Blackjacking: Security Threats to BlackBerry^® Devices, PDAs, and Cell Phones in the Enterprise

by Daniel V. Hoffman

• ISBN13: 9780470169766
• ISBN10: 0470169761
• Format: eBook
• Copyright: 2007-07-01
• Publisher: Wiley

Summary

Is someone waiting to pick off your BlackBerry? Today, it is almost impossible to do business without a cell phone and a BlackBerry or PDA. These devices are a lifeline for companies large and small. And nobody knows this better than a hacker. Traditionally, security for mobile devices-which are essentially portable computers loaded with sensitive corporate and client information-has had low priority. Now, a certified ethical hacker explains why this must change and how to change it. Packed with sobering examples of actual attacks, this book shows you how to mount your counterattack. Understand each type of mobile device and the nature of the threat to each Recognize and implement a strong security strategy Identify specific threats to BlackBerry devices Learn from analysis of actual exploits Be able to anticipate future forms of attack See how hackers create and modify their assaults Defend against physical compromise and contamination from PC or LAN connectivity

Table of Contents

About the Author

Acknowledgments

Introduction

Understanding the Threats

Quantifying the Threat

The Malware Threat

Direct Attack

Data-Communication Interception

Authentication Spoofing and Sniffing

Physical Compromise

Mobile Device Enterprise Infrastructure

PC and LAN Connectivity

Fundamental Changes in Security Strategy

Protecting the Mobile Device Itself

Enforcing Compliance on the Mobile Device

Addressing Security Deficiencies Automatically

Implementing Layered Security

Controlling and Protecting Data

Things to Remember

Understanding the Devices

BlackBerrys

BlackBerry Business Phones

BlackBerry Handheld Devices

BlackBerry-Enabled Devices

Pocket PCs

Dell Axim Pocket PCs

HP Pocket PCs

Palm Pocket PCs

Motorola Pocket PC

Palm Handhelds

Palm Smartphones

Cell Phones

Symbian OS Cell Phones

Non-Symbian OS Cell Phones

Things to Remember

Exploiting BlackBerry Devices

Malware Is Threatening Your BlackBerry

Analyzing a Malware Attack

Gathering Information

Setting Up for the Attack and Covering His Tracks

Launching the Attack

Protecting Against This Attack

Learning about New Vulnerabilities

BlackBerry Antivirus Software

Attacking a BlackBerry Directly

Attacking via IP Address

Attacking via Malware

Antimalware Applications

Enterprise-Grade Firewall with IDS/IPS

The BlackBerry Firewall

Ensuring the Device Has the Latest Updates

Educating Users about Risks

Intercepting BlackBerry Communication

What Data Is Being Transmitted?

How Is Data Being Transmitted?

Carrier Internet Access

Bluetooth

The BlackBerry Wi-Fi Interface

Physically Compromising a BlackBerry by Spoofing and Intercepting Authentication

How Physical Compromise Happens

Preventing Physical Compromise

Protecting a Stand-Alone BlackBerry

Preventing Unauthorized Access

The Truth About Wiping A Lost or Stolen BlackBerry

Implementing Content Protection

Spoofing and Intercepting Authentication

BlackBerry Security Checklist

Things to Remember

Hacking the Supporting BlackBerry Infrastructure

Good and Bad: A Conduit to Your LAN

Understanding the BlackBerry Infrastructure

BlackBerry Infrastructure Components

Infrastructure Design Considerations

Attacking the BlackBerry Infrastructure

The Attacker's Side of the Story

Insecure Server Configuration

Insecure Topology

BBProxy

Things to Remember

Protecting Your PC and LAN from BlackBerrys

Controlling Data Is Critical

How Companies Lose Control of Data

How to Control Data

Create and Communicate a Formal Policy

Enforce Security Policies with Available Technology

Threats from BlackBerry-Provided Internet Access

Internet Attack

The Attacker's Side of the Story

Preventing the Attack

Stay Up-to-Date with Patches

Use a Personal Firewall

Controlling Data Coming from a BlackBerry

Analyze the Data Coming from the BlackBerry

Analyze the Data as It Resides on the BlackBerry

Control Which Devices Can Connect to Your Enterprise PCs

Things to Remember

Exploiting PDAs

Corrupting Your PDA with Malware

Backdoor Malware for the Pocket PC

Other PDA Malware

Table of Contents provided by Publisher. All Rights Reserved.