BlackBerry encryption security broken by Russian firm Elcomsoft
Password cracking suite extracts master device password from locked phones
By Jeremy Kirk | Published: 10:42, 30 September 2011
A Russian security company has upgraded a phone password cracking suite with the ability to figure out the master device password for Research in Motion's BlackBerry devices.
Elcomsoft said that before it developed the product, it was believed that there was no way to figure out a device password on a BlackBerry smartphone or PlayBook tablet. BlackBerry smartphones are configured to wipe all data on the phone if a password is typed incorrectly 10 times in a row, the company said.
Elcomsoft said it figured a way around the problem using a BlackBerry's removable media card, but only if a user has configured their smartphone in a certain way. In order for Elcomsoft's software to be successful, a user must have enabled the feature to encrypt data on the media card.
Related Articles on Techworld
The feature is disabled by default, but Elcomsoft said around 30 percent of BlackBerry users have it enabled for extra security.
The company's software can then analyse the encrypted media card and use a brute force method to figure out a password, which involves trying millions of possible password combinations per second until one works.
Elcomsoft said it can recover a seven character password in less than an hour if the password is all lower-case or all capital letters. The software does not need access to the actual BlackBerry device but just the encrypted media card.
The new feature is wrapped into Elcomsoft's Phone Password Breaker. It costs £79 ($123) for the home edition and £199 for the full-featured suite, which can also recover plain text passwords used to access encrypted backup files for Apple's iPhone, iPad and iPod Touch devices. To crack those passwords, a user does need to have the Apple device in hand.
The BlackBerry password recovery feature is only available in the professional edition. Elcomsoft has published a chart comparing the two versions.
The backup files contain sensitive data including call logs, SMS archives, calendars, photos, email account settings, a person's web browsing history and more.
Elcomsoft reserves some of its password cracking software strictly to vetted law enforcement, such as its iOS Forensic Toolkit, which can extract passwords and decrypt a device's file system.
