McCain Campaign BlackBerry Sold Full Of Confidential Contact Data

Washington D.C.'s Fox 5 news bought a used BlackBerry from the McCain campaign as they shut down. The contents were surprising:

"When we charged them up in the newsroom, we found one of the $20 Blackberry phones contained more than 50 phone numbers for people connected with the McCain-Palin campaign, as well as hundreds of emails from early September until a few days after election night. "

Laptops were also sold, although no word has come out about remnant data on them. This once again points to the importance of wiping devices or destroying them. While destruction results in no residual benefit to the original owner, it can prevent data loss, which may save more money than the small gains from re-sale. In this case, a $20 selling point for the BlackBerries is likely far outweighed by the negative publicity and anger of those whose contact information was exposed.

How difficult is it to wipe a BlackBerry? In many cases, it is incredibly easy. For BlackBerries that have security set up, simply typing in the wrong password enough times will wipe them. Others, such as the 8800 series, have a simple wipe process:

1. Go to Options
2. Select Security Options
3. Select General Settings
4. Click the Menu key
5. Select Wipe Handheld
6. Click Continue
7. Type in the word blackberry

IPhone Pwnage and bypassing the security code

Wired's coverage of Jonathan Zdziarsk's IPhone hack which I mentioned the other day notes that the Pwnage tool can be used in combination with a custom firmware to access the phone without the code. While a local only exploit, it does give forensic investigators a potential way into locked phones without using any special hardware. O'Reilly's webcast of the event is not available yet.

Zdiarski also spoke about the cache retained for fade transitions on the phone. These leave remnant data, which can be recovered, and would show data that users might expect would not still reside on the phone - anything on screen when a transition was prepared would be recoverable.

This emphasizes the need for a secure erase capability on the phone - something that is obviously lacking in the current implementation.