GCN LAB REVIEW

Crowbar cracks SD cards and retrieves data without a trace

ManTech's device is designed to be simple and fast at doing its one job — cracking passwords on MMC/SD cards

Crowbar by ManTech Pros: Easy to use, can set up password crack groups for greater hacking speed
Cons: Only works with MMC/SD cards
Performance: A
Ease Of Use: A
Features: C
Value: C
Price: $2,300

Sometimes breaking into a place requires a lock pick, and sometimes it requires a crowbar. In this case, the crowbar is not a chunk of steel but a handheld device used to crack even the most complex passwords.

There is one extremely effective way of breaking into a password-protected computer, especially one without a lockout timer or a security subsystem that looks for attacks: You simply need a program to perform a dictionary attack against the password, trying every possible word from the dictionary to see if any fit. You would be surprised at how many people use a big word like "disestablishmentarianism" and think that it can’t be hacked.

Sorry, but if it’s a real word, a dictionary attack will find it. If the dictionary attack fails, the next step is to try dictionary words with numbers after them, because a lot of people will use something like Password1 and think that the number makes them secure. It does, but only by a few seconds on a hack.

Barring that, there is the tedious process of trying every possible character and letter combination in existence. This will work eventually, though it might take hours or even days. These attacks can be stopped if a program is monitoring for too many log-in tries. But most handheld devices don’t have that protection, making them vulnerable to attack.

This review is not about how to lock down your handheld devices but how to break into someone else’s device. The Crowbar from ManTech looks like a rugged diagnostic tool but is actually a brute force cracking tool that can shred passwords surprisingly quickly. It’s so dangerous that the company only sells it to law enforcement officers and the military.

The Crowbar is both powerful and subtle. You can use it to crack security on a handheld device without alerting the owner that the device’s security has been compromised. The Crowbar also stores log-in information for the cracked handheld, so anytime you need to access the hacked device again, you can without going through the entire brute force process again, unless the user changes the password.

The Crowbar is a simple-looking device. It has a small LCD screen that emits no backlight — in case you are working quietly in the dark — and a single button control. It also emits no sound. The device is rugged on its own but also comes with a rubber case that provides extra protection.

There are two MMC/SD card slots in the top of the device. The first is for the user’s data chip. You will want to put a large capacity card in there because after you crack the suspect’s card, you can mirror all their data to your card. The second slot, which is outlined in red, is for the card you want to hack. This is a read-only slot, so there is no danger that the Crowbar will hurt the suspect’s chip or leave any trace behind.

When you insert the card you intend to hack, the Crowbar will give you general information about it. If it’s unlocked, you can copy all the files over to your data chip. If not, you will need to begin hacking operations. There is a default character set that the Crowbar will use, but if you know a bit about the person whose card you are trying to hack or the device itself, you can increase your odds a bit with Crowbar’s software. This step is optional.

You use the software to create special character sets. If the SD card you are hacking comes from a phone, for example, 90 percent of the time the password will involve the first set of characters on the phone pad. A user does not want to hit the number 2 on their dial pad three times to type in a “c” each time they turn their phone on. So you can set up a character set that only includes the letters that come up first on a phone keypad. The Crowbar will then try combinations of numbers, plus the letters a, d, g, j, m, p, t, and w in addition to the special characters * and # before moving on to the full default character set. Most of the time, you will get a hit in just a few seconds if you can customize your search sets that way.

If you don’t know anything about the device or the person, you can fall back on the alphanumeric character set. In our testing, simple passwords, such as “bud,” were found and cracked in less than a minute. Longer ones, such as "gumby12," took about 10 minutes. And really complex ones, such as "U*R~AqT2," took a couple of hours.

Once the hack was successful, copying the files to the other chip could also take nearly an hour, depending on how much data it was moving.

We generally liked using the device and our colleagues were amazed when we told them what their passwords were. But the Crowbar has several serious limitations. The biggest is that it only works with MMC/SD cards. Almost 80 percent of the BlackBerry users we asked to participate in the review did not have an SD card on their device. They simply used their SIM cards to store all their information.

