Robert Siciliano explains how BlackBerry Enterprise Server administrators can accidentally open the door to hackers. A misconfigured setting lets users download files that deliver Trojan payloads, giving attackers access to corporate email at the server level. The iPhone is already showing similar vulnerabilities.
Chapters
Well, the French call it a security threat, and a Clinton strategist is being sued over one. We're talking about the BlackBerry. And if you think your email is safe, think again. In Boston, Robert Siciliano, CEO of IDTheftSecurity.com. Robert, we've been talking about this all day, but we don't know the exact specifics. What's happening here? Why is the— why are the emails not safe?
The issue here is that someone is responsible for handling the administration of a BlackBerry Enterprise Server, and that administrator can set controls allowing the user to download certain files that may have a, uh, destructive payload. They could, uh, receive an email that has a Trojan virus in it downloaded onto that PDA that— or that BlackBerry— that when it's launched, it will allow that hacker to monitor and access the emails that that recipient is receiving and to actually be able to monitor corporate communications at the server level.
Alright, so what would we worry about then? Espionage between companies, something like that? Information not being safe? It sounds like it's mostly in the corporate workspace. As an individual, do I have to worry about my own, you know, things that I might have about myself, or is it more for corporate?
Well, it is for both. Obviously, if you're an individual and you have a BlackBerry, more than likely that device is being used through a corporate network. And what you want to make sure is, is that at the corporate level, the IT administrator has set the controls on that enterprise server so that if in fact third-party programs are downloaded and installed, that they can't corrupt that information. If there are the options available to download files, that if it can in fact infect your device and infect the corporate network, then more than likely they're going to prevent that from happening. As an individual, you do have to pay attention to find out what at the corporate level they are doing to secure that information.
So it's got nothing to do with RIM either. They're not liable for any of this. It has to do with your own company and, and what kind of security system they have set up on the server?
Exactly. The corporation who you have this device through, they're responsible for setting the controls. They have multiple layers of security that they could administrate to prevent these things from happening, to prevent malware from being downloaded and installed by third parties.
Why does BlackBerry say it's safe? And is the iPhone safe?
Well, the iPhone, they're finding additional hacks. You know, they've just launched this device, and right off the bat, hackers have tore those devices apart to find out how they tick. And they're already finding vulnerabilities, and they'll continue. Security is a process. It's a journey. It's a constant evolving process. So as long as these devices are in in use, hackers, black hat hackers, even white hat, they're gonna try to find what those vulnerabilities are, try to penetrate those networks, and in turn try to find secure— means to secure them as well.
All right, Robert Siciliano, thanks for your time today.
