Slashdot Mirror
Cracking the BlackBerry with a $100 Key
Hit Reply writes "Eweek is running the contents of a Symantec white paper that details how easy it is for a hacker to manipulate BlackBerry applications. Using a developer key that can be purchased by anyone for $100, an attacker can launch e-mail worms, SMS interception and backdoor attacks, and compromise the integrity of contacts, events and to-do items. The white paper has been yanked from Symantec's Web site." From the article: "Signed applications can send e-mail and read incoming e-mail. A malicious application could be used to allow third parties to send messages from the infected BlackBerry and also read all received messages. A malicious application could also use e-mail as a command and control channel to receive instructions to send and receive e-mails; send and receive SMS messages; add, delete and modify contacts and PIM data; read dialed phone numbers; initiate phone calls; and open TCP/IP connections."
I see Symantec is still sensitive to the charge that they create worms, etc, to drum up business for themselves.
Personally it doesn't bother me in the least that a security company is interested in, well, security. Having them actually detail vulnerabilities and produce papers like this would at least be a useful function for them.
Of course, so would producing a worthwhile product that doesn't devour processor cycles, hog system resources, and create system instability upon removal.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
...your email is encrypted?
Use of PGP or something similar could easily defeat this.
So you can get a signature really cheap. The device owner still has to install the application on their Blackberry.
how many crackberries could a cracker crack if a cracker could crack crackberries?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I can send malicious emails and execute malicious programs in my friend's Linux box with a free "developer key". Just type "su" in the terminal and then enter this "developer key" (absolutely free) and its all yours.
I should mention that yes, indeed, these situations are almost identical. A root password *can* be changed, to whatever you want, even without knowledge of what previous password was, quite easily.
It sounds like it could be possible stalker fodder, but I don't know how many people would find the information a Crackberry stores/sends/receives to be highly valuable. Sure, they could be malicious and run up someone's text messaging bill, but there are a lot funnier ways to piss people off, such as by putting gum on the scroller wheel.
In other news, NTP just sued Blackberry, citing that the vulnerability was actually patented by them.
Help a man when he is in trouble and he will remember you when he is in trouble again.
This one again involves someone willfully installing this hypothetical software...
Just like the last attempt I saw to create a 3rd party BlackBerry security market by saying hey you can write a proxy to use a blackberry as a bridge to a company LAN via MDS... Of course you can (if i install your software)... Now if you can install this software without me letting you, then I'll worry... Until then, it's just FUD to create a market for a 3rd party security product.
It's amazing! An application installed to your phone can do things!
Why is this even posted like it's some kind of new concept?
If you install an application to your desktop machine, it can do all of those things. Why do you think the phone is any different? If you don't like the idea of malicious software then don't use a smartphone of any variety.
In fact, this should be good news. A person has to go to the extra length of signing their application before it has this access. Of course, on my smartphone an application cannot be installed without my confirmation, regardless of signatures. Is this not the case with the blackberry? If so, shame on you RIM.
I read the script, and I think it would help my character's motivation if he was on fire. -Bender
This is a pretty stupid white paper. The whole point of the key is that you can easily tell which key is being used by the offending applications, and then revoke that key. And it costs the attacker $100 per attack. It's a good system which balances the needs of the network, the users, and developers.
Post your keys so we can verify.....
(Only joking -- don't really do that)
Not to mention that you can lockdown the devices with an IT policy that doesn't allow the user to install any unapproved (by the Blackberry admin) software. Oh yeah and under OS4+ most automation steps still prompt the user. For instance I get prompted when I try to make a call from an entry in google maps mobile or launch a mailto: link from the Internet Browser app.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
A root password *can* be changed, to whatever you want, even without knowledge of what previous password was, quite easily.Right. Except that's not true.
I can crack a blackberry with a $4 hammer!
I can do it for free with my fist, but that kinda hurts.
paintball
So you buy a dev tool and can make bad things with it afterwards.. Who would have thought.
