Comments on: CRAZY! Furious Gold Lets You Change & Clone A BlackBerrys IMEI, PIN, or ESN Along With Unlocking It!

By: Michael

Michael — Fri, 20 Feb 2009 15:10:39 +0000

That furious gold software, I’m curious about it since I would consider doing this for all the old BB’s my friends and I have to get them unlocked and sell them.

By: Sith_Apprentice

Sith_Apprentice — Fri, 20 Feb 2009 11:49:01 +0000

Only the second device is disabled on the NOC. I have cloned my devices, both active and older, and kept them active for over 60 days. The second device never acquired a connection.

By: Victor

Victor — Fri, 20 Feb 2009 10:24:40 +0000

we here in indonesia sells 2 types of blackberry. The one with pin and imei or the one without(blocked or came without pin or imei) which is sold less that 50% retail price apparently its a black market product. So if u didnt have the money and u needed a pin and imei, phone shops here will charge u about USD 150.00 to give u a pin and imei for your handset regardless its blocked or locked.Funny thing is what bout the person that orignaly bought the phone with the pin and imei? who do they go to ? and what i heard is u cannot have the same pin and imei in the blackberry server as they will be both blocked by blackberry

By: Sith_Apprentice

Sith_Apprentice — Fri, 20 Feb 2009 04:56:45 +0000

IMEI cloning can still be done, but the NOC itself will reject the data. As to those in SE Asia with BBs unable to be registered, this is likely blacklisted PINs or devices that are reported stolen. When RIM blacklists a PIN you can still use carrier data (much like the “cloned” device) but you wont get BB data. The hard coded value can be viewed by users by certain tools, but cannot be changed. There are many other tools that RIM has that allow this to be written once during the construction process.

By: Sith_Apprentice

Sith_Apprentice — Fri, 20 Feb 2009 04:26:38 +0000

The Cloning tool doesnt work for BBs. There is another piece of information (3 total) that is needed to authenticate to the NOC. If your phone hasnt been “seen” by any network, it is not because of the RIM NOC itself. The NOC will ONLY prevent you from getting BB data, not voice/carrier data. I have gone very high up in RIM with this information months before this story was posted. I have been to several facilities where this was demonstrated. It is not security by obscurity, there are many other factors that are used for security.

By: Sith_Apprentice

Sith_Apprentice — Thu, 19 Feb 2009 23:52:31 +0000

Cloning the pin wont do anything, the device wont get EDGE/3G, just edge.

By: Luciano

Luciano — Thu, 19 Feb 2009 23:40:17 +0000

Bah, humbug. You’re backing out on this? Removing the links won’t hurt, but certainly doesn’t help either. What Richard wants is what RIM has been giving: security by obscurity.

“Oh yeah, the real bad guys don’t know where to find that kind of stuff. They need help from BerryReview to find it. So let’s not divulge the links!”

Give me a break.

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 23:12:21 +0000

Richard,
I removed the links due to your concerns. I doubt it will change anything. It would be like somebody not linking to thepiratebay. Not linking to it will not make thepiratebay disappear. On the other hand I cant see it hurting. I am not here to promote Furious Gold.

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 23:08:30 +0000

Richard I hope you are not taking this personally I have no intention of hurting your feelings. We just respectfully disagree on this point.

As for your first point. Jailbreaking is illegal according to Apple but that has yet to be decided: http://www.macnn.com/articles/09/02/13/apple.jailbreaking.stance/

Filesharing is also illegal. Pirating software is also illegal. Has that stopped practically every blog from mentioning it? That argument just does not hold water with me. Newspapers report about illegal activities every day. That is what we call news. I would consider it my duty to report to our readers that such illegal activity is a threat to them.

As I said sticking your head in the ground will do no good. Just because there may be nothing RIM can do about it does not mean the problem will go away. I do not want a false sense of security. People freely give away their PIN numbers now. This needs to stop with such a tool available. The only way it will stop is if people know that they need to keep that number private. Now it is like people are posting their social security numbers online. (on a more minimal scale)

The fact that nobody else mentioned it is not my problem. They choose what they want to publish and that is their discretion. I don’t see the point in removing a link when a 12 year old could find it within 5 minutes on Google. I repeat again. Ignoring a problem does not make it go away.

What I expect RIM to do is at least harden their future devices so that this is no longer possible. They would not do this if they do not know about the threat. They have made no statements and this software has been out for months. They have done nothing to protect their customers from this threat. I love RIM but they definitely should be warning their customers about protecting their BlackBerry PIN. This is just careless on their part.

By: Richard Heratland

Richard Heratland — Thu, 19 Feb 2009 22:44:08 +0000

No Ronen, you are completely wrong with your logic. Jailbreaking and unlocking an iphone IS NOT against the law. It just voids you warranty. But cloning an IMEI is against the law. You shoulnt have mentioned it here. Also, wouldnt you agree that more people know berryreview than some Chinese site? even if they offer maintenance in the states, you are letting the whole community know about this, those sites are obscure and hard to find. None of the other blogs covered this for a reason. How do you expect RIM to fix this? Recall every blackberry sold since the 7290? come on Ronen. you know you did this to get hits and not as a warning for potential harm. Couldnt you have run this story with no links or name of the product?

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 18:29:28 +0000

If they are breaking the law then why is RIM not stopping them? If the threat exists why has RIM never mentioned it? Security by obscurity used to work for RIM. I am just trying to point out that this is no longer obscure!

According to the same logic news sites should also not mention iPhone jailbreaking since that is also against the law. I am a security buff and I believe that publicizing a security issue is the fastest way of having it corrected. Sticking your head in the ground accomplishes nothing. For example the Android root access security issue was publicized for all and it was fixed within days!

Even if this site is in China they are selling to every country in the world. Their site is not some obscure shop. They even have maintenance contracts and support!

By: Richard Heratland

Richard Heratland — Thu, 19 Feb 2009 18:20:40 +0000

This was very much in poor taste Ronen. You are giving ideas to people who will potentially break the law due to seeing this. I agree its out there, but at the end of the day its a lot harder to find some site in china that sells this as opposed to berryreview thats read everyday by people. This was in very bad taste. never should have been published. this is a very bad day for you guys….

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 15:29:39 +0000

@Michael
What software cant you find?

By: Michael

Michael — Thu, 19 Feb 2009 15:23:30 +0000

Yet for some reason I can’t seem to find that software anywhere on their site.

By: Luciano

Luciano — Thu, 19 Feb 2009 10:03:43 +0000

Please enlighten us, BB. If everything happens the way you just described, what makes you so sure that the crook is the one who will get kicked off and not you, the legitimate owner?

What about me? I have now a BlackBerry that is not being used. It hasn’t been “seen” in any network for more than two weeks and should remain that way for some more time. If its PIN gets cloned while it is not in use, then later I decide to use this device again, what assurance do I have that I will not be treated like a thief and get kicked off because there has been an identical (cloned) PIN/IMEI combination in use elsewhere for some time?

By: BB

BB — Thu, 19 Feb 2009 08:12:23 +0000

Once RIM’s infrastructure detects a duplicate PIN and IMEI you get kicked off anyway, so while you could change your PIN and IMEI to mine, you can’t do anything with it and there are no implications for me – so there is no risk at all.

Take your tinfoil hats off.

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 04:17:08 +0000

True but whats the point? I think the link and the software is what make this threat so real. This is publicly available COMMERCIAL software that has been around for awhile now. Its not some obscure thing that only super secret spies know about!
They even have registered resellers in the United States
http://www.gounlock.com/details.php?itemId=2404
Its like RIM is totally ignoring the fact that this exists. Forget public interest I am trying to highlight that anybody with a few hundred bucks can clone your PIN! It sure scares me…

By: Andy

Andy — Thu, 19 Feb 2009 03:44:34 +0000

Yes, but mentioning the actual software by name, and even linking to its web page is not productive. You could have shown the screenshots blurred suitably over the name, but not name the software or where it can be obtained from. That would have covered the public interest angle.

By: Luciano

Luciano — Thu, 19 Feb 2009 03:08:28 +0000

This is a disaster. Security by obscurity, that’s what RIM has been selling us.

Very drastic changes will be necessary in upcoming models lest RIM will lose even more credibility. I expect this kind of screwup from the iPhone, not from the BlackBerry.

By: Ronen Halevy

Ronen Halevy — Thu, 19 Feb 2009 03:01:31 +0000

Andy just because it is criminal does not mean we do not have the right to know that it exists. Just reading Mipacho’s story about how somebody cloned his PIN really shows that it is a security blockbuster. There is a reason people publicize security vulnerabilities AND possible criminal tools so that the general public knows that they exist.

In short ignorance is practically never bliss… RIM really needs to find a way to fix this or this could end up going over badly. Just imagine all of those PIN numbers just floating around on all the forums…

By: Andy

Andy — Thu, 19 Feb 2009 02:51:10 +0000

This is a phone cloning tool and it is illegal (criminal offense) in most countries. If you use this, expect a visit from the police.

I don’t think you should have published this.

By: Mipacho

Mipacho — Wed, 18 Feb 2009 21:36:18 +0000

Here’s a discussion of what happened to me after my BB Pin got cloned:

http://forums.crackberry.com/f83/duplicate-pins-156359/

By: oracle

oracle — Wed, 18 Feb 2009 20:23:52 +0000

in indonesia now is very popular by cloning the pin and be careful dont give your pin to someone you dont know

By: sdfsdf

sdfsdf — Wed, 18 Feb 2009 19:13:04 +0000

I think you should have been responsible and sent this to RIM first to get their response before posting it. I love my BB and I just don’t want to get hacked* by a bunch of Russian script kiddies.

By: pwn3D

pwn3D — Wed, 18 Feb 2009 18:56:22 +0000

I understand where you are coming from Ronen, expose the problem and force a fix from acknowledgment of it.

And while I can’t say for certain (much like yourself) what this is *exactly*, I can say that the functions of this shall we say GUI? Are the exact of the MMLMultiLoader with the unlock, debranding etc..etc functionality much like how MCP has the ability to load the MMLMultiLoader as well, if you have obtained it.

So way I see it, RIM will be going after these folks if possible as they don’t seem to be US or Canadian based on the sole fact that this GUI appears to be made up of components from the MMLMultiLoader tool.