Attacking Blackberry For Phun and Profit

Attacking BlackBerryfor phun and profit

y3dips[et]echo.or.id

Sunday, November 8, 2009

y3dips

• A Bandwidth Hunter ... A Renegade

• IT Security fans for more than 7 year

• http://google.com/search?q=y3dips


http://google.com/search?q=y3dips

http://google.com/search?q=y3dips

BlackBerry

• Push Email

• Wireless Messaging System

• Phone, SMS, Cameras, Browsing


• Photos

• Emails

• Sms

• Phone log

• Contact

BlackBerry


BlackBerry

• BlackBerry Enterprise Server (BES)

• BlackBerry Internet Service (BIS)


Diagram

http://smartphone.nttdocomo.co.jp/english/blackberrybold/blackberryservice/img/index/dgm_diagram.gif


BB Proxy

• Attack BES network

• Defcon 2006 presented by Jesse D’aguanno

• Making a Blackberry Device as a gateway to internal Network


Attacking Anatomy

INTERNET

INTERNAL LAN

Attacker

BB UserApps ServerServer

Firewall


Attacking Anatomy

INTERNET

INTERNAL LAN

Attacker

BB User

Firewall

Apps ServerServer

Connecting into Attacker Computer


Attacking Anatomy

INTERNET

INTERNAL LAN

Attacker



Connecting into App Server

Firewall


Attacking Anatomy

INTERNET

INTERNAL LAN

Attacker


Connecting into App Server


Attacker 0wned Internal Network

Device as a proxy

Firewall


Our Approach

• Attacking Wifi Network

• DNS Spoofing

• Ssl Tunneling - http://stunnel.org

• BlackBag - http://matasano.com


http://blackbag.darwinport.org

http://blackbag.darwinport.org

DNS Spoofing

• Spoof dns entry into router/dns server# echo “133.7.133.7 rcp.ap.blackberry.com” >> /etc/hosts


DNS Spoofing


Stunnel

• Setup 2 SSL connection

• SSL Connection from BB device to Attacker machine

• SSL Connection from Attacker machine to BB Real Server


Stunnel

# stunnel -d 443 -r localhost:8888

# stunnel -c -d 8889 -r 216.9.240.88:443

• Setup 2 SSL connection


BlackBag

• Glue the tunnel back

# bkb replug -b localhost:8889@8888


BlackBag


Attacking Anatomy

RIM Network

DNS Server

WIFI

rcp.ap.blackberry.com216.9.240.88

search rcp.ap.blackberry.com

Attacker - 133.7.133.7


Attacking Anatomy

RIM Network

DNS Server

Attacker - 133.7.133.7

WIFI





Attacking Anatomy

RIM Network

Tcp/8888Tcp/443

Tcp/8889

Tcp/443

DNS Server

WIFI




Attacker - 133.7.133.7


Viewable


Result


Result

• Clear Text Sender PIN

• Clear Text Recipient PIN

• Clear Text Message type

• Encrypted Data


Impact

• Spam? until DDOS

• PIN abuse; such as cloning

• Blackmail; identity thief, logs

• Email and PIN Mapping


Next

• More Data to analyze (different type)

• Attack the Encryption?

• Another Infrastructur attacking Scenario


Confession


Raw Data


Mal(Spy)ware

• The Most Famous Etisalat Issue

• Firmware Update

• Reverse by some researcher

• 100% Spyware


Mal(Spy)ware


POC

• Provided by Sheran Gunasekera @HITB 2009

• Bugs - Forwarding Emails

• PhoneSnoop - Turn your BB into Spy devices

• http://chirashi.zensay.com


http://chirashi.zensay.com

http://chirashi.zensay.com

Bugs


Summary

• 0wned a blackberry with $20 (USD)

• Social Engineering rulez!

• BlackBerry User awareness


Case Stories


Mitigation

• Password Your Device

• Turn On Firewall

• Encrypt your Data/Media Card

• Controlling downloded application

• Protecting GPS location

• Connect to Legitimate Wifi Network


References

• Attack Surface Analysis of Blackberry Devices - symantec

• BlackBerry: Call to Arms, some provided - Ftr & FX of Phenoelit

• BlackJaking:0wning the Enterprise via BlackBerry - x30n

• Bugs & Kissess: Spying on Blackberry User for Fun - Sheran Gunasekera

• Seberapa Amankah Infrastruktur WIFI Blackberry device anda - y3dips & chopstick


Greetz

• Hermis Consulting

• Sheran Gunasekera

• [email protected]

• Info Komputer


mailto:[email protected]

mailto:[email protected]

Attacking Blackberry For Phun and Profit

Technology

Transcript of Attacking Blackberry For Phun and Profit