Slashdot Mirror

← Back to Stories (view on slashdot.org)

BlackBerry Server Can Be Hacked With Image File

Posted by timothy on from the image-of-the-emir-perhaps dept.

Trailrunner7 writes "There are remotely and easily exploitable vulnerabilities in the BlackBerry Enterprise Server that could allow an attacker to gain access to the server by simply sending a malicious image file to a user's BlackBerry device. The vulnerabilities are in several version of BES for Exchange, Lotus Domino and Novell GroupWise, and Research in Motion said that an attacker who is able to exploit one of the bugs might also be able to move from the compromised BES server to other parts of the network."

26 of 51 comments (clear)

  1. It's A Trade Off by WrongSizeGlass · · Score: 5, Funny

    Sure my client's BES could be hacked with an image file, but the image is of a really hot chick, so it's a fair trade.

    1. Re:It's A Trade Off by Anonymous Coward · · Score: 1

      You made me click on the TFA with your comment!

      I am sad. There is no hot chick in TFA... :(

    2. Re:It's A Trade Off by girlintraining · · Score: 2

      Sure my client's BES could be hacked with an image file, but the image is of a really hot chick, so it's a fair trade.

      That's pretty sexist. Only about half the population would appreciate that.

      --
      #fuckbeta #iamslashdot #dicemustdie
    3. Re:It's A Trade Off by Anubis350 · · Score: 1

      To be fair, *if* the GP were assuming that approx. 50% of the pop is male, 50% female, and that there are approximately similar numbers of gays and lesbians (no idea if that's in any way true or not), the comment would make perfect sense without being homophobic...

      --
      "goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
    4. Re:It's A Trade Off by jmac_the_man · · Score: 2

      To be even more fair, the question was about "is into chicks." If gays and lesbians occur with the same frequency in the population of men and women, respectively, they would cancel each other out. But if bisexuals ALSO occur with the same frequency regardless of gender, they don't cancel each other out, but instead that number counds twice.

    5. Re:It's A Trade Off by Anubis350 · · Score: 2

      unless there's enough asexuals to cancel them out :-p

      --
      "goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
    6. Re:It's A Trade Off by Scott+Scott · · Score: 1

      Actually, anyone who's read girlintraining's user page would know she's anything but homophobic.

      (Did someone say something about glass houses?)

    7. Re:It's A Trade Off by drinkypoo · · Score: 1

      That's a lot of crap, there are tons of (straight) women who look at the pictures in Playboy because they can appreciate a pretty woman, but virtually no (straight) men who will even open a copy of Playgirl.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  2. It's all about the image by SilverHatHacker · · Score: 4, Funny

    1. Send goatse image to BB.
    2. BB holder frozen in shock.
    3. Walk up to frozen holder, appropriate keys/saved passwords/etc.
    4. ???
    5. Profit!

    --
    Funny may not give karma, but +5 Informative never made anyone snort coffee out their nose.
    1. Re:It's all about the image by Kell+Bengal · · Score: 1

      Obvious goatse troll is obvious.

      --
      Scientists point out problems, engineers fix them
      altslashdot.org: The future of slashdot.
    2. Re:It's all about the image by Pseudonym+Authority · · Score: 1

      I knew it was goatse and still clicked. What kind of effeminate pansy is still shocked by goatse after all these years. For fucks sakes this is the internet. At least link to Last Measure so that the jews.wma will annoy people. (And it's run by the GNAA, a fine organization with a deep and fulfilling history on slashdot.)

    3. Re:It's all about the image by Taty'sEyes · · Score: 1

      I'm a little disturbed by your opinion of SFW. What type of work do you do exactly?

      --
      We show geeks how to get their dream girl at EyesOfOdessa.com
    4. Re:It's all about the image by hairyfeet · · Score: 1

      PC repair maybe? I know my old boss would never warn me before giving me the PC of "latino guy" or "buttgirl" to fix. Thanks a lot Doug, asshole. Latino guy would always end up with porn bugs for gay sites, usually some Latino oiled up nasty shit, and buttgirl? /Shivers at the horror/ Old buttgirl had a BF that had to weigh a good 350 and was hairy as a damned wookie and she would take all these thong pics of his big old hairy ass and make them her wallpapers, the icons for folders, her screensavers...fuck that was rough. the shit we PC guys get to see sometimes, like the gal that had dildos that i swear needed their own fricking gun rack...eek!

      As for TFA...people still use Blackberry? I thought everyone had switched to iPhone and Android by now. If MSFT has any brains left at that outfit they'll make sure to have excellent AD and GPU support in their Nokia WinPhones and will drive the final nail in the coffin that is RIM. Frankly TFA doesn't surprise me as that company has just gone from one mistake after another lately and having a serious security hole just seems like the icing on the cake.

