BlackBerry reported to FBI over potential privacy and security issues

Share this article:
BlackBerry aims to satisfy work/life balance with Balancer in BB10 and Z10
BlackBerry aims to satisfy work/life balance with Balancer in BB10 and Z10

Researchers say a vulnerability in BlackBerry 10 meant user email credentials were sent in clear text, a claim developer RIM denies.

German researcher Frank Rieger said in a post that email credentials entered into the BlackBerry 10 email Discovery Service would be sent to RIM Canada servers in clear text if forced SSL was not enabled in mail servers.

“BlackBerry thus has not only your email credentials stored in its database, it makes them available to anyone sniffing in between,” Rieger said.

“The client should only connect directly to your mail server and no one else.”

Security firm Risk Based Security reported the flaws to US authorities and criticised RIM for not fixing the purported flaws. “Due to the severity of this issue, and the apparent lack of mainstream press, Risk Based Security has reached out to clients and some contacts, including the FBI, warning them of the potential privacy and security issue,” the company said in a statement.

RIM denied the existence of a “backdoor”, a term slapped on the vulnerability by Risk Based Security, and asserted in a statement to SC Magazine that BlackBerry's Discovery Service does not store email passwords.

It said credentials were only used to simplify the email set-up process adding that users could go to advanced configuration to bypass the Discovery Service (and its terms and conditions) and set everything up manually.

Yet Risk Based Security, which sponsored the non-profit data breach repository DataLossDB and the Open Sourced Vulnerability Database, hit back at RIM's claims.

“This appears to be validation from RIM that credentials are sent and dodges the question of the default configuration sending in cleartext,” the company said, adding the problem is amplified by the majority of users who will turn to the Discovery Service to set up email and never be aware of the issue.

Rieger reiterated that the issue is only about entering private IMAP or POP email credentials into the BlackBerry 10 Discovery Service and is not related to PIN messaging, push messaging or any other service where credentials are expected to be sent to RIM.

BlackBerry's end-user software license agreement did not mention information would be sent to RIM, Risk Based Security said.

Share this article:

SC webcasts on demand

This is how to secure data in the cloud


Exclusive video webcast & Q&A sponsored by Vormetric


As enterprises look to take advantage of the cloud, they need to understand the importance of safeguarding their confidential and sensitive data in cloud environments. With the appropriate security safeguards, such as fine-grained access policies, a move to the cloud is as, or more, secure than an on-premise data storage.


View the webcast here to find out more