And most phones don’t use SD or MMC cards. In fact, the biggest use of SD cards for most people is in their digital cameras. And almost no camera data cards have password protection because most cameras can't implement or recognize a password on a card. So despite working well, the Crowbar will have very limited use. The addition of a slot to read SIM cards and also perhaps a seven-in-one media reader would make the Crowbar invaluable to law enforcement, but it doesn’t have one now. We just can’t see paying $2,300 for a device with such a limited use, unless you specifically need to crack an SD card.

The Crowbar has a few minor problems, too, though ManTech could easily fix them. The first is that when a password is found on an SD card, it puts it on the screen in hexadecimal code. You either need to be able to read hexadecimal — don’t laugh, fellow reviewer Greg Crowe can do it — or use a translator to figure out that “70 61 73 73 77 6f 72 64” equals “password.”

In addition, I could imagine a situation in which a black ops team might have time to crack a password on a target device but not enough time to transfer hours' worth of files over to their card. It would be helpful if they could see the device password on the screen, then replace the card and use the password like an authorized user, getting only the data they need without downloading unimportant information.

Finally — and this is very minor — the device stays off unless a target chip is inserted. This is fine and saves the battery power of the two AAs for more important tasks. However, the Crowbar boots to a screen that basically states that only government agents are allowed to use the device. Then, when you push the control button to move past that, a ManTech flash screen appears, which slowly fades out. This entire process takes only about 15 seconds, but again, a rapid response team working covertly might want the device to work immediately without a ManTech commercial or government warning to slow them down. Seconds might count, so the company should streamline the boot process.

In the end, the Crowbar did exactly what ManTech said it would do. If you need to hack an MMC/SD card, this is a perfect tool. It has a few minor flaws and limited usage, which we feel makes it too pricey. But within those parameters, it works well.

ManTech Cyber Solutions International, 703-388-2169, cybersolutions.mantech.com

Reader Comments

Tue, Sep 1, 2009 DeExpress

While I would say it is possible because of the expense of the product, it is doubtful they would use rainbow tables for password hashes here. If you can insert the SD card, then the device can hit the front door as many times as possible without setting off any counter measures. To keep rainbow tables of all of the different type of message digest would be storage prohibitive even with the current low prices. It is more likely the storage they have is just for dictionary only based attacks, I’ll give them a point or two if they have dictionaries of more than one language. Once the dictionary attack has exhausted, it appears to go through a hybrid attack. The review doesn’t state that it goes beyond that, and I would say that this thing does not have enough horsepower to brute force before your children’s children are old and grey. Besides if this thing were able to compare hashes, since you already have stolen the card, why waste time comparing hashes when you can just overwrite it with one you know. Put it back in the device and use your new password to decrypt the contents? That’s of course assuming that the key and password are independent. (which I would surmise is highly likely, if they were together, your device would have to decrypt and encrypt every time you changed the password).

Fri, Aug 28, 2009 Ev1l Wrangler USA

Actually, in all likelihood this device accomplishes the password cracking chore using what are known as "rainbow tables". For the uninitiated (that means everyone without a clearance) rainbow tables are large data structures containing every possible permutation of a cryptographic key space. As technology has become less expensive, the traditional trade off between time and space (CPU cycles versus memory) has shifted to favor the latter choice. Therefore, rather than spending weeks or months performing huge numbers of mathematical calculations, it is more cost effective to pre-compute all of the possible encrypted passwords for a given password length, and then use the already encrypted password that you desire to crack to search through all those computed results for a match. Find the match, and you find the clear text password. Much faster, but it requires enormous amounts of non-volatile memory to store all of those precomputed passwords (which might explain the exorbitant cost of the device - or maybe it's priced high to keep teenagers from ordering one to try on their mom and dad's SD cards - dunno). I guess I won't bother to encrypt my mp3s on my SD cards now since the military and law enforcement who purchase this product now will have almost instance access to my music philes =;^)

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above