Blackberry – Blackjacked?
p2pnet.net News:- If Jesse D’Aguanno’s BBProxy installs on a BlackBerry either physically or via a Trojan horse delivered by e-mail, the hand-held can call the attacker’s system in the background, opening communications between it and the company’s internal network.
So said a Wired News story last week, and now a security firm is warning any firm with a BlackBerry server behind its gateway could be thus blackjacked.
BBProxy opens a back channel by-passing the organization’s gateway security mechanisms between the hacker and the inside of the victims’ network, says Secure Computing.
“Since the communications channel between the BlackBerry server and handheld device is encrypted and cannot be properly inspected by typical security products, a tunnel is most often opened by the administrator to allow the encrypted communications channel to the BlackBerry server inside the organization’s network.
“A malicious person could potentially use this back channel to move around inside of an organization unabated and remove confidential information undetected or use the back channel to install malware on the network.”
According to the BBC, D’Aguanno, who’s a consultant with Praetorian Global, said he’d release his BBProxy blackjacking code to researchers next week.
However, Blackberry firm Research In Motion (RIM), “played down the threat from Mr D’Aguanno’s work and said he made ’several reaching assumptions’ about how corporates use the Blackberry, says the story, adding:
“RIM said Blackberry handhelds could only run third-party programs, such as games sent to them via e-mail, if the permission is explicitly granted by network administrators. Access to wider corporate networks is typically limited too, it said.
“RIM has also updated its security site to show users more secure ways of using the Blackberry handheld and to avoid falling victims to trojans that hide malicious code. “
Also See:
Wired News – BlackBerry a Juicy Hacker Target, August 5, 2006
Secure Computing – Secure Computing Warns of Serious BlackBerry Hack Threat, August 8, 2006
BBC – Hijacked handheld turns data spy, August 9, 2006
p2pnet newsfeeds for your site.
rss feed: http://p2pnet.net/p2p.rss
Mobile – http://p2pnet.net/index-wml.php
