Feeds

'New' Canadian BlackBerry security scare emerged in 2011

Hypegasm points to crisis for democratic process, not deadly new flaw

Providing a secure and efficient Helpdesk

Reports that Canada has just awakened to the perils of BlackBerry PIN-to-PIN messaging in government should be taken with a pinch of salt – the nation knew about the problem back in 2011.

PIN-to-PIN messages take advantage of the fact that every BlackBerry device is issued with a unique eight-digit PIN. If a BlackBerry user shares their PIN, it is possible to send messages to their device.

The PIN-to-PIN FUDgasm started on Wednesday, Canadian time, when Canada.com revealed the contents of a memo it obtained from Public Safety Canada (PSC), the nation's emergency management and crime prevention agency, after a freedom of information request.

The site's report says that PSC's internal memo was updated in January 2013 to say, "Although PIN-to-PIN messages are encrypted, they key used is a global cryptographic 'key' that is common to every BlackBerry device all over the world." That's worrisome, PSC says, as lots of politicians and public sector employees use BlackBerries.

Cue the usual ripple effect, with articles aplenty reporting a terrible security flaw, often with overtones that Canada, home of BlackBerry, has turned against its own progeny.

What's not often pointed out is that Canada's government has known about this issue since March 2011, when this piece of advice from Communications Security Establishment Canada (CSEC) hit the web. CSEC is Canada's "national cryptologic agency" with responsibility for "foreign signals intelligence in support of defence and foreign policy, and the protection of electronic information and communication."

CSEC's analysis of PIN-to-PIN messaging is extensive. Here's an excerpt:

PIN-to-PIN is not suitable for exchanging sensitive messages. Although PIN-to-PIN messages are encrypted using Triple-DES, the key used is a global cryptographic "key" that is common to every BlackBerry device all over the world. This means any BlackBerry device can potentially decrypt all PIN-to-PIN messages sent by any other BlackBerry device, if the messages can be intercepted and the destination PIN spoofed. Further, unfriendly third parties who know the key could potentially use it to decrypt messages captured over the air. Note that the "BlackBerry Solution Security Technical Overview" document published by RIM specifically advises users to "consider PIN messages as scrambled, not encrypted".

The agency's recommendations about the messaging tool suggest "For departments with specific requirements for PIN-to-PIN messaging (e.g. emergency communications), it is recommended that a clear policy on the use of PIN-to-PIN messaging be put in place" and detailed security mitigation actions be undertaken.

The document is dated March 2011, which means Wednesday's "revelations" about PSC waking up to the potential horrors of PIN-to-PIN messaging are scary, but only inasmuch as they show the agency has taken nearly two years to heed advice from the CSEC. Either that or the PSC came to its conclusions independently, which is just the kind of wheel-reinvention that makes parliamentary democracy such an excellent system of government. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Same old iPad? NO. The new 'soft SIMs' are BIG NEWS
AppleSIM 'ware to allow quick switch of carriers
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Brits: Google, can you scrape 60k pages from web, pleeease
Hey, c'mon Choc Factory, it's our 'right to be forgotten'
Of COURSE Stephen Elop's to blame for Nokia woes, says author
'Google did have some unique propositions for Nokia'
It's even GRIMMER up North after MEGA SKY BROADBAND OUTAGE
By 'eck! Eccles cake production thrown into jeopardy
Mobile coverage on trains really is pants
You thought it was just *insert your provider here*, but now we have numbers
Don't mess with Texas ('cos it's getting Google Fiber and you're not)
A bit late, but company says 1Gbps Austin network almost ready to compete with AT&T
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.