Security Researcher To Release Code That Could Help Exploit BlackBerry Security Flaw
But Research In Motion says the threat is overstated.
A security researcher next week plans to release code that could enable hackers to exploit the encrypted link between BlackBerry handhelds and servers to bypass gateway security and hit machines inside corporate networks.
BlackBerry maker Research In Motion (RIM) and its partners, however, say the risk is overstated.
At last week's Defcon security conference in Las Vegas, Jesse D'Aguanno, a consultant at Praetorian Global, a Placerville, Calif.-based risk management firm, showed how a hacking program he developed--called BBProxy--could allow an attacker to gain access to a company's internal network via the encrypted connection between a BlackBerry handheld and the Blackberry Enterprise Server (BES).
Security vendor Secure Computing on Tuesday warned companies that their BES deployments on internal networks could be vulnerable to a BBProxy attack. After manually installing BBProxy or getting a user to install it via an e-mail attachment, a hacker could piggyback the encrypted connection between the handheld and the BES and gain access to the internal network, according to San Jose, Calif.-based Secure.
However, the notion that BBproxy could be spread by e-mail without user interaction is misleading, said Scott Totzke, director of the global security group at RIM, Waterloo, Ontario. "Our attachment service doesn't work that way. You can send and view e-mail, but the BES system is designed to require users to manually download the application from a Web site," he said.
"[BBProxy] isn't a hacking tool. It's an application that runs on the BlackBerry and potentially does something malicious," Totzke added.
Although BBProxy may work in theory, RIM has addressed the issue of over-the-air or self-installing applications with the IT policy component of BES version 4.1, said David Bean, president of eAccess Solutions, a Palatine, Ill.-based RIM partner. BES 4.1 includes policies that can repel an attack by a self-installing or virus-infected file, but such policies must be set up and implemented by the server administrator, Bean added.
On its Web site, RIM has published documents that describe steps that companies can take to protect themselves from such an exploit. Those measures include segmenting networks and limiting third-party application access to the BlackBerry Enterprise solution.
Dan King, president of New West Technologies, a Portland, Ore.-based solution provider, said he thinks it's interesting that security researchers are announcing hacks before releasing them, which he said helps educate companies about the risks they take by not locking down their networks.
"Hopefully, companies will take the appropriate steps to make sure their data is not intruded on so that they are not enabling the proliferation of viruses and hacks by leaving their compromised systems open and on the Internet," King said.
IT's Reputation: What the Data SaysInformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business really views IT's performance in delivering services - and, more important, powering innovation. Our results suggest IT leaders should worry less about whether they're getting enough resources and more about the relationships they have with business unit peers.
What The Business Really Thinks Of IT: 3 Hard TruthsThey say perception is reality. If so, many in-house IT departments have reason to worry. InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business views IT's performance in delivering services - and, more important, powering innovation. The news isn't great.
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.