
Canadian Police Obtained BlackBerry’s Global Decryption Key - ghshephard
https://news.vice.com/article/exclusive-canada-police-obtained-blackberrys-global-decryption-key-how
======
tonyle
Lets break this down.

sms, not encrypted.

pin messages/BBM, "scrambled"

BBM protect, encrypted

BES (corporate device), encrypted with a key that BlackBerry is not suppose to
be able to access.

Originally bb devices could send messages to other bb if you knew their pin.
The data was compressed and encrypted, but a moot point since all bb devices
had the same key. Pin messages,BBM and their bis infrastructure was never
really considered secured, their main offering was BES with offered end to end
security.

I used the term scrambled since that was the term everyone was using years ago
since people get confused between encrypted, vs encrypted with shared key, vs
not encrypted, etc. It quickly becomes a pointless conversation.

As far as I'm concerned, This isn't really surprising if you think about it.
BlackBerry's only claim to security was BES for end to end communication.

~~~
x5n1
The take away from each one of these is that corporations can not be trusted
with your data not to divulge it to the government, or even to secure it well
enough that it is not compromised. However, most corporations do not have the
resources in terms of technical know-how and labor to do much better in terms
of not being compromised.

------
stygiansonic
It's worthwhile to note that John Chen called out Apple for refusing to unlock
an iPhone for the US government. (No, not the San Bernardino one, but a
different one in a criminal case; I believe Apple has unlocked iPhones in
other cases though.)

Quote: " _In fact, one of the world’s most powerful tech companies recently
refused a lawful access request in an investigation of a known drug dealer
because doing so would “substantially tarnish the brand” of the company. We
are indeed in a dark place when companies put their reputations above the
greater good._ "

I guess it depends on your definition of "the greater good".

[http://blogs.blackberry.com/2015/12/the-encryption-
debate-a-...](http://blogs.blackberry.com/2015/12/the-encryption-debate-a-way-
forward/)

------
ghshephard
Some pretty epic parts coming out of this story, if even _half_ of it is true:

 _" Rouleau even admitted to the judge, during one ex parte hearing, that his
own phone would be vulnerable to the type of intrusion the RCMP used on the
targets of the investigation.

"I'm a dead chicken. That's the reality of it, that's what we don't want the
general public to know," Rouleau said."_

------
kstrauser
CEO John Chen earlier said this about BlackBerry security (at
[http://crackberry.com/john-chen-discusses-blackberry-
securit...](http://crackberry.com/john-chen-discusses-blackberry-security-and-
e-mail)):

> There have been a number of news articles over the past few months
> speculating that BlackBerry technology may have been deployed in a non-
> approved manner, placing sensitive government information at risk. While I
> cannot comment or speculate on those news stories, _or the extent to which
> any vulnerable non-BlackBerry components may have been involved_ , I do want
> to reiterate the security technologies that BlackBerry provides to millions
> of government and enterprise customers around the world.

New BlackBerries are based on Android now. I'd venture that 95% of a new
BlackBerry is made of non-BlackBerry components. I find it interesting that he
carefully disclaims any vulnerabilities that might have been found and
exploited in that 95%.

I don't have anything particularly against BlackBerry. I wish they'd get their
act together and do well so we can have more competition and innovation in the
cell phone market. However, I wish we'd put that whole "BlackBerry is secure"
trope to rest because that doesn't ring remotely true to my ears.

~~~
neurobuddha
Blackberry deserves props for experimentation and their surprising good OS 10,
but if Priv is shorthand for privacy, then that's veering close to dishonesty.