---- Booth was a patriot ----
I've decided this news posting was just an elaborate ploy by Slashdot to identify the BES admins in the slashdot community :P
depends on the situation... with physical access it's generally trivial to boot in to single user mode and wipe out a root password with no knowledge of the original.
... I mean come on, nobody's stupid enough to install random software on their machine without knowing what it does. Oh, wait...
So if you execute code on a computer, it does what you tell it to do? Better watch out!
First they come up with the hypothetical Mac "virus" that can hypothetically execute code if you manually download it and run it. And now it's the hypothetical BlackBerry malware that will hypothetically execute code if you manually download it and run it.
What an absolutely pathetic attempt at marketing from the once grand antivirus company.
ENDUT! HOCH HECH!
So I can buy a copy of their development software and make signed programs and sucker people into executing them. So what? The only differences between doing it on a Crackberry and an XBox are the barriers to entry. The price of a dev license for Xbox is much higher, and Microsoft probably makes you sign an agreement stating that you won't do this or that blah blah blah. Blackberry just makes it cheaper and apparently doesn't check credentials.
Other than this text, there is no discernible information contained in this sig.
I'm just a beginner bb developer, but I think it's even HARDER than is sounds to write Blackberry worm.
Even if you DO write a program that reads/sends email or connects to the internet.
And then pay the money and SIGN your malicious app--
and then somehow get somebody to INSTALL it..
Well on the BB releases I use - you will also get WARNINGS when you execute the program.
When the program first tries to access your email folder - it will pop up a warning asking you "do you want to allow this program to acesss your email folder?"
First time the application tries to open a TCP/IP connection to the outside world - same thing: "The application is attempting to open a conneciton to X.X.X.X - do you wish to allow it?". You can type "Allow" or "Deny" or "Allow always".
So BE WARNED: A person can a malicous program, that is signed with his name on it (RIM takes your info before they give you the keys), which you MIGHT install and then you MIGHT accidentally give it access to your emails, and address book, and access to internet. If all those things happen - then it would be bad!
QUICK! Better tag it as "itsatrap"!
I can just see a future where your phone's processor is so bogged down by an Anti Virus "security suite" that it isn't responsive enough to answer a call in time.
Ummm anyone who cares, google BBproxy and Blackhat/Defcon. There were multiple demonstations of this, and more. This is not just FUD, it is an important potential security hole, into many top enterprise companies.
This is basically saying that signed applications have access to the device?
What's next, an alert that signed applications for a PSP can access the memory stick? Signed applications for the Xbox 360 can modify things on the hard drive?
Seriously, shouldn't things like this be a feature?
It sounds like Blackberry are using developer keys as a tax on development for their platform. Developer keys should not work on any device, you should have to configure your device to accept them, either configuring it as a "development device", or better, configuring it to accept a specific developer key. In the latter case, the device manufacturer, network operator, or whoever controls the production keys, can get out of the way, and let developers create their own self-signed keys for development. Unfortunately too many of them see developers as a direct revenue opportunity, rather than encouraging Free development that increases their revenue more indirectly by making their platform more popular due to the wide range of apps that result.
Ah, crap.
Browsing with classic discussion, noscript, at -1 and nested
no hidden comments and I only mod UP
Why wipe the root password? that would let the legitimate root user know you were there as soon as he/she tried to log in as root again.
what you do is create another account, call it root2 or backupop or something like that, set your own password for it and make it user 0 as well as root.
Now you have root access with a different username and password that doesn't look as suspicious.
This is also good for admins with bad memories who change root passwords often. Set up a second root account with a complex password that you keep in the safe and log that account's actions so you know if someone else manages to use it.
"The white paper has been yanked from Symantec's Web site"
Blackberry security overview
davecb5620@gmail.com
"That isn't the white paper. It is a sales pitch!"
davecb5620@gmail.com
And thus the advent of tripwire. At best the hacker could disable tripwire, but then the (savvy) admin would notice the lack of tripwire reports.
It's a simple matter of complex programming.