I read an article that famed cryptographers at Elcomsoft have discovered a method to brute force RIM Blackberry device passwords. Usually a Blackberry will only allow 10 failed password attempts before wiping the device. Elcomsoft discovered if a user enables media card encryption an unlimited offline password attack against the media card can be performed bypassing the 10 guess restriction.
Scary stuff… I’m a user with Media Card Encryption enabled. Do I disable encryption OR permanently solder the media card in place so it can’t be removed?
From Computer World:
“A Russian security company upgraded a phone-password cracking suite with the ability to figure out the master device password for Research in Motion’s BlackBerry devices. Elcomsoft said September 29 that before it developed the product, it was believed there was no way to figure out a device password on a BlackBerry smartphone or PlayBook tablet. BlackBerry smartphones are configured to wipe all data on the phone if a password is typed incorrectly 10 times in a row, the company said. Elcomsoft said it figured a way around the problem using a BlackBerry’s removable media card, but only if a user has configured their smartphone in a certain way. For the software to be successful, a user must have enabled the feature to encrypt data on the media card. The feature is disabled by default, but Elcomsoft said about 30 percent of BlackBerry users have it enabled for extra security. The company’s software can then analyze the encrypted media card and use a brute-force method to figure out a password. Elcomsoft said it can recover a seven-character password in less than an hour if the password is all lower-case or all capital letters. The software does not need access to the actual BlackBerry device but just the encrypted media card. The new feature is wrapped into Elcomsoft’s Phone Password Breaker. The software can also recover plain-text passwords used to access encrypted backup files for Apple’s iPhone, iPad, and iPod Touch devices. To crack those passwords, a user does need to have the Apple device in hand.”
Read the full article here at Computer World.