Nokia Gave In to Ransom Request

Status
Not open for further replies.

The Knight

Knight is coming
Forerunner
News has come to surface that Nokia paid several million euros towards the end of 2007 in an extortion incident, so that the blackmailer wouldn’t publish the Symbian encryption key.

The code was just a few kilobytes in size and was being used to make sure that only Nokia-signed applications could be installed on the phones.

An investigation team from Finnish MTV News revealed that the blackmailer demanded several millions of euros in exchange for the promise that the application signing code would not be put to bad use.

The Finnish company agreed to pay the ransom and alerted the authorities about the incident in the hope that the culprit would be caught and the matter solved.

Just like in a Hollywood movie, the ransom money was placed in a bag left in a parking lot, near the Särkänniemi amusement park in the Finnish city of Tampere.

However, it appears that the blackmailer was quicker than the eye and managed to make an escape with the millions of euros without the police being able to keep track of his movements.

“Then things went wrong. The blackmailer took the bag. Police, however, lost track of the blackmailer and the money was gone,” says the MTV News post.

The National Bureau of Investigation confirms that the case is still under investigation and the matter is treated as “aggravated extortion,” Detective Superintendent Tero Haapala told MTV News.

There is no information on how the blackmailer managed to get the encryption key, but if it had been used for malicious purposes it could have dealt an impressive blow to plenty of phone owners around the world, considering that at that time Nokia had around half the market share, other manufacturers relying on Symbian as well.

“Had the key been leaked, Nokia would not have been able to ensure that the phones accept only applications approved by the company,” notes MTV News.

Most security boffins agree that shelling out the money for ransom requests is not an advised course of action, because generally, there is no guarantee that the wrongdoers keep their end of the deal.

However, the advice comes in the case of ransom demands from malicious software attacking the computers and smartphones of the average user, who is usually asked to pay smaller amounts of money.

Ransom demands from cybercriminals have grown more frequent lately, as specifically crafted malware, Cryptolocker being among recent examples, comes with encryption capabilities aimed at data (images, videos, documents) stored on the affected devices.
 
This news would have created vibrant impact if it was leaked at that time itself. Now even if the key gets leaked, I doubt if it will affect a lot of margin as people have already shifted to Android, iOs and Windows platforms.

Yes, the key 'll certainly be of importance for somebody like me who still uses Symbian s60 but I keep modding my own firmware so not exactly interested. And geeks already use modded os or patched firmwares so the key 'll be useless to them as well.

Also, the blackmailer having the key will be least interested to leak it or sell it elsewhere. As its just a key and not the code of whole Symbian os where it would have really mattered. And as I said very less people use Symbian these days.
Also, its not revealed whether the key belongs to s40 or s60.
An os update will surely render the key useless, unless planned.
 
Anyway there was a certificate generator based on your phones imei . I would use it with my un modded firmware .With modded firmware this too was not required . Signed or unsigned could be used with modded roms .
 
Pragmatically, perhaps at that point in time, the Nokia executives thought that exposure of having the keys sold to a third party/ rival/ underground consortium would have created a larger liability on its head such as clean up, loss of reputation, investor anger, legal tangles etc., hence they would have considered it worth paying that amount.
 
Pragmatically, perhaps at that point in time, the Nokia executives thought that exposure of having the keys sold to a third party/ rival/ underground consortium would have created a larger liability on its head such as clean up, loss of reputation, investor anger, legal tangles etc., hence they would have considered it worth paying that amount.

They actually informed the police before making the payout. The police lost the criminals while chasing them...

http://www.bbc.com/news/technology-27909096
 
Status
Not open for further replies.