Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Russian Software Company Says Its App Can Crack BlackBerry Security

timothy posted more than 2 years ago | from the put-down-that-wrench dept.

Blackberry 78

AZA43 leaps into the ranks of accepted submitters, writing "Russian security software vendor Elcomsoft has released an app that it claims can determine BlackBerry handheld passwords. The software supposedly hacks the BlackBerry password via an advanced handheld security setting that's meant to encrypt data stored on a user's memory card. And a hacker doesn't even need to have the BlackBerry to determine a password, just the media card."

cancel ×

78 comments

Sorry! There are no comments related to the filter you selected.

someone cracks blackberry security (-1)

MindPrison (864299) | more than 2 years ago | (#37583686)

news at 11...big freaking deal...

Re:someone cracks blackberry security (5, Informative)

PsychoSlashDot (207849) | more than 2 years ago | (#37583770)

news at 11...big freaking deal...

You act like this is either unimportant or not news. I'm not sure which.

Fact is while there's a lot of FUD floating around regarding things like RIM "caving in" and dropping BIS servers in questionable countries, there haven't actually been very many actual real-life exploits for the phones or their communications. Blackberry phone remains the only ones on the market that encrypt all data traffic by default and that encryption can't be disabled. If you're on BIS or if you're on BES, your unencrypted web traffic, e-mail traffic (even POP3) is encrypted at the device. That's still worlds ahead of the other devices.

There's reports that one exploit exists that can decrypt Password Keeper data from a phone backup on a PC. There's this report that discusses recovery of phone unlock passwords. There's the widely discussed and misunderstood reports about RIM dropping BIS MDS servers in unfriendly countries and what that allows (hint: it has zero to do with Blackberries not in those countries).

RIM's stuff is by and large still very, very secure by any comparison and their phones are unique in that regard. So the way I see it, this is both news (being a genuine security hack) and relevant (these phones being the best on the market).

So stuff your ignorant sarcasm.

Re:someone cracks blackberry security (1)

wiedzmin (1269816) | more than 2 years ago | (#37584038)

Very well said. Though, I really hope this gets addressed, because I don't feel comfortable with having to make a choice between potentially exposing my device password or contents of my SD card..

Re:someone cracks blackberry security (0)

Anonymous Coward | more than 2 years ago | (#37584256)

There is a lot of hype here, so be sure to read the full article. It only works for users who have encrypted the media card with device password only, and they only discuss the time to hack a single case 7 character password. If you use one of the encryptions options that includes the device key, then the attacker is stuck trying to crack AES.

Re:someone cracks blackberry security (0)

MindPrison (864299) | more than 2 years ago | (#37584040)

quote you:
So stuff your ignorant sarcasm.
quote end...

Yep...stuff me, that will solve all issues right there.
unlike you, I actually know something about it, but then again, would you even care?
You write...RIM's stuff is by and large, very secure...etc... yep.. you do live in a cubicle of security beliefs don't you? Do I really care? Nope...not really..just trying to inform the likes of ya. Take the information any way you like it. I get my burger edgeways.

Re:someone cracks blackberry security (1)

PsychoSlashDot (207849) | more than 2 years ago | (#37584184)

would you even care?

Yes.

just trying to inform the likes of ya.

Inform away. So far you've got zero information content in either of your posts. Mine summarizes the known exploits and security topics. Yours don't. Feel free to drop the newsburger edgestuff at 11 nonsense and communicate with us. Drop down to the lesser language of English and educate me.

Re:someone cracks blackberry security (1)

ColdWetDog (752185) | more than 2 years ago | (#37584268)

Pics. Or it didn't happen.

Slapping your epenis around with ol Psycho isn't terribly entertaining. You know something? Tell us.

Re:someone cracks blackberry security (1)

Eponymous Hero (2090636) | more than 2 years ago | (#37590668)

fuck rule 10, i'm more interested in rule 34. where's the porn of these security vulnerabilities?

