Slashdot Mirror
Security Holes Found In RIM BlackBerry Service
An anonymous reader writes "Researchers have found several security holes in Blackberry handheld devices and the servers that power them, according to a story at Washingtonpost.com. The research points out serious flaws in the BlackBerry server, which could be exploited by convincing Blackberry handheld users to click on an image file attachment. From the article: 'Lindner's slides from his presentation -- which he agreed not to release until RIM has fully fixed this problem -- show that the Blackberry server which manages all of the encryption keys needed to unscramble e-mail traffic to and from all Blackberry devices registered on the network stores them on a Microsoft SQL database server in plain, unencrypted text. Lindner found that by convincing a Blackberry user to click on a special image attachment, that handheld device could be made to pass on malicious code to the Blackberry server, which could then be taken over and used to intercept e-mails or as a staging point for other attacks within the network.'"
This gives a whole new meaning to getting a RIMming...
Some say he is made with ascii, others that he is eyeballed daily by millions. All we know is, he is known as the Sig
*watches the karma drop* btw I'm a RIM supporter
do.what.promptcmds
I'm no SQL guru, but even I know how to avoid these kinds of attacks. Plus, storing information like that in plain text is just... dumb.
... they're being patented out of existence. Sure makes things like this a little less serious, in that Office Space sort of way.
...is that it took so long to find this. Blackberries are in such wide use around government agencies, I would have hoped they would have found something like this long ago. I always have to wonder about the idiot designers and coders who create bugs like this.
Government's view of the economy: If it moves, tax it. If it keeps moving,regulate it. If it stops moving, subsidize it.
Imagine an army of handheld zombie spamservers!
Some say he is made with ascii, others that he is eyeballed daily by millions. All we know is, he is known as the Sig
That's exactly why I use my Sharp Zaurus Linux handheld with 802.11b CF card and connect to the IMAP server I administrate myself. Never really understood why RIM existed. $80 a month to be hacked and sued?
I think that publishing an exploit where the user has to receive a corrupt tagged TIFF file is just making the problem into a bigger issue.
The article says it only affects certain versions of the servers, and than only a certain, corrupt image file. THAN it only prevents you from getting other attachments.
Not exactly a big deal in my book (of course we use palms anyway, haha)
It's a corrupt PNG (a common image file type), that may pass code to the server to be run there (as administrator), with complete access to the corporate network, including all the plain-text, non-passphrase-protected private keys of all blackberry users on the same corporate network.
If true, this is a gaping hole, and a very big deal.
when I know they are hiring newbs from U of W that don't know their ass from a hole in the ground, this sort of thing is not a surprise to me!
Apparently they don't know their ass from a hole in the security, either.
He who knows best knows how little he knows. - Thomas Jefferson
Interesting because UofW has an amazing Computer Science program, is reknown for the quality of the co-op students that they send out, and is one of the largest sources for technology labour in Canada.
do.what.promptcmds
Exactly. No one should be able to get a job until they've had a job. That'll fix everything.
Who in their right mind would store that info unencrypted? It must be pretty easy these days to get a rim job.
Will I be able to flash between 1.5 and 2.0 as much as I want?
Does Norton see this as Brick.Trojan?
Oops, that was the OTHER MegaCorp's product... Sorry, carry on.
So, you enjoy security through obscurity via your 1337 n1nj4 'administrate' tricks, whereas the unwashed masses are forced to 'administer' their hardware, and, therefore, be compromised.
U R t3h m4n!
I used to work at RIM, and if you honestly think that it is mostly staffed by 23 year olds, you are mistaken. The vast majority of folks at RIM are not fresh out of undergrad and the technical genius that does exist there is indeed very impressive (I worked on the business side, not the tech side.. and the tech guys really know what they're doing). And further, if you honestly think that Lazaridis and Balsillie run the type of place where major design decisions are made by junior people, I'm not surprised that you don't have the qualifications to get a job there.
The fact that they made a small design mistake isn't really that surprising. These things happen all the time. Their response is what's important going forward, and I (as a current BB user) have faith that they will quickly patch this up and move on.
What about the parent post indicates that it was intended to be taken seriously?
They obviously don't know what they're doing if ANYONE using a BlackBerry can use an SQL Injection Attack on their own server. This is extremely easy to check for. Just like buffer overflow attacks. There is no reason why either should exist except for either laziness or pure stupidity.
They made two big mistakes with their design. This kind of thing should be surprising. If they're selling a product used in millions of businesses, it has to be secure. Storing important information in unencrypted text and not taking the time to add a few more lines of code to do some verification before submitting anything to the database is inexcusable.
