Security flaw in Utimaco Safeguard PDA

I was delighted when Utimaco (https://www.utimaco.co.uk/) announced that their latest version of Safeguard PDA would include PIM (E-mail, organiser etc) encryption for Windows Mobile 5 devices. As far as I am aware they are the first company to the market to offer this.

Unfortunately, from my experiences it seems that the product has a little way to go before it becomes really useful or even secure. Annoyances with the current version include the fact that it is impossible to uninstall the program short of performing a hard reset, furthermore, if you use your PDA for TomTom or other navigation aids, watch out, because even if you disable auto-lock in the settings the software ignores this and automatically locks your PDA after about half an hour.

Much more worrying than this though, it is possible to bypass the log on procedure altogether, here is how. This works when using the Dell Axim X51v PDA. I had PIM encryption turned on and no PrivateDisk volumes set up.

Log into the PDA as normal, now fill up all the available memory on the unit (not the storage card) an easy way of doing this is to use the recording option. Set the recorder going and leave it until all available memory on the PDA is used up. When this happens recording will stop and Windows will probably warn you that memory space is critically low.

At this point, wait until Safeguard locks the PDA and the Safeguard Authentication screen appears.

When this screen appears, try to authenticate, Safeguard PDA will reject your password even if entered correctly. Try it a couple of times to be sure that you entered it correctly and the software is rejecting it.

Now, perform a soft reset on the PDA. System will reset and instead of presenting the Authentication screen, it will present the Safeguard setup wizard and tell you that Safeguard is not yet configured.

Now Cancel the setup procedure. You are now given full access to the PDA including PIM without entering any password whatsoever. I have repeated these steps twice now and got into the PDA both times.

Of course I let Utimaco know about this problem immediately. In the meantime if you use safeguard be extra careful not to fill up your PDA's internal memory. Beware of any executables downloaded from the net or Bluetooth as these could exploit this flaw.

I'll blog again if I find out any more about this issue.