Darn happy with my Passport though.

~~~
Silhouette
_...if Priv is shorthand for privacy, then that 's veering close to
dishonesty._

I remember one experience very clearly from when the Priv first entered the
market. I looked through the related web pages, curious about where Blackberry
was going. I found plenty of marketing around tools that would notify you if
various things went wrong in terms of privacy and security. However, I found
_literally nothing_ to state that the phone would actively prevent those
things from going wrong or check with the user before performing actions they
apparently considered significant enough to warn about. It was one of the most
marketing-heavy, content-light, non-committal product sites I've seen in a
long time.

Until today I don't think I've been there again. After reading the initial
marketing, I just assumed the phone wasn't actually going to be significantly
more secure or private than anyone else's or they'd have told us how it was
instead of skirting around it repeatedly for the entire site. In fact, if
memory serves, it was at the time based on a version of Android that predates
some significant improvements in terms of app permissions and locking down
what they can do, suggesting that contemporary models from competitors that
used a later version of Android would actually have been much better than the
Priv in at least some areas of security and privacy.

------
peeters
What am I missing? When I Google "blackberry pin to pin encryption" , the
first result is this article:

> Canadian government warns BBM PIN-to-PIN messaging is ‘most vulnerable
> method of communicating on a BlackBerry’

[http://bgr.com/2013/02/27/blackberry-messenger-security-
vuln...](http://bgr.com/2013/02/27/blackberry-messenger-security-
vulnerability-346634/)

> Canadian government agency Public Safety Canada, which is tasked with
> overseeing cyber-security across all federal departments, has issued a memo
> warning government workers that communicating using BlackBerry Messenger
> PIN-to-PIN messaging is “the most vulnerable method of communicating on a
> BlackBerry.” ... According to the memo, PIN-to-PIN messages sent via
> BlackBerry Messenger could be intercepted and read by any BlackBerry user
> anywhere in the world. ... “Although PIN-to-PIN messages are encrypted, they
> key used is a global cryptographic ‘key’ that is common to every BlackBerry
> device all over the world,” Public Safety Canada official stated in the
> memo. “Any BlackBerry device can potentially decrypt all PIN-to-PIN messages
> sent by any other BlackBerry device.”

Why is there any surprise then that the RCMP has capability to decrypt it?

------
jlgaddis
Assuming this is all true -- and I think the article puts forth some
compelling evidence that it is -- I don't think it's a stretch to assume that
the U.S. (and the three other "Eyes") also have access to this key.

------
joesmo
There is no way this key is not already in someone's hands who is not supposed
to have it. There is no way it wasn't leaked, stolen, misplaced, or sold (for
probably a ton of money).

Who is going to trust Blackberry now? Even as a BB Enterprise customer, I'd be
scrambling right now to change my system immediately. This is exactly what I
expect will happen to the whole industry if idiotic bills like the one
currently proposed by Senator Feinstein make it through. No sane, security-
minded person will want to use any of these products. And there certainly is
no shortage of foreign competition. But it's all worth it to calm down the
cowardly masses who are afraid of terrorism or whatever the fear of the day
might be, right?

------
pritambaral
Just an example of why closed security systems are inherently not secure.

EDIT: Of course, I also mean the closed possession of private keys.

~~~
criddell
Even if it were open, how would you know the key had been obtained by a third
party?

~~~
pritambaral
By 'closed', I also meant that the key was in proprietary possession.

If it were open, one could check and ensure private keys were never under the
possesion of a third-party.

------
ghshephard
This story doesn't make any sense at all. Surely Blackberry isn't stupid
enough to use a "single encryption/decryption key" for all their messages.

~~~
jlgaddis
The linked article on Motherboard [0] expands on this a little bit:

> _BlackBerry (formerly RIM) encrypts all messages sent between consumer
> phones, known as PIN-to-PIN or BBM messages, using a single “global
> encryption key” that’s loaded onto every handset during manufacturing. With
> this one key, any and all messages sent between consumer BlackBerry phones
> can be decrypted and read. In contrast, Business Enterprise Servers allow
> corporations to use their own encryption key, which not even BlackBerry can
> access._

[0]: [http://motherboard.vice.com/read/rcmp-blackberry-project-
cle...](http://motherboard.vice.com/read/rcmp-blackberry-project-clemenza-
global-encryption-key-canada)

~~~
ghshephard
Right - that's the part that I have a really hard time believing. Even having
a single decryption key _per device_ seems insane - isn't it pretty standard
practice to frequently rotate your session key? I'm wondering if this was
something that Blackberry was doing back in the early 90s, and, as the state
of the art advanced, they never upgraded their systems.

It really sounds terribly insecure to me.

~~~
coldcode
How are these people still in business?

~~~
elthran
Corporate inertia mostly

------
Scoundreller
Cracking Blackberries isn't unknown for RCMP:

From:
[https://www.canlii.org/en/ns/nssc/doc/2016/2016nssc7/2016nss...](https://www.canlii.org/en/ns/nssc/doc/2016/2016nssc7/2016nssc7.html)

" On June 24, 2014 the RCMP advised in writing that their crime lab required
another two to three months to crack the BlackBerry."

&

"The Crown could not disclose the contents of the BlackBerry until they were
able to crack it. Once cracked, there was no relevant evidence on it to
disclose."

------
tptacek
This is just PIN-to-PIN messaging, right? Isn't PIN-to-PIN sort of morally
equivalent to GSM encryption?

------
walrus01
I would be surprised if CSE and CSIS don't have their own staff embedded
inside Blackberry, either with or without the company's knowledge. They don't
have nearly the budget that NSA does but they're not stupid.

------
jasonjei
Wasn't Obama using a Blackberry device a few years ago? Granted the device he
was using was likely hardened, but still raises interesting questions.

~~~
peeters
What interesting questions does it raise?

~~~
jasonjei
Whether or not his phone is compromised from BlackBerry's key being available
to governmental authorities, even those outside the US.

~~~
dmix
Canada/CSEC works directly with the NSA. So I'm sure they are aware of
Blackberry's vulnerabilities. Same with GCHQ and New Zealand. I believe the
DoD complained about having to secure his Blackberry when he insisted on using
it over their standard Android devices.

