5 ms·
Canadian Police Obtained BlackBerry’s Global Decryption Key
- ghshephard 11y agoThis story doesn't make any sense at all. Surely Blackberry isn't stupid enough to use a "single encryption/decryption key" for all their messages.
- jlgaddis 11y agoThe linked article on Motherboard [0] expands on this a little bit: > BlackBerry (formerly RIM) encrypts all messages sent between consumer phones, known as PIN-to-PIN or BBM messages, using a single “global encryption key” that’s loaded onto every handset during manufacturing. With this one key, any and all messages sent between consumer BlackBerry phones can be decrypted and read. In contrast, Business Enterprise Servers allow corporations to use their own encryption key, which not even BlackBerry can access. [0]: http://motherboard.vice.com/read/rcmp-blackberry-project-clemenza-global-encryption-key-canada http://motherboard.vice.com/read/rcmp-blackberry-project-cle...
- ghshephard 11y agoRight - that's the part that I have a really hard time believing. Even having a single decryption key per device seems insane - isn't it pretty standard practice to frequently rotate your session key? I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It really sounds terribly insecure to me.
- coldcode 11y agoHow are these people still in business?
- mschuster91 11y ago> I'm wondering if this was something that Blackberry was doing back in the early 90s, and, as the state of the art advanced, they never upgraded their systems. It's called backwards compatibility... though that's not really an excuse.
- misnome 11y agoCouldn't the message could have the "real" encryption key encrypted with the private blackberry key, thus allowing them to access it if required?
- neerdowell 11y agoBBM's security paper: https://help.blackberry.com/en/bbm-security/latest/bbm-security-pdf/BBM-Security_Note-1336480397548-en.pdf https://help.blackberry.com/en/bbm-security/latest/bbm-secur... [PDF] Check out the bottom of page 7, and the diagrams on page 8.
- bmh_ca 11y agoThis is the company that used PBKDF2 with a single iteration: http://security.stackexchange.com/questions/5985 http://security.stackexchange.com/questions/5985 Security is not exactly their forte.
- ghshephard 11y agoSome pretty epic parts coming out of this story, if even half of it is true: "Rouleau even admitted to the judge, during one ex parte hearing, that his own phone would be vulnerable to the type of intrusion the RCMP used on the targets of the investigation. "I'm a dead chicken. That's the reality of it, that's what we don't want the general public to know," Rouleau said."
- pritambaral 11y agoJust an example of why closed security systems are inherently not secure. EDIT: Of course, I also mean the closed possession of private keys.
- criddell 11y agoEven if it were open, how would you know the key had been obtained by a third party?
- pritambaral 11y agoBy 'closed', I also meant that the key was in proprietary possession. If it were open, one could check and ensure private keys were never under the possesion of a third-party.
- jlgaddis 11y agoAssuming this is all true -- and I think the article puts forth some compelling evidence that it is -- I don't think it's a stretch to assume that the U.S. (and the three other "Eyes") also have access to this key.
- kstrauser 11y agoCEO John Chen earlier said this about BlackBerry security (at http://crackberry.com/john-chen-discusses-blackberry-security-and-e-mail http://crackberry.com/john-chen-discusses-blackberry-securit...): > There have been a number of news articles over the past few months speculating that BlackBerry technology may have been deployed in a non-approved manner, placing sensitive government information at risk. While I cannot comment or speculate on those news stories, or the extent to which any vulnerable non-BlackBerry components may have been involved, I do want to reiterate the security technologies that BlackBerry provides to millions of government and enterprise customers around the world. New BlackBerries are based on Android now. I'd venture that 95% of a new BlackBerry is made of non-BlackBerry components. I find it interesting that he carefully disclaims any vulnerabilities that might have been found and exploited in that 95%. I don't have anything particularly against BlackBerry. I wish they'd get their act together and do well so we can have more competition and innovation in the cell phone market. However, I wish we'd put that whole "BlackBerry is secure" trope to rest because that doesn't ring remotely true to my ears.
- neurobuddha 11y agoBlackberry deserves props for experimentation and their surprising good OS 10, but if Priv is shorthand for privacy, then that's veering close to dishonesty. Darn happy with my Passport though.
- kstrauser 11y agoI give them their props. Again, even though I like iPhones, I want someone else to give them a run for their money so that Apple is more motivated to emulate the cool stuff so I can have it. But even today, their CEO goes on about privacy and security - as long as you use only the enterprise stuff and not the messaging that it ships with. And as long as all the other stuff on the phone isn't compromised, say by a root hack that allows attackers to dump RAM. And as long as they haven't deliberately handled the encryption key protecting your stuff over to third parties. As long as all that's true, their stuff is secure. That's not confidence inspiring.
