Slashdot Mirror
Nokia Extorted For Millions Over Stolen Encryption Keys
jppiiroinen writes: At the end of 2007, when Nokia still had huge market share with Symbian devices, they failed to disclose that somebody had stolen their encryption keys and extorted them for millions of Euros. The Finnish National Bureau of Investigation has not been able to figure out who did it. "The blackmailer had gotten hold of the Symbian encryption key used for signing. The code is a few kilobytes in size. Had the key been leaked, Nokia would not have been able to ensure that the phones accept only applications approved by the company."
all good ransom getaways seem to involve motocycles
The money was left in a bag at a parking lot nearby Särkänniemi amusement park. Then things went wrong. The blackmailer took the bag. Police, however, lost track of the blackmailer and the money was gone.
What, no GPS transmitter in the filament of each paper Euro? Amateurs.
Nokia would not have been able to ensure that the phones accept only applications approved by the company.
Sounds more like a feature than a bug. Do device "owners" really want phones that "accept only applications approved by the company".
Keys get compromised, expire, etc. They should have had a process for updating keys, and then it would have cost nothing but a little egg on the face for letting someone steal it.
I don't get why they actually paid people for this. Even if they received the key _back_ the attacker could have still used them.
"nokia would not have been able to ensure that the phones accept only applications approved by the company"
is complete BS, they could not verify that at the point they realized they screwed up key security.
Doesn't anybody else find it odd that the circle of trust includes the persons who stole the keys. After all we all know they would not do something bad like use the keys.
Now GTFO.
Ezekiel 23:20
From a strategic point of view this is a clusterfuck. Why did Nokia put real money in the bag if they were planning to arrest the person that came to pick it up? If the police had succeeded then it wouldn't matter if the money was real. If the blackmailer gets away, then maybe, if you are lucky, he might keep his promise if he thinks you acted in good faith. But now I am reading a story on slashdot about how they tried to catch this guy and botched the plan, so now the blackmailer knows that Nokia was not acting in good faith. Now the blackmailer has no reason not to leak the keys, unless he plans to try to extort more money.
So how do you trust a company? Profit is their primary goal, and if they feel that hiding a breach like this will be more profitable than disclosing it that's exactly what happens... Meanwhile, you now potentially have to also trust some criminals who have already demonstrated their willingness to commit blackmail.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Likely story. The NSA asked and they rolled over, right ? This is just cover.
Blackmailer blackmails blackmailer. More at 11.
"National Security is the chief cause of national insecurity." - Celine's First Law
Whoever decided it was a better idea to pay rather than protecting their customers should be sent to prison... I'm sorry, but they knowingly compromised security for every user.
Damn you just have to feel sorry for Nokia...
I couldn't imagine the pain and suffering must be associated with selling devices and then losing the ability to control what software can be installed on them.
Moriarty Calls every Nokia phone and broadcasts the image of himself laughing.
Pay me, or you don't get to extort your users with your locking scheme! :)
RFID - Read the Fucking Included Document?
So, they didn't include the document so the blackmailers did not know what to do and ended up getting lost?
Ah! I get it!
Symbian had a toggle in the settings to disable signed app requirement.
So does Android. But that doesn't stop carriers from forcing that signature requirement toggle on, just as AT&T did for the first several months that it sold Android phones (Motorola Backflip, HTC Aria, Samsung Galaxy S "Captivate"). And the vast majority of phones sold in the U.S. market during the Symbian era had carrier branding on them.
Do device "owners" really want phones that "accept only applications approved by the company".
Yes.
As BasilBrush and CronoCloud have explained here several times, the majority of people are not geeks and don't want to have to spend time doing their own vetting of safety, usefulness, and battery efficiency of apps. Instead, they choose to delegate this vetting to Nokia, Apple, Microsoft, Sony, Nintendo, etc. I've summarized the purported advantages of closed platforms.
The Slashdot user's ideas of free software come from a RMS.
Where you see "freedom" in arguments for free software, read "flexibility". The iPhone is less flexible in some ways than some other platforms. For example, there's no app for helping contribute to an access point database because Apple refuses to make the needed APIs public.
People give a care when they find that they'll never be able to get an app for a particular task on their phone or tablet. Where's WiFi-Where for iOS? Where's a web browser for iOS capable of viewing a WebGL visualization of the brain? And where's a web browser that supports uploading documents created in an app, other than pictures and videos, to a web form?
The email address I used for a dev account there gets spammed a lot and I never used it anywhere else!
since nobody wrote or used symbian in the android era anyways.
Crypto keys stored on a Linux server??? Just asking.
They should have let it free, so people could hack the device.
And why not using key revocation?
My guess:
They assumed or knew there were more than one person. They put real money in the bag to pass any kind of quick check of the money. Police lost the person picking up the money because they were trying too much to stay hidden. This might have taken days of following the person to see who he meets. Maybe they wanted all of the blackmailers. Other option is Nokia wanted to let the blackmailers go, and didn't give all info to the police. This could happen if they first contacted the police, but then got second thoughts about if it's a good thing to catch the blackmailers and possibly face the renvenge of leaked keys.
For those who don't understand the reference, the Keystone Cops were incompetent policemen in a series of American silent movies. I read the article linked to in the article and basically Nokia dropped the money off in a paper bag in a parking lot and the police watched the pickup and then completely lost the blackmailer. To this day they have no idea at all who got the money and it seems that Nokia has only the word of the blackmailer that they wouldn't use the keys for nefarious purposes.
"Had the key been leaked, Nokia would not have been able to ensure that the phones accept only applications approved by the company."
Um... tiny little problem there. Your extortionist already HAD the keys. It's not like they can "un-have" them.
We promise we'll delete them after you give us the money.