Security Researcher To Release Code That Could Help Exploit BlackBerry Security Flaw
But Research In Motion says the threat is overstated.
A security researcher next week plans to release code that could enable hackers to exploit the encrypted link between BlackBerry handhelds and servers to bypass gateway security and hit machines inside corporate networks.
BlackBerry maker Research In Motion (RIM) and its partners, however, say the risk is overstated.
At last week's Defcon security conference in Las Vegas, Jesse D'Aguanno, a consultant at Praetorian Global, a Placerville, Calif.-based risk management firm, showed how a hacking program he developed--called BBProxy--could allow an attacker to gain access to a company's internal network via the encrypted connection between a BlackBerry handheld and the Blackberry Enterprise Server (BES).
Security vendor Secure Computing on Tuesday warned companies that their BES deployments on internal networks could be vulnerable to a BBProxy attack. After manually installing BBProxy or getting a user to install it via an e-mail attachment, a hacker could piggyback the encrypted connection between the handheld and the BES and gain access to the internal network, according to San Jose, Calif.-based Secure.
However, the notion that BBproxy could be spread by e-mail without user interaction is misleading, said Scott Totzke, director of the global security group at RIM, Waterloo, Ontario. "Our attachment service doesn't work that way. You can send and view e-mail, but the BES system is designed to require users to manually download the application from a Web site," he said.
"[BBProxy] isn't a hacking tool. It's an application that runs on the BlackBerry and potentially does something malicious," Totzke added.
Although BBProxy may work in theory, RIM has addressed the issue of over-the-air or self-installing applications with the IT policy component of BES version 4.1, said David Bean, president of eAccess Solutions, a Palatine, Ill.-based RIM partner. BES 4.1 includes policies that can repel an attack by a self-installing or virus-infected file, but such policies must be set up and implemented by the server administrator, Bean added.
On its Web site, RIM has published documents that describe steps that companies can take to protect themselves from such an exploit. Those measures include segmenting networks and limiting third-party application access to the BlackBerry Enterprise solution.
Dan King, president of New West Technologies, a Portland, Ore.-based solution provider, said he thinks it's interesting that security researchers are announcing hacks before releasing them, which he said helps educate companies about the risks they take by not locking down their networks.
"Hopefully, companies will take the appropriate steps to make sure their data is not intruded on so that they are not enabling the proliferation of viruses and hacks by leaving their compromised systems open and on the Internet," King said.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.