Security Researcher To Release Code That Could Help Exploit BlackBerry Security Flaw - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
News

Security Researcher To Release Code That Could Help Exploit BlackBerry Security Flaw

But Research In Motion says the threat is overstated.

A security researcher next week plans to release code that could enable hackers to exploit the encrypted link between BlackBerry handhelds and servers to bypass gateway security and hit machines inside corporate networks.

BlackBerry maker Research In Motion (RIM) and its partners, however, say the risk is overstated.

At last week's Defcon security conference in Las Vegas, Jesse D'Aguanno, a consultant at Praetorian Global, a Placerville, Calif.-based risk management firm, showed how a hacking program he developed--called BBProxy--could allow an attacker to gain access to a company's internal network via the encrypted connection between a BlackBerry handheld and the Blackberry Enterprise Server (BES).

Security vendor Secure Computing on Tuesday warned companies that their BES deployments on internal networks could be vulnerable to a BBProxy attack. After manually installing BBProxy or getting a user to install it via an e-mail attachment, a hacker could piggyback the encrypted connection between the handheld and the BES and gain access to the internal network, according to San Jose, Calif.-based Secure.

However, the notion that BBproxy could be spread by e-mail without user interaction is misleading, said Scott Totzke, director of the global security group at RIM, Waterloo, Ontario. "Our attachment service doesn't work that way. You can send and view e-mail, but the BES system is designed to require users to manually download the application from a Web site," he said.

"[BBProxy] isn't a hacking tool. It's an application that runs on the BlackBerry and potentially does something malicious," Totzke added.

Although BBProxy may work in theory, RIM has addressed the issue of over-the-air or self-installing applications with the IT policy component of BES version 4.1, said David Bean, president of eAccess Solutions, a Palatine, Ill.-based RIM partner. BES 4.1 includes policies that can repel an attack by a self-installing or virus-infected file, but such policies must be set up and implemented by the server administrator, Bean added.

On its Web site, RIM has published documents that describe steps that companies can take to protect themselves from such an exploit. Those measures include segmenting networks and limiting third-party application access to the BlackBerry Enterprise solution.

Dan King, president of New West Technologies, a Portland, Ore.-based solution provider, said he thinks it's interesting that security researchers are announcing hacks before releasing them, which he said helps educate companies about the risks they take by not locking down their networks.

"Hopefully, companies will take the appropriate steps to make sure their data is not intruded on so that they are not enabling the proliferation of viruses and hacks by leaving their compromised systems open and on the Internet," King said.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2021 State of ITOps and SecOps Report
2021 State of ITOps and SecOps Report
This new report from InformationWeek explores what we've learned over the past year, critical trends around ITOps and SecOps, and where leaders are focusing their time and efforts to support a growing digital economy. Download it today!
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

Slideshows
IT Leadership: 10 Ways to Unleash Enterprise Innovation
Lisa Morgan, Freelance Writer,  6/8/2021
Commentary
Preparing for the Upcoming Quantum Computing Revolution
John Edwards, Technology Journalist & Author,  6/3/2021
News
How SolarWinds Changed Cybersecurity Leadership's Priorities
Jessica Davis, Senior Editor, Enterprise Apps,  5/26/2021
Register for InformationWeek Newsletters
Video
Current Issue
Planning Your Digital Transformation Roadmap
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll