Careless downloading makes BlackBerry users spy targets

A security researcher said downloading foreign applications to a BlackBerry leaves you vulnerable to spies

IPhone lovers and other smartphone users should take heed: A security researcher showed ways to spy on a BlackBerry user during a presentation Wednesday, including listening to phone conversations, stealing contact lists, reading text messages, taking and viewing photos and figuring out the handset's location via GPS.

And ironically, Sheran Gunasekera, head of research and development at ZenConsult, said the BlackBerry is one of the most secure smartphones available, in some ways better than the iPhone.

"There is no technical way of hacking a BlackBerry, it's impossible," said Gunasekera, during a presentation at the Hack In The Box security conference in Kuala Lumpur. "It's just too secure for that. So we have to rely on social engineering."

For hackers, social engineering is the art of tricking someone into loading spyware onto a device or finding some other way to install it, such as borrowing the device and downloading malware from the Internet or a MicroSD card, for example.

One way to entice a BlackBerry user to download spyware onto their smartphone is by offering a free application that appears to be a game or some other harmless software, but in fact carries a dangerous payload. Enticing slideshows are even easier to get users to accept, Gunasekera said.

"I will have the slideshow running on top and the spyware doing its nastiness on the bottom," he said.

What kind of nastiness?

A small piece of software able to conceal itself by not appearing on the BlackBerry's application menu, nor taking up much memory space nor using much processing power, can allow a hacker to do all kinds of things.

"People tend to put a lot of personal data on a BlackBerry," he said, but it's not just the data on the phone that's at risk.

Spyware on a BlackBerry could intercept a phone call and let the hacker listen in, or even let the hacker listen to a meeting the victim is sitting in on. By silently answering the victim's phone, then turning on the speakerphone, the spyware could allow the hacker to overhear the meeting. It could also forward incoming and outgoing text messages to the hacker, and even enable the hacker to write messages from the victim's BlackBerry, or run up the victim's phone bill by making international calls.

The hacker could also program the spyware to have the handset's camera take pictures every 10 seconds, for example, to see find out the victim's location.

One recent example shows a massive installation of spyware on BlackBerry phones in the United Arab Emirates.

Regional mobile phone service provider Etisalat last June told its 145,000 BlackBerry subscribers to download a software upgrade that turned out to be spyware. Once users downloaded the "upgrade," it forwarded the phone's e-mails to a central server, Gunasekera said. The ploy was discovered because the software drained BlackBerry batteries at an excessive rate, in as fast as 30 minutes after a full recharge.

Etisalat maintains the software was an upgrade.

BlackBerry manufacturer Research In Motion (RIM), however, took matters into its own hands and provided a fix to affected users.

"Independent sources have concluded that Etisalat's "Registration" software application is not actually designed to improve performance of a BlackBerry Handheld, but rather to send received messages back to a central server," RIM said on its Web site.

Gunasekera offered a range of advice to help people keep their BlackBerries secure, advice useful to most smartphone users.

"Don't install random pieces of software," he said, "and be sure of what you're installing, and limit the amount of software on your BlackBerry."

It's also not a good idea to let anyone else use your smartphone, he said, but if you do hand over your phone, keep an eye on it. He also implored people to learn and set Default Application Permissions on their BlackBerries, a feature that increases safety. And always enable a device password. "This is the least you can do in case your device is lost or stolen," he said.

He also suggested that RIM start regulating Apps made for BlackBerries.

"People complain about Apple and their application process for the App Store, but it's good for security because you have people actually looking at the code," he said. RIM needs to put third-party apps aimed at BlackBerries under the same scrutiny, he said.

A RIM security researcher sent to the Hack In The Box conference to view the presentation declined to comment, but said the company planned to issue a statement later in the day.

Join the CSO newsletter!

Error: Please check your email address.

Tags Blackberrysecurity

More about AppleBlackBerryMotionResearch In MotionResearch In Motion

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Dan Nystedt

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts