I just got a very interesting question from a reader:
IT Nerd. The Quebec Police just announced that they arrested a bunch of accused members of the Mafia. This story from the CBC says that the police intercepted PIN to PIN messages as part of the investigation:
http://www.cbc.ca/news/canada/montreal/quebec-police-raids-target-31-alleged-mafia-members-1.2673070
I thought PIN to PIN messages were secure?
Thanks for the question. In short, they are secure but they can be snooped on. Here’s what BlackBerry themselves have to say on this from a technical paper on the subject:
By default, each device uses the same global PIN encryption key, which Research In Motion adds to the device during the manufacturing process. The global PIN encryption key permits every device to authenticate and decrypt every PIN message that the device receives. Because all devices share the same global PIN encryption key, there is a limit to how effectively PIN messages are encrypted. PIN messages are not considered as confidential as email messages sent from the BlackBerry Enterprise Server, which use BlackBerry transport layer encryption. Encryption using the global PIN encryption key is sometimes referred to as “scrambling”.
So in short, PIN messages are secure to a degree. But not totally secure. Which means that someone could get access to PIN to PIN conversations. If you want even more info on this, CSEC has a very detailed document on the subject that is very much worth reading.
So if we accept that they can be snooped on, it is conceivable that a search warrant from the Quebec Police was all that was needed to get access to these PIN to PIN conversations. This pretty much reinforces a core belief of mine. There’s no such thing as privacy anymore and nobody should expect otherwise.
Related
This entry was posted on June 12, 2014 at 1:05 pm and is filed under Commentary with tags BlackBerry, Privacy, Security. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Hey IT Nerd! Aren’t BlackBerry PIN Messages Secure From Snooping?
I just got a very interesting question from a reader:
IT Nerd. The Quebec Police just announced that they arrested a bunch of accused members of the Mafia. This story from the CBC says that the police intercepted PIN to PIN messages as part of the investigation:
http://www.cbc.ca/news/canada/montreal/quebec-police-raids-target-31-alleged-mafia-members-1.2673070
I thought PIN to PIN messages were secure?
Thanks for the question. In short, they are secure but they can be snooped on. Here’s what BlackBerry themselves have to say on this from a technical paper on the subject:
By default, each device uses the same global PIN encryption key, which Research In Motion adds to the device during the manufacturing process. The global PIN encryption key permits every device to authenticate and decrypt every PIN message that the device receives. Because all devices share the same global PIN encryption key, there is a limit to how effectively PIN messages are encrypted. PIN messages are not considered as confidential as email messages sent from the BlackBerry Enterprise Server, which use BlackBerry transport layer encryption. Encryption using the global PIN encryption key is sometimes referred to as “scrambling”.
So in short, PIN messages are secure to a degree. But not totally secure. Which means that someone could get access to PIN to PIN conversations. If you want even more info on this, CSEC has a very detailed document on the subject that is very much worth reading.
So if we accept that they can be snooped on, it is conceivable that a search warrant from the Quebec Police was all that was needed to get access to these PIN to PIN conversations. This pretty much reinforces a core belief of mine. There’s no such thing as privacy anymore and nobody should expect otherwise.
Share this:
Like this:
Related
This entry was posted on June 12, 2014 at 1:05 pm and is filed under Commentary with tags BlackBerry, Privacy, Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.