Specifications

ManualsBrandsBlackberry ManualsOtherJAVA DEVELOPMENT ENVIRONMENT - - FUNDAMENTALS GUIDE

Table Of Contents

Introduction........................................................................................................................................................
Architecture Overview........................................................................................................................................
Operating System..............................................................................................................................
Code Signing...................................................................................................................................................
Modifying Signed Applications..................................................................................................................
Malicious Code Signing..............................................................................................................................
Mitigation Strategies......................................................................................................................................
BIS Deployment.........................................................................................................................................
Application Permissions.......................................................................................................................
Device Firewall....................................................................................................................................
BES Deployment......................................................................................................................................
IT Policy...............................................................................................................................................
Application Control Policy...................................................................................................................
Application Permissions.....................................................................................................................
Device Firewall....................................................................................................................................
Attack Surface Analysis....................................................................................................................................
Introduction.................................................................................................................................................
JAD Files.......................................................................................................................................................
Mitigation................................................................................................................................................
File System...................................................................................................................................................
Persistent Storage...................................................................................................................................
J2ME File System.....................................................................................................................................
USB Mass Storage....................................................................................................................................
Mitigation................................................................................................................................................
Memory and Processes................................................................................................................................
Auto start-up and Background processes...............................................................................................
SMS (Short Message Service)......................................................................................................................
Premium Rate Scam................................................................................................................................
SMS Interception.....................................................................................................................................
SMS Backdoor..........................................................................................................................................
Mitigation................................................................................................................................................
Bluetooth......................................................................................................................................................
Bluetooth Backdoor.................................................................................................................................
Bluetooth Worms.....................................................................................................................................
Mitigation................................................................................................................................................
Email.............................................................................................................................................................
Email Interception...................................................................................................................................
Backdoor..................................................................................................................................................
Worm........................................................................................................................................................
Mitigation................................................................................................................................................
PIM Data (Personal Information Manager Data).........................................................................................
Data Theft................................................................................................................................................
Loss of data availability and integrity.....................................................................................................
Mitigation................................................................................................................................................
TCP/IP Connections......................................................................................................................................
Proxy/Firewall Bypass.............................................................................................................................
Backdoor..................................................................................................................................................
Port Scan..................................................................................................................................................
Mitigation................................................................................................................................................
Port Scan..................................................................................................................................................
HTTP / WAP...................................................................................................................................................
Data Theft................................................................................................................................................
Backdoor............................................................................................................................................
HTTP Proxy...............................................................................................................................................
Mitigation................................................................................................................................................
Telephony.....................................................................................................................................................
Call Record Monitoring............................................................................................................................
Premium Rate Calls.................................................................................................................................
Bypassing Caller Verification Systems....................................................................................................
Telephony Data Theft...............................................................................................................................
Mitigation................................................................................................................................................
Camera.........................................................................................................................................................
Mitigation................................................................................................................................................
Conclusions......................................................................................................................................................
Appendix A........................................................................................................................................................
References........................................................................................................................................................

Attack Surface Analysis of BlackBerry Devices

21 Connected Limited Device Configuration 1.1 (CLDC) Specification, Java Community Process.

http://jcp.org/aboutJava/communityprocess/final/jsr139/

22 BlackBerry Enterprise Server Policy Reference Guide, RIM.

http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/7963/1139827/BlackB

erry_Enterprise_Server_Policy_Reference_Guide.pdf?nodeid=1139948

23 MIDP Signing, Sun Microsystems.

http://java.sun.com/j2me/docs/wtk2.2/docs/UserGuide-html/security.html

24 BlackBerry Signature Tool Developer Guide, RIM.

http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1271077/

BlackBerry_Signature_Tool_Developer_Guide.pdf?nodeid=1271325&vernum=0