Re:someone cracks blackberry security (3, Interesting)

Bert64 (520050) | more than 2 years ago | (#37584394)

RIM stuff is largely security by obscurity at this point however, very few people have seemingly tried to pull their stuff apart, and the few that have didn't find good things, see the pwn2own contest from this year for one such example.

Android, iphone and even windows mobile devices are much easier to target because they are largely based on existing systems which are well understood... RIM are using a totally obscure black box that requires significant investment of time to reverse engineer. This doesn't mean it's secure, it just means that hackers will need to spend more time to find holes in it. On the other hand, it means that whitehats will also require more time to reverse engineer the system, whereas its highly possible that blackhats have already stolen the sourcecode.

Most devices provide the option to run a VPN between the handset and a server under your control, only RIM require that there be a server under their control sitting in between.

Most devices (RIM included) can also boot up and start talking to the network without requiring any user input, therefore the keys used for this encryption must be stored on the device somewhere, just waiting for someone appropriately skilled and motivated to work out how to extract them...

Re:someone cracks blackberry security (1)

Fnord666 (889225) | more than 2 years ago | (#37586778)

RIM's stuff is by and large still very, very secure by any comparison and their phones are unique in that regard. So the way I see it, this is both news (being a genuine security hack) and relevant (these phones being the best on the market).

This seems to be misunderstood as either a crack or a break in the security of the BB. It is neither. Elcomsoft is using a crib that they have found to attempt dictionary and/or brute force attacks, nothing more. See this blog post [crackpassword.com] for the specific details about the file they are using. Unless there is something else that they haven't mentioned, this is a garden variety known plaintext attack.

In Soviet Russia... (2)

ksd1337 (1029386) | more than 2 years ago | (#37583694)

...software cracks YOU!

Crackberry (-1)

Anonymous Coward | more than 2 years ago | (#37583728)

This turns your Blackberry literally into a Crackberry.

Do Russians contribute anything useful? (2, Insightful)

Beelzebud (1361137) | more than 2 years ago | (#37583738)

It seems like the only time I read about anything Russians do with computer tech, it involves botnets, stealing passwords, and ripping off peoples bank accounts. Are there any Russians that contribute something positive to the world of software?

Re:Do Russians contribute anything useful? (1)

Threni (635302) | more than 2 years ago | (#37583760)

They provide entertaining plane/sub/ etc disasters. Oh, and putin does stuff like lying about finding ancient vases etc when he goes swimming. He's like that bearded Iranian twat. But without the beard.

Re:Do Russians contribute anything useful? (1)

Anonymous Coward | more than 2 years ago | (#37584066)

Have you seen that picture of him riding the shark though? A guy who could harness a wild shark and ride it around the sea, is probably badass enough to happen upon an ancient vase. Even more likely to do so because he would be traveling at shark speed through the water, rather than human speed.

I wonder what would happen (1)

circletimessquare (444983) | more than 2 years ago | (#37584468)

if Putin crossed paths with Chuck Norris

Re:I wonder what would happen (0)

Anonymous Coward | more than 2 years ago | (#37594428)

Maybe you could make a movie about Russian zombies. That would be great.

Re:Do Russians contribute anything useful? (2, Funny)

thht (1473001) | more than 2 years ago | (#37583772)

Kaspersky?

Mod parent up. (1)

RulerOf (975607) | more than 2 years ago | (#37583882)

Kaspersky?

Talk about getting pwned.

Re:Do Russians contribute anything useful? (4, Funny)

Anonymous Coward | more than 2 years ago | (#37583786)

Are there any Russians that contribute something positive to the world of software?

Tetris alone puts them way ahead of most countries.

Re:Do Russians contribute anything useful? (2)

Osgeld (1900440) | more than 2 years ago | (#37583794)

they have pinouts for everything!

http://pinouts.ru/ [pinouts.ru]

Re:Do Russians contribute anything useful? (3, Insightful)

ripdajacker (1167101) | more than 2 years ago | (#37583836)

One might view the testing and breaking of security as a valuable contribution. How else will companies like RIM learn?

