Eavesdropping today's smartphones

There have been a number of countries, like UAE and India that have demanded access to encrypted communications of Research-In-Motion’s (RIM) BlackBerry smartphones. These efforts are misguided, and unfairly target RIM’s business.

Public key encryption

We need a quick primer on today’s encryption. We pick the standard scenario where Alice wants to talk to Bob, and Charlie is trying to listen in.

In the old days Alice had to get a ‘secret’ to Bob before they can chatter. This was vulnerable because there was always the possibility that Charlie could intercept that initial exchange.

Nowadays, public key encryption makes that unnecessary. Bob can publish a (large) number, in his newspaper, or on his business card. This Bob’s public key. If Alice uses some well-known, open-source software like GPG that even Charlie has, Alice can send a message to Bob that only Bob (with a second, private large number key) can decrypt.

Let us be clear. The code that does the encryption and decryption is open, available for inspection by Charlie, who may spend years with scientists and huge computers and will still never break the code. The secret to decoding the message is Bob’s private key, which he has never given to anyone.

Duality of the key pair

The two keys, Bob’s Private and Public key, are a dual - what is done by one can only be undone by the other. There are infinitely many of these key pairs, and when you need them they can be generated. The bigger these numbers are, the harder it is to decrypt. The numbers can be made up to any size.

They can be used for signatures too - Bob can create an email, and sign it -attach a (very big) number to that email created with his private key. Anyone, like Alice or Charlie, can verify that only someone with access to Bob’s private key could have ‘guessed’ the number Bob put at the bottom of the Email - proving that Bob wrote it.

Secure communication protocols

Public key encryption is at the cornerstone of SSL - the secure wrapper to a number of protocols - https:// that is used to access your banking website, ssmtp for email submission, and imaps for email retrieval to name a few. It isa very well studied mathematical science - we have a pretty good idea what America’s National Security Agency is able to do concerning cracking these protocols.

Blackberry phones

Research-In-Motion have two types of customers - corporate, and casual smartphone buyers that like the BlackBerry phone. For corporate customers, they install the BlackBerry Enterprise Server (BES) - a computer at their premises that interfaces to their corporate mail server and securely delivers the mail to the smartphone.

This traffic is encrypted at the BES (Alice), send over RIM’s network and the public phone network (Charlie) and decrypted on Bob’s smartphone

• using the private key that has never left the innards of his phone. RIM corporate clients know this, and that is why they buy RIMs devices.

Snooping traffic

The only way the message could be read by Charlie is if he installed snooping software on either the BES or the phone itself. UAE tried to install at the phone, but they were outed. RIM go into exhaustive detail on the steps used to generate and exchange the keys. If this process is followed nobody except that corporation can read those messages. Especially not Charlie, RIM themselves, or the UAE or Indian government.

With proper attention to detail, SSL protocols like SSMTP and IMAPS can be made just as secure, with no possibilities of eavesdropping. RIM has just come under the spotlight because its business model is based on this security. My Nokia E71 can access my mailserver, and the traffic between the two is secured as tightly as RIM’s service. What is different is that key management on my phone is too sloppy. A Corporate Nokia customer could request more restrictness.

BlackBerry Internet Service

The BlackBerry Internet Service is the service non-corporate individuals get if they just buy a BlackBerry at the corner store. Depending where that server is located, and who has access to it, will entirely determine the security of the service. If Charlie controls this server, then naturally Alice and Bob can expect no privacy.

If the UAE or India lean too hard on RIM, hard enough to either control the key generation process so private keys are revealed, or the numbers representing the keys are small enough to be broken by a large computer, or if either the BES or smartphone have spyware installed, there will no longer be any reason for corporates to buy their service, and RIM will go out of business in those markets.

Security-conscious Blackberry buyers will instead buy another smartphone, most of which (with attention to detail) can be made just as secure to eavesdroppers. The government will have gained very little in snooping on someone determined to keep their privacy.

Android

Furthermore, the new Google smartphone OS, Android, is open-source. Soon individuals or companies will be able to install their own version of the same encryption software RIM uses and neither their network provider, cellphone provider or government will be able to do anything about it.

Conclusions

Perhaps India and the UAE are just going after the conveniently-packaged security-in-a-box that the casual smartphone user has been able to buy in the BlackBerry brand - and they want to at least deny that to their perceived enemies. But it is a limited solution, will not stand the test of time, and unfairly targets one company - RIM.

As a user, don’t stand for this bullying by the governments. Take your privacy and security seriously. Hold companies like Yahoo and Google and Facebook and Twitter accountable for your privacy using their services, or use them understanding that it might be, and probably is, routinely snooped.