      Once upon a time everywhere I went it was crackberries, but now all I ever see is iPhones and the HTC Androids. If a security hole appears but nobody is there to exploit it, does it still count?

      --
      ACs don't waste your time replying, your posts are never seen by me.
    5. Re:It's all about the image by Pseudonym+Authority · · Score: 1

      Well, one particularly nasty person posted some CP of a kid being raped a while back, during a discussion on Tor vulnerabilities (I think). /. is total garbage when it comes to search, so I can't point you to it until CmdrTaco gets off his ass to fix it. If you are really serious about the road you are taking, you could always try that. May be hard to avoid prison with though. Not to mention that it kinda crosses the lines from asshole to monster pretty quick. Might want to leave that to the /b/tards.

      Good luck in your adventures of false advertisements, what ever you decide!

  3. Re:But NIST certified it! by belg4mit · · Score: 1

    No, they certified the (stupidly named) PlayBook tablet.

    --
    Were that I say, pancakes?
  4. A Malicious Image File eh? by Anubis350 · · Score: 1

    I always knew we needed an emoticon for "pwned!"

    --
    "goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
  5. Do they think I'm stupid? by MacGyver2210 · · Score: 4, Funny

    So you want me to click a link to an article about hacking via image files...?

    *opens lynx*

    --
    If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
  6. This article is illegal! by xmorg · · Score: 2

    This article violates teh DMCA and has been sent to the DHS for immediate action against the terrorists who wrote it.
    All those involved will be hand molested by the TSA before being sent to Guantanamo bay.

  7. Sad is how negative this was written! by Anonymous Coward · · Score: 1

    RIM announced the problem, WITH the solution, it wasn't. Announced by a 3rd party, so RIM remains dedicated to security.

    The problem is on servers, not on devices, maintaining device security. One would need intimate knowledge of the BES set up to actually extract information from the server.

    Their communication between device and server has yet to be hacked

    1. Re:Sad is how negative this was written! by Alex+Zepeda · · Score: 1

      I think you forgot the quotes around "security". As long as they're decrypting stuff voluntarily for various governments, there's nothing secure about it.

      --
      The revolution will be mocked
  8. TNG by Kebis · · Score: 1

    Isn't this exploit pretty much what Captain Picard wanted to do to the Borg in the episode with Hue?

  9. Re:Haven't you heard? by That+Guy+From+Mrktng · · Score: 1

    This is your hipster server Steaming Chrome Racks baby!

  10. The servers control the devices. by apparently · · Score: 1
    While this may be true:

    Their communication between device and server has yet to be hacked

    This isn't:

    One would need intimate knowledge of the BES set up to actually extract information from the server.

    Their communication between device and server has yet to be hacked

    From the KB warning:

    "Vulnerabilities exist in how the BlackBerry MDS Connection Service and the BlackBerry Messaging Agent process PNG and TIFF images for rendering on the BlackBerry smartphone. Successful exploitation of any of these vulnerabilities might allow an attacker to gain access to and execute code on the BlackBerry Enterprise Server. Depending on the privileges available to the configured BlackBerry Enterprise Server service account."

    Access to the besadmin account gives an attacker all sorts of access to the server. That account has sendas permissions on all users mailboxes, can make configuration changes to the BES configuration, including changing device settings, and pushing applications to the devices.

    It really wouldn't be all that hard to completely compromise an organization's Blackberry configuration -- server and device -- and there's a good chance that you'd be able to escalate privileges onto other servers within the network.

    1. Re:The servers control the devices. by kevinmenzel · · Score: 1

      But what is true is that the Slashdot editors or the submitter has decided that instead of even mentioning the patch, they would just focus on the exploit.

      Strange of course, as the source material for this post is titled "Severe Remote Flaw Fixed in BlackBerry Enterprise Server", and the source for THAT article does indeed include the patch itself.

    2. Re:The servers control the devices. by lennier · · Score: 1

      But what is true is that the Slashdot editors or the submitter has decided that instead of even mentioning the patch, they would just focus on the exploit.

      But of course the patch has automagically applied itself to every BES server in the world, instantly, leaving no window of vulnerability while sysadmins scramble to apply it.

      I mean, that's what patches do, right?

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
  11. This hasn't been a problem for a while by narcc · · Score: 1

    RIM shipped a patch for these vulnerabilities almost a week ago. The headline should read "Blackberry Server Can't Be Hacked With Image File"

    That's right, this was discovered and fixed long before it could become a problem. That's what I expect from RIM's best-in-class security.

    --
    Required reading for internet skeptics