Re:Do Russians contribute anything useful? (1)

davester666 (731373) | more than 2 years ago | (#37583952)

Unfortunately, RIM has two CEOs, and it appears it takes them twice as long as everybody else to learn things.

Re:Do Russians contribute anything useful? (4, Funny)

fuzzyfuzzyfungus (1223518) | more than 2 years ago | (#37584050)

I'm told that they are currently hunting for a third, because they think that a Mismanage à trois would be totally hot...

Re:Do Russians contribute anything useful? (1)

roman_mir (125474) | more than 2 years ago | (#37584008)

I am former Soviet, Israeli, Canadian, currently in Europe building and selling/deploying software systems that analyze and integrate retail operations within store chain (integrate stores into a chain) and between stores and suppliers/manufacturers. It's hard business to compete with Oracle, SAP, MS in this field as well as with a number of smaller providers, including Russian 1C (1S), which is supported by Russian government, even their owner is a 'comptroller general' for a very large part of Russian Federation. OTOH I don't have Russian citizenship, so :) maybe not precisely what you are asking.

Re:Do Russians contribute anything useful? (2)

Reservoir Penguin (611789) | more than 2 years ago | (#37584074)

Parallels.

Re:Do Russians contribute anything useful? (1)

X.25 (255792) | more than 2 years ago | (#37584076)

It seems like the only time I read about anything Russians do with computer tech, it involves botnets, stealing passwords, and ripping off peoples bank accounts. Are there any Russians that contribute something positive to the world of software?

No, of course not, you stupid retard. All Russians are criminals, right?

How are you not ashamed of publicly admitting that you don't read anything is beyond me, though.

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37585250)

Yes, he generalized, but --You-- haven't listed anything to support that their primary export, besides oil, is -not- cyber crime; you only implied an unsupported position. Your screechy little comment sounds like you write sound bites for PETA in your spare time. You spoke out, so give us the benefit of your wisdom- You imply that you have read something... Why don't you make a solid list of the positive, well-known contributions Russians / Eastern Europeans have made to the cyber world. I'm not talking about IrfanView, or a bunch of Russian code slaves working in a basement in New York either. Come on, Sparky, tell us some of the ground-moving, positive contributions they've made- Give me an operating system, a browser, hell- just give me a decent word processor. How about something like drop box? Paypal? iTunes? a worthwhile cloud-based app? any good games? Yeah, Russians are really out there swinging for the fences, pal... enthusiasm for the art of computer science and ethics are just rampant in the Russian cyber community. Their entire fucking economy is run like a Chicago gangland from the 1920's, why should their cyber domain be any different?

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37584096)

The Russians don't contribute much to anything. Its a bunch of criminal thugs.

Re:Do Russians contribute anything useful? (1)

Eponymous Hero (2090636) | more than 2 years ago | (#37590678)

they trade us awesome hockey players. lawyered

Re:Do Russians contribute anything useful? (1)

melted (227442) | more than 2 years ago | (#37584160)

They do. There are a lot of Russian programmers working here in the US contributing quite heavily and positively to "the world of software". It's just that good news aren't as exciting.

Engineer is really a third rate profession in an oil and gas rich country like Russia. Everyone wants to be a boss of some kind and to sit just a wee bit closer to the pipe. A few companies that manage to pull together good talent generally either work for the local market (because US is impossible to get into if you're not a US company), or offer outsourcing, or just keep low profile. Kaspersky writes antiviruses, but it was almost a decade before he figured out a viable strategy to enter the US market. Yandex works on the local market. Google, Cisco and Intel have dev offices there. I suspect many other large multinationals do, too.

Re:Do Russians contribute anything useful? (2, Informative)

TheRaven64 (641858) | more than 2 years ago | (#37584208)

How did this borderline racist shit get modded up? Two of the biggest open source projects that I work on (LLVM and FreeBSD) have a lot of Russian contributors. You are almost certainly using code (at least partially) written by Russians on a daily basis.

