Specifications
Table Of Contents
- Introduction........................................................................................................................................................
- Architecture Overview........................................................................................................................................
- Operating System..............................................................................................................................
- Code Signing...................................................................................................................................................
- Modifying Signed Applications..................................................................................................................
- Malicious Code Signing..............................................................................................................................
- Mitigation Strategies......................................................................................................................................
- BIS Deployment.........................................................................................................................................
- Application Permissions.......................................................................................................................
- Device Firewall....................................................................................................................................
- BES Deployment......................................................................................................................................
- IT Policy...............................................................................................................................................
- Application Control Policy...................................................................................................................
- Application Permissions.....................................................................................................................
- Device Firewall....................................................................................................................................
- Attack Surface Analysis....................................................................................................................................
- Introduction.................................................................................................................................................
- JAD Files.......................................................................................................................................................
- Mitigation................................................................................................................................................
- File System...................................................................................................................................................
- Persistent Storage...................................................................................................................................
- J2ME File System.....................................................................................................................................
- USB Mass Storage....................................................................................................................................
- Mitigation................................................................................................................................................
- Memory and Processes................................................................................................................................
- Auto start-up and Background processes...............................................................................................
- SMS (Short Message Service)......................................................................................................................
- Premium Rate Scam................................................................................................................................
- SMS Interception.....................................................................................................................................
- SMS Backdoor..........................................................................................................................................
- Mitigation................................................................................................................................................
- Bluetooth......................................................................................................................................................
- Bluetooth Backdoor.................................................................................................................................
- Bluetooth Worms.....................................................................................................................................
- Mitigation................................................................................................................................................
- Email.............................................................................................................................................................
- Email Interception...................................................................................................................................
- Backdoor..................................................................................................................................................
- Worm........................................................................................................................................................
- Mitigation................................................................................................................................................
- PIM Data (Personal Information Manager Data).........................................................................................
- Data Theft................................................................................................................................................
- Loss of data availability and integrity.....................................................................................................
- Mitigation................................................................................................................................................
- TCP/IP Connections......................................................................................................................................
- Proxy/Firewall Bypass.............................................................................................................................
- Backdoor..................................................................................................................................................
- Port Scan..................................................................................................................................................
- Mitigation................................................................................................................................................
- Port Scan..................................................................................................................................................
- HTTP / WAP...................................................................................................................................................
- Data Theft................................................................................................................................................
- Backdoor............................................................................................................................................
- HTTP Proxy...............................................................................................................................................
- Mitigation................................................................................................................................................
- Telephony.....................................................................................................................................................
- Call Record Monitoring............................................................................................................................
- Premium Rate Calls.................................................................................................................................
- Bypassing Caller Verification Systems....................................................................................................
- Telephony Data Theft...............................................................................................................................
- Mitigation................................................................................................................................................
- Camera.........................................................................................................................................................
- Mitigation................................................................................................................................................
- Conclusions......................................................................................................................................................
- Appendix A........................................................................................................................................................
- References........................................................................................................................................................
Attack Surface Analysis of BlackBerry Devices
References
1 BlackBerry Java Development Environment Version 4.2.0 Fundamentals Guide, RIM.
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1271077/
BlackBerry_Java_Development_Environment_Fundamentals_Guide.pdf?nodeid=1271322&vernum=0
2 BlackBerry Java Development Environment Version 4.2.0 Development Guide, RIM.
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1271077/
BlackBerry_Java_Development_Environment_Development_Guide.pdf?nodeid=1271319&vernum=0
3 BlackBerry Application Developer Guide Volume 1: Fundamentals (4.1), RIM.
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1106255/
BlackBerry_Application_Developer_Guide_Volume_1.pdf?nodeid=1106256&vernum=0
4 BlackBerry Application Developer Guide Volume 2: Advanced Topics (4.1), RIM.
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1106255/
BlackBerry_Application_Developer_Guide_Volume_2.pdf?nodeid=1106444&vernum=0
5 RIM Device Java Library - 4.2.0 Release (Javadoc), RIM.
http://www.blackberry.com/developers/docs/4.2api/
6 Mobile Information Device Profile (MIDP), Sun Microsystems.
http://java.sun.com/products/midp/
7 Connected Limited Device Configuration (CLDC), Sun Microsystems.
http://java.sun.com/products/cldc/
8 BlackJacking, Jesse D'Aguanno and Praetorian Global.
http://www.praetoriang.net/presentations/blackjack.html
9 Protecting the BlackBerry device platform against malware, RIM.
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/7979/1181821/828044/1181292/Pro
tecting_the_BlackBerry_device_platform_against_malware.pdf?nodeid=1266119&vernum=0
10 Java VM Spec: Verification, Sun Microsystems.
http://java.sun.com/docs/books/jvms/second_edition/html/Concepts.doc.html#22574
11 Attachment Service, RIM.
http://www.blackberry.com/products/blackberry/attachments.shtml
12 Placing the BES in a segmented network, RIM.
http://www.blackberry.com/solutions/resources/Placing_the_BlackBerry_Enterprise_Solution_in_a_Segmented_Net
work.pdf
13 W32.Beagle.A@mm writeup, Symantec.
http://www.symantec.com/security_response/writeup.jsp?docid=2004-011815-3332-99&tabid=1
14 W32.Fujacks.AW write-up, Symantec.
http://www.symantec.com/security_response/writeup.jsp?docid=2007-020812-2448-99
15 BlackBerry Pearl, O2 Ireland.
http://www.o2online.ie/webapp/wcs/stores/servlet/O2ProductDisplayView?storeId=10001&langId=-
1&catalogId=10001&phoneId=40522&flowType=PU&productId=40522&partNumber=352127
16 O2 Ireland Homepage.
http://www.o2online.ie/
17 Private email communication with RIM.
18 This approach was suggested by Ollie Whitehouse of Symantec Advanced Threat Research, who has had similar
results in the past testing this on other platforms.
19 FlexiSPY – Commercial mobile phone spyware application.
http://www.flexispy.com/
20 BlackBerry Application Control, RIM.
http://www.blackberry.com/developers/journal/july_2005/app_control.shtml
36










