A small shock wave went through the community of BlackBerry users recently when a consultant showed off a way to use the popular wireless technology to circumvent a network's defences and attack its core computers.
Research In Motion Ltd., which boasts more than 5.5 million BlackBerry subscribers worldwide, has never experienced a major attack on its system.
But the demonstration at a notorious hacker's convention in Las Vegas last month showed how a special program running on a BlackBerry could give an attacker surreptitious access to the user's network.
"An attacker could utilize many typical corporate BlackBerry deployments to directly attack machines on the internal network -- behind your perimeter defences," said Jesse D'Aguanno, director of research and professional services at Praetorian Global LLC. The Placerville, Calif.-based consultancy specializes in information technology risk management.
Mr. D'Aguanno created an attack program called BBProxy, which he said could penetrate computers behind a corporate firewall once it is installed on a BlackBerry device.
This type of program is commonly known as malware, or Trojan software, and does its damage after an unsuspecting user loads it onto a computer, often by opening an e-mail attachment.
RIM, based in Waterloo, Ont., has used the extensive security features of its devices as a selling point for corporations and government organizations particularly sensitive about securing their data.
Its technology has been approved for storing and transmitting sensitive data by several governments, including those in Canada and Britain.
RIM concedes that attackers might try to use malware to access a network via a BlackBerry, and to steal data or create a denial of service attack to make a network unusable.
But the company says the threat demonstrated by Mr. D'Aguanno can be prevented by using the correct settings built into its software that sits behind the firewall, called BlackBerry Enterprise Server.
While RIM software does not inspect or verify third-party programs that run on BlackBerry devices, it does control the access they get to the user's network and information on it.
An IT administrator in charge of an organization's BlackBerry deployment can adjust settings to control what third-party programs are loaded and run on BlackBerrys. By not allowing a user to download attachments to the handheld unit, an administrator would prevent Trojan software arriving via e-mail attachment.
He can also set rules that allow or disallow third-party software to make an external connection from a BlackBerry. Finally, he can adjust settings to determine whether the mobile system gets access to various systems on an internal network.
"These containment methods are designed to prevent malware that might gain access to the BlackBerry device from causing damage to the device, its applications and its data, or to the corporate network," RIM said in a document titled "Protecting the BlackBerry Device Platform Against Malware."
The paper is one of two posted on the company's website at blackberry.com/security in response to Mr. D'Aguanno's claims.
RIM also said it was unfair to single out its system as more susceptible to attack from the BBProxy than any other of the plethora of wireless e-mail offerings on the market.
"The type of malware exploit demonstrated is not unique to BlackBerry and is possible from any mobile device, including smart phones, PDAs and laptops," the company said.
The importance of establishing the right settings is especially critical for IT departments using BlackBerry Enterprise Server because of the level of data encryption RIM uses between a BlackBerry and server.
RIM offers two advanced levels of data encryption, called Advanced Encryption Standard and Triple Data Encryption Standard, which make information in transit unreadable.
The technology creates two private encryption keys. One sits on the BlackBerry handheld and the other is stored on the secure e-mail software inside the user's organization. Data remains encrypted in transit and is only decipherable at either end with the two keys.
The downside is that the encryption also prevents IT managers from detecting the malicious type of file trying to penetrate the network.
RESEARCH IN MOTION LTD.