I would like to try and convince most people with a Blackberry to see if they could use it as a suppository, but I digress...
From the Washington Post: RIM didn't mention anything about the flaw allowing attackers to download and execute programs on the targeted device, but I'm left wondering whether they escalated this because of just such a threat.
I really don't think RIM is going to shout this from the rooftops. If the exploit is as bad as is disclosed, there's some serious trouble brewing that makes the brouhaha with NTP look like a cakewalk.From the Washington Post: Lindner said he started looking into Blackberry's proprietary communications protocols because the Blackberry server requires an unusual level of access inside of a corporate network: the server must be run inside a company's network firewall and on a Windows machine that is granted full and direct administrative access to the customer's internal e-mail server.
And RIM thought this was a good idea because...? It's like building a 50-ft high wall around the castle, then creating a hole for an 8-lane superhighway to pass through. Imagine the enterprising and inventive hacker that can plant a zombie process on that machine. Talk about spam! Imagine if a Fortune 500 company starts getting nipped because their email servers are dumping spam on the unsuspecting public. Lawsuits for everyone!!
GetOuttaMySpace - The Anti-Social Network
Yep, sorry guys... this flaw is patented. Pay up!
Heh, I wasn't actually going to post that, but I had a thought... if we patented the dumbest mistakes out there (buffer overflows, etc)... what company would want to prove "prior art" ?
help me i've cloned myself and can't remember which one I am
Waiting for bush to help them label this as a feture so that they can spy on the spys
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
How would someone exploit the password issues on a GroupWise or LotusNotes- based BES install? Maybe I should be glad that RIM hasn't actually managed to come up with a backend-independent version (say, something that speaks IMAP or POP3), which would result in more servers being vulnerable.
Also- given some of the other flaws that I've discovered with BlackBerries (which is not to say that I'm not an addict), something like this is not wholly unexpected. I mean, they haven't yet managed to make the timestamps on messages sent from handhelds actually conform to the relevant RFC (2822), and I've had an open trouble ticket with RIM on that issue for the better part of a year.
Fight psychopharmacological mccarthyism. http://www.norml.org/
You make several good points. As I said, I'm not fully familiar with all of the advanced technical details of the system (I worked in Marketing). My guess is that this story is blown a wee bit out of proportion, or someone just got a bit sloppy on implementation or something along those lines. I would be genuniely surprised if someone seriously dropped the ball on this.. it just isn't how BlackBerry does business. (Although they do seem to be a bit more "push it out the door" than they may have been two years ago when I worked there.)
r /groupwise/security.shtml is my source and a good starting point to read more about BlackBerry security. This page is far too buried on the site if you ask me...
My original point (if you take out the negativity focussed at the parent) was that this stuff happens in software and I'm sure it will get fixed soon.
Just to follow up on your other point -- BlackBerry is held by governments and independent audiors as being ridiculously secure. It is one of if not the only wireless email solution that is FIPS-140 cerified, amongst its other security certifications.
http://www.blackberry.net/products/software/serve
Have a good one.
this is not a SMALL design mistake.. this is a HUGE GLARING ERROR. perhaps you thinking "they made a small design mistake" explains why you worked in the marketing department.
If the vast majority of the tech side is "very impressive" then this mistake wouldn't have been made, the structure and design of these systems should have been done in a team environment, and someone with experience should have flagged this in the very beginning.
there is, of course, a place for fresh grads, but it should be working along side seasoned professionals. Also, I don't think that age is a factor: 43 or 23, if you have 4 years of university under your belt, you're on your way to a good career, but you likely do not have the knowledge and know-how to replace someone with years of work "in the field"
It is interesting to have an inside view of things rather than to simply criticize anonymously on the web.
It's unfounded subjective views like these that make reading slashdot feel like a waste of time.
See my reply to Kasracer re: "small mistake" and my slightly educated guess as to how it would happen. And I do agree that I should be on the business side, not the tech side.. if I was ever on the tech side, these sorts of stories would be a lot more common.
I definitely agree with you re: place for new hires.. I don't think many people would disagree. What I was trying to say is that this is very much the way things are within RIM (e.g. teams working on specific projects with a range of experience and backgrounds in them). I was trying to give a more inside view to how things get done at RIM.. a fair defense given the accusation made in the parent.
But I will also defend RIM a bit more and say that it doesn't matter whether the team is staffed entirely by folks that have been doing the job for 40 years, mistakes still happen.. the important thing isn't to gripe and whine about the problem happening, but rather to focus on a quick and effective solution. That is what is productive and that's what makes a great company great. Hopefully RIM will do just that.
Cheers.
With the scant details provided, it sounds almost like an SQL Injection vulnerability. It doesn't sound like a problem with SQL Server directly, or else it wouldn't be a RIM specific problem.
