A note on the security of code memo

ABSTRACT

Today, secret codes such as passwords and PINs are the most prevalent means for user authentication. Because of the constantly growing number of required secret codes, computer users are increasingly overtaxed. This leads to many problems in daily use, e.g., costs due to forgotten passwords in enterprises and security problems through bad password practice. Storing secret codes on mobile phones seems to be some kind of panacea to have secret codes always available since mobile phones are today's permanent companions. Code Memo is a software that is used on mobile phones to store secret codes in a safe way; it is provided as firmware on Sony Ericsson mobile phones. We assume that the intention of the Code Memo designers was to provide an ideal cipher system according to Shannon's classification, i.e., it leaves an adversary with uncertainty w.r.t. the correct decryption key. In this paper we show how to break Code Memo. For our attack, we have identified feedback channels in Code Memo that can be exploited for distinguishing correct master passwords from incorrect ones, and thereby, sieving candidates of master passwords. This weakness allows attackers in a realistic setting to identify the correct master password, and thus, to obtain all the stored passwords and PINs.

REFERENCES

• 1: P. Ducklin. Simple advice for more sensible password use. http://www.sophos.com, Apr. 2006.
• 2: Warren Harrison, Passwords and Passion, IEEE Software, v.23 n.4, p.5-7, July 2006 [doi>10.1109/MS.2006.110]
• 3: G. Hayday. IT users in password hell. ZDNet UK News, Dec. 2002.
• 4: G. Hayday. Counting the costs of forgotten passwords. ZDNet UK News, Jan. 2003.
• 5: SafeNet. 2004 Annual Password Survey Results. SafeNet (Inc.), http://www.safenet-inc.com, 2004.
• 6: C. Shannon. Communication Theory of Secrecy Systems. Bell System Technical Journal, 28(4), 1949.
• 7: Sophos. Employee password choices put business at risk. http://www.sophos.com, Apr. 2006.
• 8: J. VanAuken. Review: Password Management: Grief Relief. Information Week, http://www.informationweek.com, Jan. 2006.

INDEX TERMS

Primary Classification:
  E. Data
  E.3 DATA ENCRYPTION

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS

Keywords:
mobile applications, password management, security analysis