Crowbar cracks SD cards and retrieves data without a trace

Sometimes breaking into a place requires a lock pick, and sometimes it requires a crowbar. In this case, the crowbar is not a chunk of steel but a handheld device used to crack even the most complex passwords.

There is one extremely effective way of breaking into a password-protected computer, especially one without a lockout timer or a security subsystem that looks for attacks: You simply need a program to perform a dictionary attack against the password, trying every possible word from the dictionary to see if any fit. You would be surprised at how many people use a big word like "disestablishmentarianism" and think that it can’t be hacked.

Sorry, but if it’s a real word, a dictionary attack will find it. If the dictionary attack fails, the next step is to try dictionary words with numbers after them, because a lot of people will use something like Password1 and think that the number makes them secure. It does, but only by a few seconds on a hack.

Barring that, there is the tedious process of trying every possible character and letter combination in existence. This will work eventually, though it might take hours or even days. These attacks can be stopped if a program is monitoring for too many log-in tries. But most handheld devices don’t have that protection, making them vulnerable to attack.

This review is not about how to lock down your handheld devices but how to break into someone else’s device. The Crowbar from ManTech looks like a rugged diagnostic tool but is actually a brute force cracking tool that can shred passwords surprisingly quickly. It’s so dangerous that the company only sells it to law enforcement officers and the military.

The Crowbar is both powerful and subtle. You can use it to crack security on a handheld device without alerting the owner that the device’s security has been compromised. The Crowbar also stores log-in information for the cracked handheld, so anytime you need to access the hacked device again, you can without going through the entire brute force process again, unless the user changes the password.

The Crowbar is a simple-looking device. It has a small LCD screen that emits no backlight — in case you are working quietly in the dark — and a single button control. It also emits no sound. The device is rugged on its own but also comes with a rubber case that provides extra protection.

There are two MMC/SD card slots in the top of the device. The first is for the user’s data chip. You will want to put a large capacity card in there because after you crack the suspect’s card, you can mirror all their data to your card. The second slot, which is outlined in red, is for the card you want to hack. This is a read-only slot, so there is no danger that the Crowbar will hurt the suspect’s chip or leave any trace behind.

When you insert the card you intend to hack, the Crowbar will give you general information about it. If it’s unlocked, you can copy all the files over to your data chip. If not, you will need to begin hacking operations. There is a default character set that the Crowbar will use, but if you know a bit about the person whose card you are trying to hack or the device itself, you can increase your odds a bit with Crowbar’s software. This step is optional.

You use the software to create special character sets. If the SD card you are hacking comes from a phone, for example, 90 percent of the time the password will involve the first set of characters on the phone pad. A user does not want to hit the number 2 on their dial pad three times to type in a “c” each time they turn their phone on. So you can set up a character set that only includes the letters that come up first on a phone keypad. The Crowbar will then try combinations of numbers, plus the letters a, d, g, j, m, p, t, and w in addition to the special characters * and # before moving on to the full default character set. Most of the time, you will get a hit in just a few seconds if you can customize your search sets that way.

If you don’t know anything about the device or the person, you can fall back on the alphanumeric character set. In our testing, simple passwords, such as “bud,” were found and cracked in less than a minute. Longer ones, such as "gumby12," took about 10 minutes. And really complex ones, such as "U*R~AqT2," took a couple of hours.

Once the hack was successful, copying the files to the other chip could also take nearly an hour, depending on how much data it was moving.

We generally liked using the device and our colleagues were amazed when we told them what their passwords were. But the Crowbar has several serious limitations. The biggest is that it only works with MMC/SD cards. Almost 80 percent of the BlackBerry users we asked to participate in the review did not have an SD card on their device. They simply used their SIM cards to store all their information.

And most phones don’t use SD or MMC cards. In fact, the biggest use of SD cards for most people is in their digital cameras. And almost no camera data cards have password protection because most cameras can't implement or recognize a password on a card. So despite working well, the Crowbar will have very limited use. The addition of a slot to read SIM cards and also perhaps a seven-in-one media reader would make the Crowbar invaluable to law enforcement, but it doesn’t have one now. We just can’t see paying $2,300 for a device with such a limited use, unless you specifically need to crack an SD card.

The Crowbar has a few minor problems, too, though ManTech could easily fix them. The first is that when a password is found on an SD card, it puts it on the screen in hexadecimal code. You either need to be able to read hexadecimal — don’t laugh, fellow reviewer Greg Crowe can do it — or use a translator to figure out that “70 61 73 73 77 6f 72 64” equals “password.”

In addition, I could imagine a situation in which a black ops team might have time to crack a password on a target device but not enough time to transfer hours' worth of files over to their card. It would be helpful if they could see the device password on the screen, then replace the card and use the password like an authorized user, getting only the data they need without downloading unimportant information.

Finally — and this is very minor — the device stays off unless a target chip is inserted. This is fine and saves the battery power of the two AAs for more important tasks. However, the Crowbar boots to a screen that basically states that only government agents are allowed to use the device. Then, when you push the control button to move past that, a ManTech flash screen appears, which slowly fades out. This entire process takes only about 15 seconds, but again, a rapid response team working covertly might want the device to work immediately without a ManTech commercial or government warning to slow them down. Seconds might count, so the company should streamline the boot process.

In the end, the Crowbar did exactly what ManTech said it would do. If you need to hack an MMC/SD card, this is a perfect tool. It has a few minor flaws and limited usage, which we feel makes it too pricey. But within those parameters, it works well.

ManTech Cyber Solutions International, 703-388-2169, cybersolutions.mantech.com