BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 08-07-2006, 11:57 AM   #1 (permalink)
New Member
 
Join Date: Aug 2006
Model: 7100T
Posts: 2
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default [2006-08-05] Blackberry a Juicy Hacker Target

Please Login to Remove!

Blackberry a Juicy Hacker Target

LAS VEGAS -- A computer security researcher says he's found an unexpected new path into company networks: the Blackberry.

Jesse D'Aguanno, a consultant with Praetorian Global, has developed a hacking program that exploits the trust relationship between a Blackberry and a company’s internal server to hijack a connection to the network. Because the data tunnel between the Blackberry and the server is encrypted, intrusion detection systems at the perimeter of the network won't detect the attack.

The technique is successful, D'Aguanno says, because most companies aren't equipped to detect someone trying to deliver an exploit from inside the network. It also works because few companies view the Blackberry as a plausible attack vector.

"Because it's a handheld device, most people don't think it's something that can actually harm the rest of your internal network," D'Aguanno said. "But a Blackberry is not your average handheld. It's not just a PDA that's connected (to your network) only when you're in the office. It's a code-running machine that's always on and always connected to your internal network and has direct access to whatever you give it access to. And most company architectures allow it unfettered access to everything on the internal network."

The program, called BBProxy, has to be placed on a Blackberry either physically or as a Trojan horse delivered by e-mail. Once installed, it causes the Blackberry to call back to the attacker's system in the background, opening a communications channel between the attacker and the company's internal network.

From there, safely behind the organization firewall, the intruder can scan for hosts with security vulnerabilities.

D'Aguanno said he'll release BBProxy for download in a week or so.

Given how ubiquitous the Blackberry is, it's an obvious target for attack, but few researchers have examined it for vulnerabilities. D'Aguanno says the attack could be prevented if companies built more secure architectures on the back end and tightened user policies so not just any user can install third-party code

"Securely deploying it shouldn't be that hard but there hasn't been a whole lot of documentation provided by (Blackberry maker) Research in Motion in the past on securely deploying the Blackberries."

D'Aguanno, who has met with Research in Motion about the issue, said the company posted two new documents on its website this week in anticipation of his presentation at the DefCon hacker convention here. The documents include instructions to customers for configuring a more secure architecture for Blackberry service.

Ironically, D'Aguanno's own Blackberry was stolen during a recent business trip in Paris.
Offline  
Old 08-08-2006, 03:50 AM   #2 (permalink)
BlackBerry Extraordinaire
 
BBAdmin's Avatar
 
Join Date: Feb 2005
Location: Port 3101.org
Model: .
Carrier: .
Posts: 2,492
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Has anyone actually found the documents on RIM's website for this?? If there's one thing RIM are deadful at doing, it's designing a decent website! I can't find these docs anywhere!!!!
__________________

Offline  
Old 08-08-2006, 09:16 AM   #3 (permalink)
Thumbs Must Hurt
 
PacketRat's Avatar
 
Join Date: Sep 2004
Model: 8900
OS: 4.6.1.206
PIN: 24AC9B18
Carrier: T-Mobile
Posts: 140
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I have looked and found no RIM documents.. I'm going to call them.
Offline  
Old 08-08-2006, 09:35 AM   #4 (permalink)
Talking BlackBerry Encyclopedia
 
udontknowjack's Avatar
 
Join Date: Aug 2004
Location: State of Confusion
Model: 9000
Carrier: T-Mobile
Posts: 483
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I may be wrong but I think these are the documents mentioned. They don't address this issue specifically but address how to securely deploy BES to be more protected.
Placing the BlackBerry Enterprise Solution in a segmented network (ie. Firewalling the different BlackBerry components)
Livelink - Redirection

Protecting the BlackBerry device platform against malware
Livelink - Redirection
Offline  
Old 08-08-2006, 10:12 AM   #5 (permalink)
BlackBerry Extraordinaire
 
BBAdmin's Avatar
 
Join Date: Feb 2005
Location: Port 3101.org
Model: .
Carrier: .
Posts: 2,492
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Here we go!!!