Re:Do Russians contribute anything useful? (2)

fatphil (181876) | more than 2 years ago | (#37584530)

Plenty working on Linux are from Russia too. The input layer subsystem is Dmitry Torokhov's ward, for example, and Artem Bityutskiy gave us UBI(FS). Not to mention a great number of footsoldiers contributing a whole host of drivers, features, fixes, etc. I've worked alongside a great many Russians, and they were highly skilled and rigorous engineers.

Re:Do Russians contribute anything useful? (2)

gtall (79522) | more than 2 years ago | (#37586108)

Racist? Errrm...okay, I give up, how does casting aspersions on Russians constitute racism?

The GP though should give the Russians a break. First the Tsars, then Stalin, and now Putin. Russkies do have a knack for finding the least capable people to run the country. Having a government which is the moral equivalent of La Cosa Nostra isn't a recipe for success. The Russkies should be hailed for still trying to succeed in spite of their leaders.

Re:Do Russians contribute anything useful? (1)

Unequivocal (155957) | more than 2 years ago | (#37586986)

Yeah good points. I'll add Nginx to the list. Jeez - that webserver software has been killing it in terms of capabilities (and market growth) for about 4 years. All thanks to a solid Russian OSS developer named Igor Sysoev.

And if you want to dig a little deeper, the GiST index system for Postgres which enables GIS, spherical projections (for astronomy) and all kinds of other amazing solutions in Postgres - thanks to two great (and amazingly smart) guys also in Russia. http://www.sai.msu.su/~megera/postgres/gist/ [sai.msu.su] (note the ".su" badass domain still). :)

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37587750)

I suppose it could be worse. Imagine running code written by chinky's!

Tetris (0)

Anonymous Coward | more than 2 years ago | (#37584242)

Not sure about "useful", but Tetris sprints to mind as something positive

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37584320)

It seems like the only time I read about anything Russians do with computer tech, it involves botnets, stealing passwords, and ripping off peoples bank accounts. Are there any Russians that contribute something positive to the world of software?

Kaspersky A/V.

Sergey Brin? (2)

circletimessquare (444983) | more than 2 years ago | (#37584450)

Re:Sergey Brin? (1)

Pseudonym Authority (1591027) | more than 2 years ago | (#37585282)

Yeah, but what has he done for me lately?

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37584516)

nginx.

Re:Do Russians contribute anything useful? (1)

tokul (682258) | more than 2 years ago | (#37584560)

Are there any Russians that contribute something positive to the world of software?

rarlabs, akella, http://l10n.gnome.org/languages/ru/ [gnome.org]

Re:Do Russians contribute anything useful? (2)

Hentes (2461350) | more than 2 years ago | (#37584896)

If they disclose the vulnerability instead of just exploiting it than it's useful. Also, Russians are very good at IT in general, [wikipedia.org] you just only hear about the hackers as they are the ones to make the news.

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37584952)

www.kaspersky.com [kaspersky.com]

That is, if you agree that's a contribution. Some don't :).

I know they have (in programming) (0)

Anonymous Coward | more than 2 years ago | (#37585118)

Many times over the past 2 decades. E.G.-> I was an avid Borland Delphi dev. circa 1995-2002, & a good % of those that contributed VCL were Russian coders.

(VCL prebuilt objects/libs, albeit, with added or better functionality than std. ones Borland gave you)

I'm SURE that the same goes for C/C++ over time & probably Assembly work before that, etc./et al...

* Then again, I am inclined to go with you on some grounds, online security ones, because I have been populating a custom HOSTS file vs. malware infested sites, botnet C&C servers, known bogus hosts-domain names, & adbanners too, & where do a LARGE %-age of them come out of? You guessed it: The U.S.S.R./Soviet Union/Russia...

"Are there any Russians that contribute something positive to the world of software?" - by Beelzebud (1361137) on Sunday October 02, @12:38PM (#37583738)

Per what I wrote above, you have a SMALL fraction of a possible answer...

(It's the same anywhere though - you've got your "normal folks" & you've got your "criminal elements" too...)

