Blackjacking is a technique used to connect internally to a corporate network using a typical BES device. It was announced at DefCon a few years back and is hardly new.
How does this work, and what are the ways to reduce risk from this exploit?
asked Aug 26, 2010 at 20:34
Add a comment
|
2 Answers
In short... exploiting a blackberry device or BES... to attack your LAN directly. There's several ways of accomplishing it. Email-based exploited PDFs are probably most common, as they can affect the BES server directly or turn the endpoint into a proxy for attacks. What most people don't realize is that a BES server will proxy ALL traffic for any device registered to it. If the BES server is not properly kept in a secure DMZ, you can use the server to attack your network from the inside.
If a handset is exploited (using any means), anything your BES server is attached to can be attacked. Any mail or other communications processed by the BES server could also potentially also exploit the BES server and use it as a proxy.
-
I thought that the PDF exploits for BES were targetted at the attachment viewer running on the BES itself. I'm not aware of any which result in malware running on the handset and using "blackjacking" style connections. Of course this is something you should be concerned about as well, but it looks much more like familiar malware when it's running on your server - e.g. you have antivirus options.– AdamAug 27, 2010 at 9:55
-
Yes & no. The most common attack the BES server itself, but there have also been attacks done on handsets using malformed PDFs too. There have even been successful attacks targeting a specific users' device via bluetooth. Unfortunately the benefits of BES are also it's weaknesses. Integration with Active Directory... also potentially allow hackers access to Active Directory... Just keep in mind that almost anything your BES has access to... so does a handset. I purposely treat my BES as a "hostile" target in my firewall. Aug 27, 2010 at 14:17
A blackberry device which is connected to a BES server has a VPN to the network that the BES is connected to. This is often used as a feature, e.g. to deploy internal applications directly to Blackberry handsets. But it means that any application running on the handset potentially has access to the network. So if an attacker can get you to install a malicious app then this is essentially running inside your firewalls.
There are a number of preventative measures that you can take.
- Block the installation of any apps on the device
- This prevents any malicious apps from getting onto the device
- Limit the rights of apps when they are installed
- The ability to use the internal network can be allowed or denied for each app. Either by the user when they install it, or by the administrator through IT policies
- Place the BES in a different network segment
- You can keep the BES away from your internal network, and use your firewall to limit the access that it has to internal servers. You'll need to ensure that it can connect to your mail servers, and RIM's support for this configuration is limited (See Placing the BES in a segmented network)
I'm not aware of any Blackberry device based exploits in the wild, but I would definitely recommend doing as much of this as possible in your environment.
