more time to reverse engineer the system, whereas its highly possible that blackhats have already stolen the sourcecode.
Most devices provide the option to run a VPN between the handset and a server under your control, only RIM require that there be a server under their control sitting in between.
Most devices (RIM included) can also boot up and start talking to the network without requiring any user input, therefore the keys used for this encryption must be stored on the device somewhere, just waiting for someone appropriately skilled and motivated to work out how to extract them...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
http://en.wikipedia.org/wiki/Sergey_Brin
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
if Putin crossed paths with Chuck Norris
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Let's try not posting this as an Anonymous Coward by mistake.
This is the same company that employed Dmitry Skylarov, one of the first people to be arrested under the DMCA for breaking the encryption on Adobe's eBook format.
http://en.wikipedia.org/wiki/Dmitry_Sklyarov
Karma: Positive. Mostly effected by cowbell.
RIM's stuff is by and large still very, very secure by any comparison and their phones are unique in that regard. So the way I see it, this is both news (being a genuine security hack) and relevant (these phones being the best on the market).
This seems to be misunderstood as either a crack or a break in the security of the BB. It is neither. Elcomsoft is using a crib that they have found to attempt dictionary and/or brute force attacks, nothing more. See this blog post for the specific details about the file they are using. Unless there is something else that they haven't mentioned, this is a garden variety known plaintext attack.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
This is simply brute-forcing the password, relying on a short user password. It is only viable if the user has set up the phone security options in a weak way: selected to encrypt media card with user password only, rather than user password plus device key. So really there is nothing surprising in this attack. If you want good security on a Blackberry, it's a matter of setting it up in the options.
"Politicians and diapers must be changed often, and for the same reason."
fuck rule 10, i'm more interested in rule 34. where's the porn of these security vulnerabilities?
insensitive clod overlords obligatory xkcd car analogy russian reversals whoosh pedant fanbois ftfy in 3...2...1..PROFIT