Slashdot Mirror
RIM Agrees To Hand Over Its Encryption Keys To India
An anonymous reader writes "BlackBerry maker Research in Motion's (RIM) four-year standoff with the Indian government over providing encryption keys for its secure corporate emails and popular messenger services is finally set to end. RIM recently demonstrated a solution that can intercept messages and emails exchanged between BlackBerry handsets, and make these encrypted communications available in a readable format to Indian security agencies. An amicable solution over the monitoring issue is important for the Canadian smartphone maker since India is one of the few bright spots for the company that has been battling falling sales in its primary markets of the US and Europe. In India, RIM has tripled its customer base close to 5 million over the last two years,"
Part of the appeal of RIM was that you knew governments weren't out there stealing secrets sent across your network. I understand that India has a legitimate security need to be able to wiretap communications and so on. But this isn't going to 'help' RIM. This takes away the only major competitive advantage they had, which was that using RIM meant you knew no one in the indian government was going to steal your work and sell it to someone else (which is a serious concern in india).
If anything, this just levels the playing field. And that's bad for RIM, because they aren't competitive.
... to a democratically elected government...
According to this article in The Register: http://tinyurl.com/d2zllzk - they don't have the keys to hand over
give it a few days and someone will do it for them.
Please, the BES keys have not been handed over... because they can't be...
http://crackberry.com/rim-encryption-keys
BIS != BES.
Mark
Moral of the story: If you do not control end-to-end encryption yourself, it is not secure.
Go green: turn off your refrigerator.
"RIM recently demonstrated a solution developed by a firm called Verint that can intercept messages and emails exchanged between BlackBerry handsets, and make these encrypted communications available in a readable format to Indian security agencies..."
And it is probably also worth pointing out that this means that RIM's BIS service provides better content protection than SMS/MMS, unencrypted email (which is virtually all e-mail, and indeed all Android phones using the inbuilt GMail app), and almost any IM out there. I've also missed other equally unprotected means of communication.
Why? Because at least BIS is encrypted in transit to and from RIM. (To be fair, services like MSN Messenger in which all messages go through a central server could be considered more secure than BIS communications, as long as both clients are connecting to the server via SSL).
Hell, even BB PIN-to-PIN messaging is more secure than many or most of the aforementioned modes of communication.Yes, the key used for encryption is present on each and every handset - but random MITM sniffer can't get the content without at least having to decrypt it.
Sure, an Android user could get TextSecure for encrypted SMS, but does anyone actually know anyone who USES this tool?
Half the country has been unable to recharge their Blackberries for two days in a row anyway.
It seems to me VPN or IMAP over SSL has all the advantages of BB without the risk they'll sell you out. And has for some time.
Encryption is crackable
True, encryption _CAN_ be cracked, by hook or by crook
If it's USA, with its seemingly unlimited resources (NSA and the like always get a blank check from the congress for whatever black programs they initiate), I would agree with you.
But you almost forgot one thing, this is INDIA we are talking about - a nation which nearly 30% of its population still living below one dollar a day level
Muchas Gracias, Señor Edward Snowden !
I think we need to make clearer what exactly the impact of this is.
Does an Indian businessman who bought a Blackberry in SouthAmerica and is working in Europe be assured on some level of privacy on communications?
Does an American businessman with a Blackberry bought in the USA visiting India on the way to China need to rethink how company documents are transmitted?
Not very clear, especially as the BIS keys can't and therefore haven't been handed over.
So we have a new server in India, but what is being routed through it?
A blog I run for the wealth
from the fine article:
"But he said there was no access to secure encrypted BlackBerry enterprise communications or corporate emails as these were accessible only to the owners of these services."
The reality is BES uses keys assigned by the owner of the BES server, RIM HAS NOT and CAN NOT give those to anyone, because they dont know them. This has been RIM's position from the begining, and still is. What they HAVE done is give access to the messaging services they run (and therefor have keys to) to the Indian authorities. My understanding is that this was always the case. The article really does not make the distinction between the two clear.
