With BlackBerry reportedly hacked, is anything secure?
You have to wonder what level of encryption can withstand the brute-force computing power that is cheaply available today
Computerworld - Is anything secure anymore? The National Security Agency (NSA) leaks have produced a number of side effects. What we assumed was a safe form of communications is perhaps not so secure after all. The gold standard of secure mobile messaging, BlackBerry, may have been compromised!
Apparently, the NSA and Britain's spy agency GCHQ (and/or other governments/agencies) were able to hack into the BlackBerry streams of government officials attending a G20 summit in London. If true, this raises a bigger question: Is any encrypted communication safe anymore given the massive amount of brute-force computing power that can be applied to code-breaking and pattern recognition?
Low-cost GPUs (graphical processer units) that are being configured into massively parallel systems are far better at code-breaking than traditional CPUs. When the encryption algorithms were originally created, people reported it would take tens or hundreds of years in brute-force computing power to break them. But they never envisioned the relatively cheap, massively parallel systems available today using hundreds or thousands of NVidia or AMD GPU cores. These parallel processing machines are really effective at finding patterns and hence decrypting data streams. Indeed, some "researchers" have demonstrated ways of breaking the security of wireless transmissions like Wi-Fi, Bluetooth, etc.
Do we need to re-evaluate what secure mobile messaging is all about? For years, Research In Motion has said its BlackBerry system was secure. There's no reason to doubt that RIM is being honest when it confirms that there is no back door designed into its systems to allow decoding of user data streams. But that does not mean it can't be done by other means, perhaps by monitoring the data and then deciphering it, and not necessarily in real time. (Recording in real time than processing the data in massive supercomputing systems is common practice.) What may have taken tens or hundreds of years to brute-force when algorithms were designed may no longer be an accurate estimate for those players able to devote enough resources to their defeat. And the cost and availability of those resources is dropping rapidly.
So should organizations, even ones that believe they are highly secure (and perhaps even FIPS-compliant), assume they are safe? Should stand-alone or PC-installed encrypted storage devices be assumed unbreakable? Should highly encrypted mobile messaging be assumed unreadable by prying eyes? They're safe from most hacking, probably. From all hacking and various government agencies, U.S. and otherwise, not necessarily. Don't forget, Enigma, the most ambitious and secure "unbreakable" system of its day, was defeated.
The NSA disclosures should raise red flags. We are entering a new era of security where decryption of secure systems is something that can be accomplished on multiple levels and with relatively easily available technology. Mobile users with highly sensitive data should be concerned, both with mobile data transfers and also data at rest that may be stolen (e.g., while laptops remain in a hotel room and the owner goes out). There is no longer an absolute guarantee of confidentiality. This is not paranoia. Moore's Law's exponential expansion applies as well to the brute-force hacking of encryption as it does to other computing tasks.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Critical Role of Support in Your Enterprise Mobility Management Strategy Most business leaders underestimate the importance of tech support when they choose an EMM solution. Here's what to put on your checklist.
- Separating Work and Personal at the Platform Level: How BlackBerry Balance Works BlackBerry® Balance™ separates work from personal on the same mobile device, right at a platform level. Find out how it can work for...
- Protection for Every Enterprise: How BlackBerry Security Works Get an IT-level review of BlackBerry® Security, addressing data leakage protection, certified encryption, containerization and much more.
- Future Focus: What's Coming in Enterprise Mobility Management (EMM) Find out why Enterprise Mobility Management (EMM) solutions that are truly future-ready must be designed to enable Machine-to-Machine (M2M) capabilities and much more.
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Privacy White Papers | Webcasts