APK

P.S.=> As to what I opened with - Pretty much any custom VCL site can show folks this, & once there? Take a peek around @ the VCL authors' names: You'll see what I mean...

Then also, you've got the guys in the FREEWARE 64 bit world who did UltraDefrag64:

http://it.slashdot.org/comments.pl?sid=2435272&cid=37443252 [slashdot.org]

(Which is 1 of INFOWORLD's "top picks" recently for good freeware)

They're russians too.

Honestly - I'm not even BEGINNING to scratch the surface here either, not really!

Face it - Every culture has "good" & "bad" folks (some are bad due to bad decisions forcing their hands too I'd imagine as well, so, i.e.-> They're not really "evil", just more desperate)...

... apk

Re:I know they have (in programming) (-1)

Anonymous Coward | more than 2 years ago | (#37585392)

nigger

An application of... "ReVeRsE-PsYcHoLoGy" (0)

Anonymous Coward | more than 2 years ago | (#37585744)

"nigger" - by Anonymous Coward ANOTHER "ne'er-do-well" /. OFF-TOPIC TROLL on Sunday October 02, @05:43PM (#37585392)

"???"

Uhm... Could we get a translation of that off-topic "troll-speak/trolllanguage" of yours, please?

---

* And, you're an off-topic troll - no questions asked...SEE MY SUBJECT LINE ABOVE!

APK

P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his off-topic b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!

("ReVeRsE-PsYcHoLoGy", for trolls - Courtesy of this code by "yours truly" in less than 1 second flat):

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
    try:
        trollstring = ""
        for apksays in s:
        trollstring = apksays + trollstring
    except:
        print("error/abend in reverse function")
    return trollstring

s = ""
print reverse(s)

try:
  s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
  s = reverse(s)
  print(s)
except Exception as e:
  print(e)

---

... apk

Translation from trollspeak (0)

Anonymous Coward | more than 2 years ago | (#37585786)

"reggin" - by Anonymous Coward ANOTHER "ne'er-do-well" /. OFF-TOPIC TROLL on by Anonymous Coward on Sunday October 02, @05:43PM (#37585392)

"???"

Uhm... Could we get a translation of that off-topic "troll-speak/trolllanguage" of yours, please?

* And, you're an off-topic troll - no questions asked...SEE MY SUBJECT LINE ABOVE!

APK

P.S.=> Yes, it must have just have been another off-topic done nothing of significance with his life troll spewing his off-topic b.s. again & not contributing to the ongoing conversations. Oh well - No biggie!

("ReVeRsE-PsYcHoLoGy", for trolls - Courtesy of this code by "yours truly" in less than 1 second flat):

---

#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)

def reverse(s):
    try:
        trollstring = ""
        for apksays in s:
        trollstring = apksays + trollstring
    except:
        print("error/abend in reverse function")
    return trollstring

s = ""
print reverse(s)

try:
  s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
  s = reverse(s)
  print(s)
except Exception as e:
  print(e)

---

... apk

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37586490)

It seems like the only time I read about anything Russians do with computer tech, it involves botnets, stealing passwords, and ripping off peoples bank accounts. Are there any Russians that contribute something positive to the world of software?

http://en.wikipedia.org/wiki/List_of_Russian_people#IT_developers

A Russian invented Google, and you can't even use it.

-Yuri

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37586862)

While here in America, the cream of our finest business and engineering schools jointly crafted the subprime mortgage derivatives boom that produced billions USD in profits for themselves, and trillions in public debt and a worldwide recession that should last, oh, another eight years or so, for everyone else.

Do Americans contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37586956)

It seems like the only time I read about anything an American wrote, it involves ignorance, bad generalizations, and a us versus them mentality. Are there any Americans that contribute something positive to the world?

Re:Do Russians contribute anything useful? (1)

hutsell (1228828) | more than 2 years ago | (#37587560)

Isaac Asimov's Three Laws of Robotics. Initially, I found the simplistic algorithm to be strangely fascinating; in hindsight,
I realized the exposure was my first experience with the idea of programming--something I still find strangely fascinating.

