BlackBerry baffled by Dutch cops' phone encryption cracked brag

It might have something to do with using keys that are too short. There have been notifications that the older 32 bit key ids are no longer secure and that users should be using longer ones.

There are also reports around that something like 95% of Blackberry users use short passwords which can be brute-forced in practical periods of time.

Both of the above are related to the fact that passwords or keys that might have provided reasonable security 10 or 15 years ago are no longer adequate because of the availability of cheap computing power.

Of course a third possibility is that they are simply going around the encryption in a poorly implemented third party app. If the app is keeping plain text draft, display, cached copies, or fragments of text from deleted memory, then the Dutch don't need to actually crack the encryption in order to get at least some of the messages.

There are also reports that people have been removing (de-soldering) memory chips from the Blackberry PC boards, or using the JTAG port to get a copy of the password hash, and then brute forcing it.

The thing which suggests that it is something to do with one of the above, or something similar, is that the Dutch were able to crack some messages but not others.

Cellebrite says their UFED analyser will: "Recover a greater amount of deleted data from unallocated space in the device's flash memory ... Rich set of data: Apps data, passwords, emails, call history, SMS, contacts, calendar, media files, location information etc. ... Decoding of JTAG physical extractions of a rich set of data from Windows Phone 8, BlackBerry 10, Android devices and more ... Recover deleted image files and fragments when only remnants are available"

If you download and read their supported devices list, they "support" a long list of Blackberry phones (and pretty much everyone else as well). I suspect the Dutch used a Cellebrite analyser to get actual data, and then applied some techniques of their own to brute force weak passwords including passwords which were re-used for multiple purposes. If the owner used the same passwords over and over again for different purposes (as many people tend to do), the Dutch only needed to find one app that had a weak point in order to get access to the rest.

Snowden was a long time ago now, the world changes. He may not have had access to everything and he only worked one place. He may also have been a plant, give us stuff that was going to leak eventually to hide the bigger secrets.

All very unlikely, but an argument that runs "Snowden said it was safe" is not particularly reliable.

Re: Nothing to see, move along

I am not an expert on this, but I was under the impression that PGP only encrypted the message body, and maybe the subject - for exactly the risk you highlight. Also, if you encrypted the whole bloody thing then you couldn't deliver the message. So if you get 200 emails you get a load of plaintext headers, and some blobs of data. 200 is not a lot if you're looking to crack the key by brute force.

Re: They have not cracked PGP

It may have been cracked years ago, but by those that are good at keeping secrets. The Israeli company has a commercial interest in publicising their abilities.

Re: Propaganda

Indeed. Spreading this 'news' might the effect of making the criminals or whoever wary of using their existing communication techniques, if only for a short while. There might then be knock-on effects that the police can take advantage of, such as more face-to-face meetings between criminals.

https://xkcd.com/538/