Stolen Blackberry - Strange Results!!

[Jax2008]

This one is definitely for your BB experts out there...

One of our users left the organization and turned in his Berry 9000. I removed him from the BB Pro server and deleted his Exchange account. I also cancelled the cell # with AT&T..

This device was stolen last week. Because it was deleted from the Pro server, I cant do a wipe and disable (as far as I can tell..not an expert). But here is the kicker...

Whoever stole it, his/her contacts are synching with a user that is part of my BB Pro server! This user called me today stating that all of his contacts were gone, but there were a whole bunch of new contacts he had no idea where they came from. His calendar appointments were also gone. The only thing that did not appear to touched was his e-mail.

The good news in this is that it helped us determine who took the phone. But my question for all of you is..HOW THE HECK THAT COULD HAPPEN?!?!

[GlenB]

I dont see how the BES could cause this if you deleted the BES user account.

Ask the user for an approximate date/time of when his contacts/calendar entries disappeared, then dig around in the MAGT and SYNC logs to see if there was any activity at that time.

My gut feel here is that something else caused the entries to disappear. Did the device has a secure password, is it possible the user stored his username and password for OWA on the device?

[Jax2008]

Thanks for the suggestion!

I went through the log files and could not find the PIN of the stolen Blackberry. So I know the sync'ing did not take place over the air.

The person we believe stole the device is an employee of the organization. If this person took the device and connected it to a system on our LAN (via USB), can anyone see a scenario in which the stolen device would sync with an incorrect Outlook profile? For example, the theif walks over to a system that is left logged in as Jane Smith. He plugs in the Berry and it syncs with Tom Jone's profile.

I've contacted Blackberry to get some answers or suggestions and all they can say is "it's impossible". Unfortunately, it is possible!

Any suggestions, ideas, wild theories would be helpful.

[GlenB]

If the person who stole it connected it to a desktop PC with desktop manager installed, desktop manager would attempt to communicate with the BES through the default MAPI profile, which would be the thiefs mailbox, not the original owner's, so I cannot see a mechanism within which the device would give access to the original user's mailbox.

I'm not doubting your description of events, but am pretty certain that this hasnt been done via the stolen device and BES.

[Jax2008]

Originally Posted by GlenB

If the person who stole it connected it to a desktop PC with desktop manager installed, desktop manager would attempt to communicate with the BES through the default MAPI profile, which would be the thiefs mailbox, not the original owner's, so I cannot see a mechanism within which the device would give access to the original user's mailbox.

I'm not doubting your description of events, but am pretty certain that this hasnt been done via the stolen device and BES.

Thanks..I'm not sure if I explained it right.

User Bob turns in his Bold because he's leaving. Bold is removed from BB Pro server and phone is disconnected with provider.

Suspected theif takes Bold. This person does not have an account on my network, no account on Blackberry Pro server and no cell phone provided by us.

User Frank calls and says his contacts have disappeared and have been replaced with contacts he does not recognize. These contacts are now on his Bold and in his Outlook profile. He does NOT use desktop manager for anything. I confirm that no one else in my organization has those contacts, to eliminate some type of Exchange issue pointing to the wrong account.

I identify some of the contacts that are now appearing in Frank's contacts as relatives of suspected theif.

Any ideas?

[CanuckBB]

Theif grabs the BB. Enters his contacts in it and then plugs in the BB through USB on Frank's computer. BB syncs with Exchange via the default MAPI profile.

Although I suspect that it should have added the thief's contacts to Grank and Frank's contacts to the BB.

[Jax2008]

Originally Posted by CanuckBB

Theif grabs the BB. Enters his contacts in it and then plugs in the BB through USB on Frank's computer. BB syncs with Exchange via the default MAPI profile.

Although I suspect that it should have added the thief's contacts to Grank and Frank's contacts to the BB.

Ok..but here is the monkey wrench..

If the suspected theif plugged the Berry into a system that did not have Desktop manager and was NOT logged in with Frank's profile, any idea on how/why it would sync with Frank's contacts/calendar etC?

[phantomsax]

What happened to the ex-employee, "Bob's" email address? Was "Bob's" account forwarded to "Frank" or did you possibly add "Bob's" address as an alias of "Frank's" account?

I have a possible theory but I need to know a little more info before I say it and look dumber than usual. I have seen some weird things when you remove a BBY from a BES without wiping it, but this takes the cake for sure.

[delsolracing]

As a BES admin I am curious about this. Anything ever get figured out??