From: ...Are there any Russians that contribute something positive to the world of software?

--
"God, please stop me before I code again."

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37596250)

Not sure why password cracking software is not positively good? Have you tried it? Does it work reliably?

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37596276)

Well, I work at Microsoft and here in Redmond 2/3 of all developers appear to be Indian, Russian or Jewish by country of origin. Facebook and Google even more so. Feels like US. suddenly stopped producing good developers, or maybe all smart ones decided to turn into lawyers and patent trolls? Look at LinkedIn - many studied in Moscow Univ or one place they call "Novosibirsk" - that is where one of their strongest tech schools are I guess.

Re:Do Russians contribute anything useful? (0)

Anonymous Coward | more than 2 years ago | (#37602468)

identifying vulnerabilities in code is a valuable skill and I applaud these researches for releasing this to the general public. So as far as I am concerned this is something positive.

Not reliable... (5, Interesting)

hawkbat05 (1952326) | more than 2 years ago | (#37583740)

If you actually read this one you'll realize it's useless if the card isn't encrypted (ironically) or the user chose one of the other 3 options. Plus this option is designed to be less secure so you can put the card in another device and decrypt it with just a password. I also wonder what character set is included in their claim of cracking a 7 character password in just hours. http://xkcd.com/936/ [xkcd.com]

Re:Not reliable... (0)

Anonymous Coward | more than 2 years ago | (#37584210)

That's the first xkcd I've seen that has is a genuine disappointment. [wikimedia.org]

Re:Not reliable... (1)

Anonymous Coward | more than 2 years ago | (#37584554)

I don't think so. The Troubador password may have 5,748,511,570,879,116,626,495 possible requirements if brute forced, but it does not require pure brute forcing. A modified dictionary attack would quickly crack a one word password like that because people use certain patterns. For example, the capital letter usually only appears at the first position and numbers and symbols are appended to the end of the word. Additionally, "troubador" is likely to appear on some expanded word lists (in fact the comic seems to think it would appear on a list of 65,536 words on it). Put that all together, John the Ripper would likely get that fairly quick using some of their more basic rules.

Conversely, the four words example appears to assume they would appear on a list shorter list of 2,048 possible words (to reduce uncertainty to 1 and guarantee a hit). Then, then you get 2048^4 (possible selections^number of selections) or 17,592,186,044,416 possible permutations to get the right words in the right order through brute forcing.

Re:Not reliable... (0)

Anonymous Coward | more than 2 years ago | (#37586634)

AC reply to AC is correct, the 4 word seems easier to crack if you don't know how john the ripper works, but is less likely to get cracked in a short amount of time.

Re:Not reliable... (1)

Ja'Achan (827610) | more than 2 years ago | (#37587616)

That's assuming the average person will have 2048 words to choose from, rather than, say, 64.

Re:Not reliable... (0)

Anonymous Coward | more than 2 years ago | (#37594272)

Where do you get 64 from? The last thing I wrote was barely one page and according to uniq (after being converted to a document with new lines instead of spaces and sorted) has over 400 unique word in it. That does not even consider the fact that if I were to use the many word password, that I would have the whole English language to choose from. People use more words then they think they do.

Re:Not reliable... (1)

fatphil (181876) | more than 2 years ago | (#37594832)

And that he won't lock himself out by repeatedly trying "pony right cell staple", or similar.

Re:Not reliable... (0)

runningduck (810975) | more than 2 years ago | (#37584238)

The real question, however, is will any such attack against Blackberries be successful before RIM is out of business? Hmmm, come to think of it this is sort of like TKIP but on a macro level.

I wonder how they managed that... (0)

fuzzyfuzzyfungus (1223518) | more than 2 years ago | (#37583742)

Why would the password be stored, in any form recoverable by means that aren't computationally intractable brute forcing, anywhere in the device or storage expansion cards?

Isn't this the sort of thing that hashing is supposed to solve?