- Silhouette 11y ago
- tonyle 11y agoLets break this down. sms, not encrypted. pin messages/BBM, "scrambled" BBM protect, encrypted BES (corporate device), encrypted with a key that BlackBerry is not suppose to be able to access. Originally bb devices could send messages to other bb if you knew their pin. The data was compressed and encrypted, but a moot point since all bb devices had the same key. Pin messages,BBM and their bis infrastructure was never really considered secured, their main offering was BES with offered end to end security. I used the term scrambled since that was the term everyone was using years ago since people get confused between encrypted, vs encrypted with shared key, vs not encrypted, etc. It quickly becomes a pointless conversation. As far as I'm concerned, This isn't really surprising if you think about it. BlackBerry's only claim to security was BES for end to end communication.
- x5n1 11y agoThe take away from each one of these is that corporations can not be trusted with your data not to divulge it to the government, or even to secure it well enough that it is not compromised. However, most corporations do not have the resources in terms of technical know-how and labor to do much better in terms of not being compromised.
- pakled_engineer 11y agoThere was also that BES service Data Locking corp (a.k.a. BeStealth) hosted in Costa Rica that shilled it's "unbreakable encryption" to crime groups which the FBI remotely broke into and snatched all the keys. Another way into BES is of course via stupidity, such as Nicola Nero the crime boss police caught a few years ago in Ontario who had written his password on a memo and left it beside his BlackBerry phone because he kept forgetting it. They busted a global mafia ring from that one mistake.
- tptacek 11y agoThis is just PIN-to-PIN messaging, right? Isn't PIN-to-PIN sort of morally equivalent to GSM encryption?
- joesmo 11y agoThere is no way this key is not already in someone's hands who is not supposed to have it. There is no way it wasn't leaked, stolen, misplaced, or sold (for probably a ton of money). Who is going to trust Blackberry now? Even as a BB Enterprise customer, I'd be scrambling right now to change my system immediately. This is exactly what I expect will happen to the whole industry if idiotic bills like the one currently proposed by Senator Feinstein make it through. No sane, security-minded person will want to use any of these products. And there certainly is no shortage of foreign competition. But it's all worth it to calm down the cowardly masses who are afraid of terrorism or whatever the fear of the day might be, right?
- stygiansonic 11y agoIt's worthwhile to note that John Chen called out Apple for refusing to unlock an iPhone for the US government. (No, not the San Bernardino one, but a different one in a criminal case; I believe Apple has unlocked iPhones in other cases though.) Quote: "In fact, one of the world’s most powerful tech companies recently refused a lawful access request in an investigation of a known drug dealer because doing so would “substantially tarnish the brand” of the company. We are indeed in a dark place when companies put their reputations above the greater good." I guess it depends on your definition of "the greater good". http://blogs.blackberry.com/2015/12/the-encryption-debate-a-way-forward/ http://blogs.blackberry.com/2015/12/the-encryption-debate-a-...
- walrus01 11y agoI would be surprised if CSE and CSIS don't have their own staff embedded inside Blackberry, either with or without the company's knowledge. They don't have nearly the budget that NSA does but they're not stupid.
- jasonjei 11y agoWasn't Obama using a Blackberry device a few years ago? Granted the device he was using was likely hardened, but still raises interesting questions.
- peeters 11y agoWhat interesting questions does it raise?
- jasonjei 11y agoWhether or not his phone is compromised from BlackBerry's key being available to governmental authorities, even those outside the US.
- dmix 11y agoCanada/CSEC works directly with the NSA. So I'm sure they are aware of Blackberry's vulnerabilities. Same with GCHQ and New Zealand. I believe the DoD complained about having to secure his Blackberry when he insisted on using it over their standard Android devices.
- peeters 11y agoWhat am I missing? When I Google "blackberry pin to pin encryption" , the first result is this article: > Canadian government warns BBM PIN-to-PIN messaging is ‘most vulnerable method of communicating on a BlackBerry’ http://bgr.com/2013/02/27/blackberry-messenger-security-vulnerability-346634/ http://bgr.com/2013/02/27/blackberry-messenger-security-vuln... > Canadian government agency Public Safety Canada, which is tasked with overseeing cyber-security across all federal departments, has issued a memo warning government workers that communicating using BlackBerry Messenger PIN-to-PIN messaging is “the most vulnerable method of communicating on a BlackBerry.” ... According to the memo, PIN-to-PIN messages sent via BlackBerry Messenger could be intercepted and read by any BlackBerry user anywhere in the world. ... “Although PIN-to-PIN messages are encrypted, they key used is a global cryptographic ‘key’ that is common to every BlackBerry device all over the world,” Public Safety Canada official stated in the memo. “Any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device.” Why is there any surprise then that the RCMP has capability to decrypt it?
- Scoundreller 11y agoCracking Blackberries isn't unknown for RCMP: From: https://www.canlii.org/en/ns/nssc/doc/2016/2016nssc7/2016nssc7.html https://www.canlii.org/en/ns/nssc/doc/2016/2016nssc7/2016nss... " On June 24, 2014 the RCMP advised in writing that their crime lab required another two to three months to crack the BlackBerry." & "The Crown could not disclose the contents of the BlackBerry until they were able to crack it. Once cracked, there was no relevant evidence on it to disclose."