The BlackBerry has a fully functioning network stack
that implements the MIDP 2.0 networking APIs, including raw and secure
socket support and an HTTP library. Although the APIs may be the same in
signature, there are some important security differences underneath.
This section enumerates the security strengths and weaknesses in the
BlackBerry network stack.
Device Firewall
The BlackBerry does not have a
standard network firewall, but this is not uncommon because most mobile
devices do not listen on the network. Instead, the BlackBerry has a
messaging firewall that can be used to block unwanted e-mail, SMS, and
BlackBerry Internet Service (BIS) messages. When the firewall blocks a
message, it is simply not shown to the user. All messages can be blocked
or the set of allowable addresses can be restricted to those in the
owner’s address book. If content protection of the address book is
enabled, it is not possible to restrict incoming messages by address.
This restriction happens because the firewall does not have access to
the password-derived AES key required to unlock the address book.
The firewall provides a real
security benefit for keeping spam and malicious messages off the device.
The only downside is that you may not receive those enticing offers for
products you didn’t even know you wanted.
SSL and WTLS
To communicate with the
Internet and corporate intranet, the BlackBerry creates an encrypted
tunnel with either BIS or the enterprise’s BES. By default,
SSL/Transport Layer Security (TLS) connections are terminated at the
server; then the response is compressed and sent to clients. This is
more risky than standard end-to-end SSL/TLS because the BlackBerry
server is acting as a man-in-the-middle and could act maliciously or be
compromised. Thankfully, the BlackBerry now supports proper end-to-end
SSL/TLS.
Follow these instructions to enable proper SSL/TLS:
Open Options | Security Options | TLS.
Change the TLS Default setting from Proxy to Handheld.
Set the Encryption Strength to Strong Only.
Ensure
that Prompt for Server Trust and Prompt for Domain Name are set to Yes.
If these options are not enabled, the browser will not prompt when the
server’s certificate is untrusted or does not match the domain name.
Now that proper SSL/TLS is
enabled, it’s time to change the configuration of its wicked cousin,
WTLS. WTLS is a proxy encryption protocol that is popular among mobile
phones that do not have a lot of processing power or bandwidth to
perform encryption operations. BlackBerry devices no longer fall into
this category, so leaving weak versions of WTLS enabled is an
unnecessary risk.
To disable weak WTLS, follow these steps:
1. | Open Options | Security Options | TLS.
|
2. | Change Encryption Strength to Strong Only.
|
3. | Make sure that Prompt for Server Trust is set to Yes.
|