Anyway, can't administrators just filter all image attachments out through their AV or other software for the time being?
Woo, the best man at my wedding works at RIM...
- chrish
I wonder when they'll getting around to fixing that pesky security flaw in users which causes them compulsively to click on things.
Without excusing the security hole, is it really that surprising that the emails are stored as "plain, unencrypted text"? I would think that encrypting e-mails on a mail server of that size would be the exception rather than the norm. Anyone know if Exchange is encrypted?
I had an article here about it, looking for anyone who has a blackberry to discuss:
Blackberry handhelds/servers vulnerable to attack
I had no idea the server backend was so...crummy. Why do geeks running FreeBSD at home have their passwords encrypted within MySQL, but big companies with million dollar products don't?
fak3r.com
Wouldn't it be easier to send the victims a goatse image directly, rather that try to SQL-rape that poor Sequel server?
with absolutely NO idea what they're talking about.
ha.
ha.
Hehe ;-)
Using a Microsoft product on a server is a small design mistake?!?! You must be new here!
Not Waterloo... Winnipeg!!
(Canadians'll get it)
The fact that they made a small design mistake isn't really that surprising. These things happen all the time.
I'm not sure you can write this off as a small design mistake. This seems to me more like a fundamental design flaw based on a series of bad choices. They want you to run a Windows based server, outside your firewall, running a number of services, with security data stored unencrypted, and full privileges to the corporate e-mail server. That sounds like someone's friend or nephew was running the server project and either would not listen to advice that things should be done right, rather than quickly, or simply was unable to hire competent personnel. This is why companies making products like these should have a security team outside each project's chain of command, and why that team should be listened to. Now, who will trust them to do the right thing next time. What security conscious company will consider them as a solution provider?
theres more RIMs in this thread than a goatse site
What does he mean by convince a user to click on a special image. What if _I_ wanted to attach a RIM server and I had access to a Blackberry?! WTF? Why not describe a butterfly sneezing in China as a part of the attack?
"When the solution is simple, God is answering." -- Albert Einstein
Hey.. at least my UID starts with a 1 :)
Anyway.. I actually asked that question to folks in the tech side.. and their entire reasoning is that in 1999 (and arguably right now), the majority of their install base was running either Exchange or Notes as their email platform.. thus, in original design, they considered tight interoperability as critical to BB's success. That and MAPI allows pretty tight integration between Exchange and the BlackBerry Enterprise Server. (With BES 4.0 they added groupwise to this to support a larger base of government clients.)
BB started in the late 90s and their initial target was the Fortune 500 companies.. so essentially the BES as a product and the BlackBerry architecture as the solution are the result of the backrooms of the Fortune 500 companies of the day. This interoperability made initial TCO for BlackBerry very low (think thousands instead of tens of thousands) and thus made ROI figures very high.
I can't speak about the security implications of this because I just don't know enough about the security environment. RIM used to sell its security on three things: 1) Total AES (then 3DES) encryption from end to end, 2) Everything is behind the firewall (which I surmise is where the problem is here) and 3) FIPS certification. Feel free to offshoot from there.
I'm a security consultant and a CISSP.
That was not a small mistake. It was a series of mistakes, some of which fell short of best practice and some of which fell short of standard practice.
In fact I'll use this case as an example to explain to clients why it's imperative not to store sensitive information in plaintext on an exposed server.
They want you to run a Windows based server, outside your firewall,
The BlackBerry Enterprise Server does not, by any means, run outside the firewall.
You claim of highly skilled and technical people may be true but when they do exist, it is only at extreme higher levels of the support structure. Our BB guy is on the phone with our carrier and RIM troubleshooting our users BB issues all the time and the first 3 or 4 levels of support are completely useless and you MUST work your way up the support ladder. It takes until at least a level 3 person that you get past the "remove the battery and restart the handheld", "reregister with the wireless network and try again" or "try another sim/handheld". This gets insane when you are forced to travel this path several times a day. Luckily I do not get directly involved in the process until the BES or our mail system is involved and RIM support seems decent at that point.
I'll agree with you there -- my experience with the entire TSupport program was that it wasn't very good. The fact is that they want you to pay to get elevated automatically... not necessarily a good customer service practice.
CSU Chico, where I attended, had a strong claim to have one of the best computer science programs in California -- and some of the professors were very good -- but the grad students by and large left me unimpressed there as well.
All I can conclude is that graduating from a university, even a well-reputed one, does not imply strong real-world skills.
Bringing in a bit of new blood now and again is a good thing. Having a workforce devoid of practical experience is a recipe for disaster.