BlackBerry

Look at the 'malware' and 'segmented networks' documents
__________________

Offline  
Old 08-08-2006, 03:13 PM   #6 (permalink)
BlackBerry Extraordinaire
 
Soapm's Avatar
 
Join Date: Apr 2005
Location: The Mile Hi City
Model: 9780
OS: 6.0
Carrier: TMO
Posts: 2,790
Post Thanks: 3
Thanked 4 Times in 4 Posts
Default

Our company has MDS turned off. Hopefully this will not impact us???
Offline  
Old 08-09-2006, 08:37 PM   #7 (permalink)
Talking BlackBerry Encyclopedia
 
Join Date: Feb 2005
Model: 7280
Carrier: cingular, no wait, AT&T
Posts: 300
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by Soapm
Our company has MDS turned off. Hopefully this will not impact us???
It won't. MDS is what enables the corp lan access from the BB.
Offline  
Old 08-24-2006, 06:59 PM   #8 (permalink)
iPhone Convert
 
juwaack68's Avatar
 
Join Date: Oct 2005
Location: Tulip City - MI
Model: iP5
OS: 6.0.2
PIN: to beans
Carrier: I'm not
Posts: 13,875
Post Thanks: 3
Thanked 72 Times in 55 Posts
Default SMobile VirusGuard?

I just received (yet another) email about this from someone at our company - this time the Helpdesk manager. He actually forwarded a message to me from someone at Software Spectrum, and they claim they have software that can stop this type of virus attack. Anyone ever heard of SMobile VirusGuard? Here is a section of the email that was sent to me that references it:

Do third-party solutions exist that can protect against the vulnerability?
To our knowledge, the SMobile VirusGuard for BlackBerry from SMobile Systems is the only commercially available solution that offers immediate protection against the vulnerabilities. The SMobile VirusGuard stops malware and other threats at the handset, and allows users to continue to access the full functionality of their BlackBerry devices.

How much does the SMobile VirusGuard for BlackBerry cost?
SMobile VirusGuard for BlackBerry retails for $29.99 for a one-year subscription.


Curious to hear what others think about this......
__________________
No longer a BES Admin, but it was fun while it lasted!
Offline  
Old 08-31-2006, 07:40 PM   #9 (permalink)
Stuck In The '70's Mod
 
ndub33's Avatar
 
Join Date: Feb 2006
Location: The 'burbs east of Seattle.
Model: 9810
Carrier: T-Mobile
Posts: 7,599
Post Thanks: 0
Thanked 4 Times in 4 Posts
Default

My company has blocked all software downloads to our Blackberries until they can find some sort of specific solution to the hacking issues. I'm glad they are being proactive, but I miss being able to add a new theme or game when the mood strikes me.
__________________
1st Step in Troubleshooting: Do you have a BlackBerry Data Plan?
2nd Step in Troubleshooting: Pull the Battery.
Offline  
Old 11-14-2006, 11:51 AM   #10 (permalink)
No longer Registered.
 
Galvatron's Avatar
 
Join Date: Jul 2005
Location: Mesa Arizona
Model: 8800
PIN: 240582A8
Carrier: tmobile
Posts: 647
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I reda aboui danglo's article the technique is called "blackjacking".you can get BBproxy an see the slides. On his groups website google up "the tecklow group". It only affects you if you Use Bes he also recomends you keep the bes server Isolated on the network
Just keep the messecary prts oper an posobly keep iway fron a direct conection to the web you could run it throug a router or have the web server an the main network isolated from each other on of the common $istakes is some people run bes on the main server withe everything else.
Offline  
Old 11-15-2006, 08:00 AM   #11 (permalink)
BlackBerry Extraordinaire
 
blakeatl's Avatar
 
Join Date: Oct 2006
Location: Atlanta area
Model: 8100
OS: 4.5.0.102
Carrier: T-mobile
Posts: 1,686
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by Galvatron
I reda aboui danglo's article the technique is called "blackjacking".you can get BBproxy an see the slides. On his groups website google up "the tecklow group". It only affects you if you Use Bes he also recomends you keep the bes server Isolated on the network
Just keep the messecary prts oper an posobly keep iway fron a direct conection to the web you could run it throug a router or have the web server an the main network isolated from each other on of the common $istakes is some people run bes on the main server withe everything else.


BBSpell for you!
__________________
Build Your Business Even If You Are On A Budget.
Magnetic Sponsoring
Offline  
Old 11-29-2006, 02:39 AM   #12 (permalink)
New Member
 
breaker909's Avatar
 
Join Date: Mar 2006
Location: Chicago, IL
Model: 7100i
Carrier: NEXTEL
Posts: 14
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Interesting read thanks for the post.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright © 2004-2014 BlackBerryForums.com.
The names RIM © and BlackBerry © are registered Trademarks of BlackBerry Inc.