BlackBerry purportedly sending users' email credentials in cleartext

Share this article:
BlackBerry 10 users email credentials are being sent to server belonging to the mobile manufacturer.
BlackBerry 10 users email credentials are being sent to server belonging to the mobile manufacturer.

Upset that BlackBerry has yet to address a potentially major security and privacy vulnerability in the email client of its latest version, a security company said Monday that it's fed up with the response and has notified federal authorities.

"Due to the severity of this issue, and the apparent lack of mainstream press, Risk Based Security has reached out to clients and some contacts, including the FBI, warning them of the potential privacy and security issue," the company said in a statement.

Roughly two weeks ago, German researcher Frank Rieger disclosed that email credentials are being sent to BlackBerry's developer, Canada-based Research in Motion (RIM), without consent or warning when a user enters their POP or IMAP email address into the standard BlackBerry 10 email client, known as Discovery Service.  

You should delete your email accounts from any BlackBerry 10 device immediately, change the email password and resort to use an alternative mail program like K-9 Mail (an open-source email client for Android),” Rieger wrote.

After tinkering with the device, he found that a Canadian server was connecting to his mail server and logging his credentials. He discovered that the server belonged to RIM.

“The client should only connect directly to your mail server and no one else,” Rieger wrote in a post, dated July 17. “A phone hardware vendor has no right to for whatever reason harvest account credentials back to his server without explicit user consent and then on top of that connect back to the mail server with them.”

A RIM spokesperson denied the existence of a "backdoor" and asserted in a statement to SCMagazine.com on Tuesday that BlackBerry's Discovery Service does not store email passwords. Credentials are only used to simplify the email set-up process, the company said in the statement, adding that users can go to advanced configuration to bypass the Discovery Service (and its terms and conditions) and set everything up manually.

But Risk Based Security, which sponsors the nonprofit data breach repository DataLossDB and the Open Sourced Vulnerability Database, said it's not buying that.

“This appears to be validation from RIM that credentials are sent and dodges the question of the default configuration sending in cleartext,” the company said, adding the problem is amplified by the majority of users who will turn to the Discovery Service to set up email and never be aware of the issue.

One of the bigger problems, Rieger discovered, is that users who have not enabled SSL/TLS encryption on their mail server will have their information sent to the RIM server in cleartext, meaning anyone with working eyes and access to the user or RIM network can easily steal the credentials.

Rieger reiterated that the issue is only about entering private IMAP or POP email credentials into the BlackBerry 10 Discovery Service and is not related to PIN messaging, push messaging or any other service where credentials are expected to be sent to RIM.

In the BlackBerry end-user/software license agreement, Risk Based Security points out, there is no mention that information will be sent to RIM or that users are responsible for such communications. RBS called the issue an “inexcusable vulnerability” and likened it to a vendor backdoor.

Share this article:

Sign up to our newsletters

More in News

Pentagon to triple its security workforce by 2016

Pentagon to triple its security workforce by 2016

Defense Secretary Chuck Hagel recently announced the recruitment efforts during a speech in Fort Meade, Md.

Tech manufacturer's online payment system breached

LaCie confirmed an unauthorized party used malware to access its online payment system for almost a year and could have stolen customer information.

The Heartbleed bug works, and could be a scapegoat for older breaches

The Heartbleed bug works, and could be a ...

Researchers proved the Heartbleed bug was real in a challenge issued by CloudFlare to prove private keys can be stolen, right around the time companies are claiming they were breached ...