TLDNR: RIM gave what they always give anyone, some minister is useing it to try and save face. Poor reporting means it worked.
Are you saying that email sent via the Android GMail app isn't encrypted between the device and Google's servers? I can't believe that would be the case, since they made a big deal about forcing people onto SSL for web access to GMail quite a while ago.
Are you saying you trust your smart phone to have only real, valid intermediate ssl certificates? Or are you so ignorant to think that governments aren't trying to man-in-the-middle SSL like crazy, especially on mobile networks.
They don't need MITM; they have the CA private keys.
I have noticed that news-reaction stock market swings are more responsive to the general public's perception of a news item than they are to the opinions of technical people who may, or may not, have a better grasp of the future business implications of a piece of news.
In other words, betting opposite of the sentiment you read on /. is likely to bring you better than average returns.
I hope you arent in a position where you advise anyone on IT.
Active Sync's security is in LARGE part dependent on the security of SSL. For a HUGE number of organizations, those SSL keys are self-signed, which provides about the same security of WEP. All that is needed to break in is to somehow get the device to reach out to your server, and then have your server present a similar self-signed cert. Even if you are using a "proper" cert, you can be "easily" bugged by a government, since a large number of governments are considered trusted root authorities (including China); this means they can generate their own certificate, claim to be your Exchange CAS, and your device will happily talk back and forth with it. Presumably at that point your device would authenticate to that rogue server; Im not clear in what form the credentials would be sent, but we're already into "danger" territory.
On the flip side, with a proper BES (which is NOT what is being discussed in TFA), SSL simply isnt in the loop. All communications are relayed through RIM, but the encryption keys (up to AES-256) are held completely internally. I believe (though I could be wrong) that each device has its own key which is derived from the master key, so under the absolute worst conditions someone could sieze a blackberry and -- shockingly-- have access to that user's email. But of course, they'd have to get around the in-memory encryption and flash encryption that a security-sensitive organization would obviously have enforced on their blackberries.
At the end of the day, if absolute security is a necessity, you probably dont want your employees running around with smartphones, but if you do, youre using Blackberry / BES because there STILL isnt a good competitor in that range. Plus, if we're completely honest, most androids are touchscreen, and touchscreen devices simply arent as good at fulfilling the role of business communication device. They have other perks, but from personal experience I can say that they are a massive letdown when it comes to email and phone.
PS, if you think IMAP is a serious competitor to what a BES does, you are even more in the dark than I originally thought.
Once again. For the last time....
RIM does NOT have the encryption keys used by BES servers. Those keys are held internally by businesses only, and those are then used (along with "random" data) to generate the device keys. Even if RIM somehow had the organization's master key, they wouldnt have access to the "random" data that was used to derive the device key (which is pulled from that "wiggle your mouse around for a while" procedure).
In other words, BES servers continue as unaffected as before. Call me when India figures out how to large-scale crack AES256 with unknown keys.
Should read "India claims RIM gave encryption keys, RIM strongly denies". http://www.theregister.co.uk/2012/08/02/rim_keys_india/
Tomorrow is another day...
Sure, BES has that advantage. GP was responding to "unencrypted email (which is virtually all e-mail, and indeed all Android phones using the inbuilt GMail app), and almost any IM out there. I've also missed other equally unprotected means of communication. Why? Because at least BIS is encrypted in transit to and from RIM"
i.e. he was refuting the statement that Android phones send email unencrypted. This isn't true. Email is encrypted on the route to Google's servers. What happens from there is dependent on the eventual destination. This is the same standard that BIS meets, right?
"Although not all of a BlackBerry's messaging functions are encrypted, RIM has long maintained that it is unable to grant anyone access to its corporate e-mail service, which is encrypted from end-to-end. RIM responded in a statement late on Wednesday, saying it was necessary "to correct some false and misleading" information" that had appeared in the Indian media."
