Blackphone gets rooted at BlackHat security conference

There is nothing like calling out competitors in a race to win. It happens in just about every sport as well as other industries. Social media has enabled a whole new level of communication when it comes to proclaiming victory as well as setting the stage for utter embarrassment.

Blackphone is a venture by Silent Circle and Geeksphone, and it is designed to provide a suite of secure services running on a fork of the Android Open Source Project (AOSP). Called PrivatOS, it is meant to provide a consumer level access to secure options that protect personal data from being leaked to third parties.

The advent of seeing a device like the Blackphone come to market was in the wake of all the Edward Snowden shenanigans, so there was a receptive audience to the purported capabilities of this device. Of course, the Blackphone was not marketed as an “NSA-proof” device, but that became the running joke once it was unveiled at MWC 2014.

The dominant player in the smartphone security line is BlackBerry, a company that has taken great pride and strides to be the “truly secure” mobile platform for the enterprise and the company’s precious government customers.

So naturally, Blackphone and BlackBerry started kicking sand on to each other’s turf to talk about how awesome their own security features were. We are not going to re-hash that drama here, because @TeamAndIRC was able to root a Blackphone in less than five minutes at the BlackHat security conference.

Now before everyone runs away with that revelation, one of the vulnerabilities has already been patched, and it appears that the only other exploitable portion is possible with direct user permission. That did not stop a fair amount of poking a little fun at Blackphone though, “It is apparent that no one ran a [compatibility test suite] on this device.” Last time we checked, two-thirds of the exploit path had been given the Blackphone.

The crux of Blackphone’s security features do not lie solely within PrivatOS, as there is a suite of security applications that ship with the device too. However, it is not the greatest of feelings when that OS which all those apps and features work on was able to be “handled” so easily.

While that might seem like easy pickings for BlackBerry, @TeamAndIRC promise that BlackBerry is their next target, ribbing the gang in Waterloo by stating that BlackBerry security is “security by lawsuit.”

UPDATE: As we were following the ongoing conversation about @TeamAndIRC's accomplishment, it is evident that the root did not take less than five minutes.  Apparently that was a mis-quote from when someone thought they had five minutes left to complete the task.  So, the root did not take less than five minutes.  The team is still looking into the vulnerabilities they have found so far, with one portion still being examined and will be disclosed privately when fully understood.


sources: @TeamAndIRC via N4BB