Security Researcher To Release Code That Could Help Exploit BlackBerry Security Flaw

A security researcher next week plans to release code that could enable hackers to exploit the encrypted link between BlackBerry handhelds and servers to bypass gateway security and hit machines inside corporate networks.

BlackBerry maker Research In Motion (RIM) and its partners, however, say the risk is overstated.

At last week's Defcon security conference in Las Vegas, Jesse D'Aguanno, a consultant at Praetorian Global, a Placerville, Calif.-based risk management firm, showed how a hacking program he developed--called BBProxy--could allow an attacker to gain access to a company's internal network via the encrypted connection between a BlackBerry handheld and the Blackberry Enterprise Server (BES).

Security vendor Secure Computing on Tuesday warned companies that their BES deployments on internal networks could be vulnerable to a BBProxy attack. After manually installing BBProxy or getting a user to install it via an e-mail attachment, a hacker could piggyback the encrypted connection between the handheld and the BES and gain access to the internal network, according to San Jose, Calif.-based Secure.

However, the notion that BBproxy could be spread by e-mail without user interaction is misleading, said Scott Totzke, director of the global security group at RIM, Waterloo, Ontario. "Our attachment service doesn't work that way. You can send and view e-mail, but the BES system is designed to require users to manually download the application from a Web site," he said.

"[BBProxy] isn't a hacking tool. It's an application that runs on the BlackBerry and potentially does something malicious," Totzke added.

Although BBProxy may work in theory, RIM has addressed the issue of over-the-air or self-installing applications with the IT policy component of BES version 4.1, said David Bean, president of eAccess Solutions, a Palatine, Ill.-based RIM partner. BES 4.1 includes policies that can repel an attack by a self-installing or virus-infected file, but such policies must be set up and implemented by the server administrator, Bean added.

On its Web site, RIM has published documents that describe steps that companies can take to protect themselves from such an exploit. Those measures include segmenting networks and limiting third-party application access to the BlackBerry Enterprise solution.

Dan King, president of New West Technologies, a Portland, Ore.-based solution provider, said he thinks it's interesting that security researchers are announcing hacks before releasing them, which he said helps educate companies about the risks they take by not locking down their networks.

"Hopefully, companies will take the appropriate steps to make sure their data is not intruded on so that they are not enabling the proliferation of viruses and hacks by leaving their compromised systems open and on the Internet," King said.