"RIM is providing an appropriate lawful access solution that enables India's telecom operators to be legally compliant with respect to their BlackBerry consumer traffic, to the same degree as other smartphone providers in India, but this does not extend to secure BlackBerry enterprise communications," the company added."
It seems to me VPN or IMAP over SSL has all the advantages of BB without the risk they'll sell you out. And has for some time.
yeah, I was pointing this out to clients as early as 2004. I had a working IMAPS client on a Treo 650 at the time. They wanted Outlook integration over security (despite always talking about their multi-billion-dollar IP that had to be protected at all costs). Lesson learned: most people don't care about security, they just say they do.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Setting up a private CA and removing default CAs != self-signed cert. SSL can be set up securely.
Won't matter once CALEA is amended to include non-voice public networks. It'll happen eventually.
This isn't to say I support the extension; I think those proposing it should be shot. That doesn't change the reality that it will eventually be enacted, whether it requires sneaking it into a broad authorization bill or actually getting the support to pass it on its own.
There goes the customers to some other solution that can't be eavesdropped.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Lesson learned: most people don't care about security, they just say they do.
Just like when a woman says she wants a "nice guy", then dates ten douches in a row that abuse the fuck out of her, all the while her bitching about the douches to a nice guy who she coincidentally isn't at all interested in.
Moral of the story: Corporations are full of the crazy!
(Apologies in advance to my opposite gender. Just got a call while reading this article from just such a person whom (I thought) I got over a decade ago... Clearly I was mistaken) :/
Are you saying that email sent via the Android GMail app isn't encrypted between the device and Google's servers?
No, I'm not saying that GMail for Android (or via a browser, or iPhone) doesn't use SSL. However, GMail is an e-mail service using a client (on Android) which doesn't have support for encryption apart from SSL to the server. Sure, if I'm sending GMail to GMail that's fine - it falls into the same boat as MSN Messenger. If I'm sending to a non-GMail recipient, then that goes out the window.
There are other apps which can use GMail, and do provide encryption functionality, but as with TextSecure - how common is their use (with encryption)?
I wouldn't even trust my uncles and cousins who work in pharmaceuticals oversight. In india.
And yes, china is far worse because the theft is state sponsored. India it's not state sponsored, it's more at the level of corporate espionage, and there's bugger all you can do about it.
Which is why its a good thing that BES doesnt use SSL certs.
I understand that India has a legitimate security need to be able to wiretap communications and so on..
Nope. This is a landgrab. Law enforcement is constantly talking about "going dark", where in fact, the light they have is much brighter than they've ever had before -- technology only made it possible to snoop on everything, and now they want the laws for actually doing so, and to lever out any countermeasures the user may take.
In the 80ies, wiretapping actually meant either a) placing a wiretap in the users phone or b) going physically to the phone switch where the user was connected to, and placing the tap there. Both only done with a judical warrant, and for very specific cases. Wiretapping was _complicated_.
Now, wholesale wiretapping is easy; so easy that a lot of people and companies take countermeasures. And now law enforcement wants "to have back" capabilities it never had?
"The more prohibitions there are, The poorer the people will be" -- Lao Tse
Comment removed based on user account deletion
Use GPG, no one has the private keys except for me and the remote party.
GPG with K-9 on my android works just fine.
What you are describing is BIS. With B_E_S-- Blackberry Enterprise Server-- you run the server that is ultimately the endpoint for the blackberries. When you install the software, it creates its master encryption key; when you tie new devices into it, it uses that key to derive a per-device encryption key.
All data is sent thru RIM, yes-- but only after it has been encrypted by YOUR server with a key that RIM never gets a hold of. There isnt any question of RIM's goodwill here, but of their inability to crack 3DES or AES (depending on your settings), and their lack of knowledge of your keys. All RIM is doing is providing the transport, as you said-- they are not involved in the encryption process at all.
If you are asserting that you think that key gets leaked, be prepared to give some proof.