Re:I wonder how they managed that... (2)

hawkbat05 (1952326) | more than 2 years ago | (#37583758)

They're brute forcing it

Re:I wonder how they managed that... (0)

Anonymous Coward | more than 2 years ago | (#37583802)

Isn't this the sort of thing that hashing is supposed to solve?

Yeah! Hash that data! ... ... ... ... ... Um... ... ... how do I get it back now? ... ...

Re:I wonder how they managed that... (3, Informative)

Sqr(twg) (2126054) | more than 2 years ago | (#37583840)

The password is not stored in any form, of course. But if there's encrypted data on the card, and that data can be decrypted using only the password, then you can just try every possible password until you find one that doesn't result in gibberish. This is called a known-plaintext attack [wikipedia.org] .

Bad description of known-plaintext in parent post (0)

Anonymous Coward | more than 2 years ago | (#37588332)

If you understand what a known-plaintext attack is you have explained it very badly. It may well be that a known plaintext attack is possible because you expect certain files or file structure to be in place but known plaintext means that you know specific parts of the plaintext not just that you are looking for anything that isn't gibberish.

Posted anonymously so that I can mod you down.

Puzzling (1)

amightywind (691887) | more than 2 years ago | (#37583826)

Russians are good at cracking software. It is a puzzle that they are so bad at creating it.

Why does this matter? (0, Funny)

Anonymous Coward | more than 2 years ago | (#37583890)

RIM will not even exists within a year or so. I'ts only a matter of time before they get completely slaughtered and file for bankrupcy etc..

Re:Why does this matter? (2)

jkflying (2190798) | more than 2 years ago | (#37584068)

Dunno. Here in South Africa, everybody has a BB. In an average week I probably see 3 people posting their new BBM number on facebook. Just because the US all went iPhone doesn't mean the rest of the world particularly agrees.

Re:Why does this matter? (-1)

Anonymous Coward | more than 2 years ago | (#37584550)

Can't speak for the U.S., but I live in Spain and BB had fallen off the map here, same when I travel to France and Germany, which I often do for work.

In other news (4, Funny)

G3ckoG33k (647276) | more than 2 years ago | (#37584060)

In other news "Other Russians Say They Cracked BlackBerry Years Ago" but kept mum about, for "financial and business reasons". ;)

Same key? (1, Interesting)

russotto (537200) | more than 2 years ago | (#37584106)

Pure speculation here:

Since this only works with media encryption enabled, I'm guessing this is an alternative cipher attack. They can't directly obtain the Blackberry device password, but they can break the media encryption (perhaps because it is a much weaker cipher). The media encryption key is likely the same as or derived from the device password, allowing an expedited attack on that.

Moral of the story: If you derive a key for a weak cipher from a key used for a strong one, make sure you use an irreversible function to do so.

Re:Same key? (0)

Anonymous Coward | more than 2 years ago | (#37586876)

Moral of the story: If you derive a key for a weak cipher from a key used for a strong one, make sure you use an irreversible function to do so.

Excellent observation, I used to charge for that....

Blast to the past: Dmitry Skylarov (0)

Anonymous Coward | more than 2 years ago | (#37586758)

This is the same company that employed Dmitry Skylarov, one of the first people to be arrested under the DMCA for breaking the encryption on Adobe's eBook format.

http://en.wikipedia.org/wiki/Dmitry_Sklyarov

Blast to the past: Dmitry Skylarov (4, Informative)

metallic (469828) | more than 2 years ago | (#37586766)

Let's try not posting this as an Anonymous Coward by mistake.

This is the same company that employed Dmitry Skylarov, one of the first people to be arrested under the DMCA for breaking the encryption on Adobe's eBook format.

http://en.wikipedia.org/wiki/Dmitry_Sklyarov [wikipedia.org]

Notthing to see here... (2)

Prune (557140) | more than 2 years ago | (#37587084)

This is simply brute-forcing the password, relying on a short user password. It is only viable if the user has set up the phone security options in a weak way: selected to encrypt media card with user password only, rather than user password plus device key. So really there is nothing surprising in this attack. If you want good security on a Blackberry, it's a matter of setting it up in the options.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>