Criminals Remote-Wiping Cell Phones 191
An anonymous reader writes "Crafty criminals are increasingly using the remote wipe feature on the Apple iPhone and other business handsets, such as RIM's BlackBerry, to destroy incriminating evidence, the head of the UK's Serious Fraud Office Keith Foggon has warned. Foggon told silicon.com that the move away from PCs towards using mobile phones was causing a headache for crime fighters who were struggling to keep up with the fast pace of new handsets and platforms churned out by the mobile industry."
Re:Woah (Score:4, Informative)
what do they mean by irretrievable:
destroying the filesystem table? (easy to get the data back)
writing all bits to zero? (still retrievable)
writing over all bits with (psuedo-)random data? (aparaently this can be retrieved)
writing over all bits repeatedly?
Re:Woah (Score:5, Informative)
You have to use something like squid, but it's because of magnetic hysteresis. (I could explain, but Wikipedia is pretty acccurate.)
It's possible in theory, but in practice, it's technology that law enforcement doesn't have access to.
Re:Woah (Score:5, Informative)
For instance, say that anything above "0.5" (half of the full possible theoretical strength of the magnetic field there) is a 1, and anything below is a 0. Maybe, the drive would actually write "0.9", which would be correctly interpreted as 1. If that number was blanked, maybe it becomes "0.3"....low enough to be a 0, but maybe another detector could tell the difference and know what the original value was.
Re:Woah (Score:5, Informative)
Go to Options-Security Options-General Settings. Enable password and content protection. Set the security timeout and password attempts to your preference. Now, when the timeout expires (X minutes after you stop hitting buttons) or you hook it to a PC, it asks for a password. If someone types in the wrong password Y times (10 is default, but you can go lower), it forces a reboot, and scrubs down the memory, which takes 20 minutes to an hour.
To force the scrub, go to Options-Security Options-General Settings. Click the menu button, select "Wipe Handheld", type blackberry.
Send me a PIN message at 244EB7DA if you need a hand.
Re:Woah (Score:5, Informative)
PS: For remote wiping, you need to be on a BlackBerry Enterprise Server (BES), which usually means your BB is company-issued. If you need it nuked, call up your admin and ask him to trigger the remote wipe. Keep in mind that the BES can (and usually does) track anything and everything that happens on a BES-connected BB, so a wipe will do nothing to hide things from your company.
Encryption-Constitution. (Score:1, Informative)
"Nope, sorry, I plead the fifth."
The UK doesn't have the fifth.
Re:Woah (Score:5, Informative)
Modern hard drives pack bits *very* densely. The bits overlap by a large amount. The technology to determine whether a bit is 1 or 0 by calling everything above 0.5 a "1" is already necessary to read the bit *normally*. Writing random data to the drive is enough to make any active sectors unrecoverable.
However, modern drives have a huge count of spare sectors, and sectors get retired constantly, and there's no way to wipe those with normal reads and writes. So there's a random sampling of everything you've ever written stored in the retired sectors of a hard drive, and no in-band way to wipe those sectors.
The is why the government standard for hard drves that have ever contained classified information is to shred the hard drive so that the pieces fit through a 1mm sieve. Of course, in reality, the government is just as likely to sell the drives unwiped on Ebay, but that's bureaucracy for you.
Re:Data Recovery Much? (Score:3, Informative)
If you manually enable "Content Protection" on your BlackBerry, doing a Security Wipe will take on the order of hours, and will overwrite the data several times with different patterns to the point that it's not recoverable by anyone, even RIM (if you don't have that mode enabled, a Security Wipe will only erase user-specific information, and it would be relatively trivial to recover it).
If you're on a BES (meaning your BlackBerry was issued and is controlled by your workplace), your BlackBerry administrator can enable this setting without your input though an IT Policy, and can remotely initiate a Wipe/Shred from within the BES control panel.
Re:First POST (Score:5, Informative)
It was added as part of the 2.0 firmware upgrade.
http://www.apple.com/iphone/enterprise/ [apple.com]
eatures include:
* Push email
* Push contacts
* Push calendar
* Global Address List (GAL) support
* Certificates and identities
* WPA2/802.1X
* Enforced security policies
* Cisco logo More VPN protocols
* Device configuration
* Remote wipe
Re:Woah (Score:5, Informative)
Does anyone know, off-hand, a way to query a sata disk for at least a count of how many sectors have been re-allocated, if not an actual map of them?
In linux, you can use smartctl (from smartmontools, I think)-- /dev/sda, and look for "Reallocated_Sector_Ct" in the output.
smartctl --all
Re:We remote wipe our data in hands of criminals (Score:4, Informative)
Remote wipe is a feature of BlackBerry/BES and Windows Mobile/Exchange. No third-party software is needed, unless your phone isn't connected to a BES/Exchange server. When the phone receives the wipe signal, all data stored on the device will be wiped.
The iPhone has remote wipe, but I don't think it has encryption of any of the content stored on the device.
BlackBerry has content encryption and the latest Windows Mobile (6.1) has encryption for the entire user-writable storage area. The key is stored on the device, encrypted with a password. BlackBerry overwrites the key in RAM when the device is locked (that is, when the device is inactive for a certain amount of time or when it is placed in its holster); since WM's encryption operates at a lower level, the key does stay in memory while the device is powered on. Either way, cutting power to the RAM will erase the decrypted copy of the key. Both support encryption of storage cards as well.
As long as the device is set to automatically lock itself out and there is no way to bypass the lock screen [engadgetmobile.com], there's not a whole lot you can do to a fully encrypted WM6.1 device without resorting to a RAM attack [tgdaily.com] or finding a weakness in the implementation. Since the BlackBerry will erase the unencrypted copy of the key when the device is not active, it's secure against searching for the key in RAM, too.
Re:Encryption (Score:4, Informative)
Except that a Vermont judge recently ruled [cnet.com] that password(s) contained in one's head are protected under the 5th Amendment to the United States Constitution. [wikipedia.org] just like any other information in your head. It was discussed right here [slashdot.org] on Slashdot.
As for threatening law enforcement officers: say nothing, know your rights, and keep your cool. The law enforcement officer is NOT your friend and you shouldn't speak to them or answer their questions. You have a right to remain silent and you should use it. BTW every attorney that I have ever heard opine on the subject has said that it is better to say nothing than to answer some of the questions but not others. Don't let them scare you into giving up your rights with their Gestapo crap. Remember, if they are questioning you, especially if they are threatening, then there is NO way that you are NOT going to be held (i.e. arrested) for a while anyway until the matter either goes before a judge or they have to let you go (48 hours max w/out cause before any attorney can force them to let you out), so don't be dumb and tip your hand right at the start. Also, remember that if you ever get your equipment back then you can never use it or those passwords again (who knows what bugs they may have planted before releasing it back to you). You basically have to wipe and start over on new hardware.
Disclaimer: IANAL so if you find yourself in a situation like the one above find yourself one that you can trust and let them do the talking, but remember that the police are NOT your friends.
Re:First POST (Score:1, Informative)
White paper on date deleting & recovery (Score:3, Informative)
Since every time something like this comes out all kinds of FUD pops up about data erasure, etc...
A classic paper on secure data deletion & recovery:
http://www.cs.cornell.edu/people/clarkson/secdg/papers.sp06/secure_deletion.pdf [cornell.edu]
Enjoy