Some of the media coverage to date has described Tyler Shields' proof-of-concept spyware as a "BlackBerry hack", much to our chagrin. In this blog post, we'd like to clarify some of the misconceptions that have surfaced both in the media and in the BlackBerry user community. Feel free to post additional questions in the comments section and we'll do our best to respond.
Q: This isn't a real hack, is it? Tyler's program is similar to many applications already on the market.
We've tried to make it clear from the beginning that txsBBSpy is a demonstration of public, documented APIs and should not be considered a hack, an exploit, or a vulnerability in the BlackBerry OS or infrastructure. There are many commercial apps, including FlexiSpy, SmrtGuard, Mobile Spy, and others, all of which utilize the same BlackBerry APIs. But these apps must be purchased, and they're only available in compiled form.
What's notable about txsBBSpy is that we've released source code to demonstrate how the application works. This serves as an educational resource as well as an eye-opener showing how simple it is to implement malicious functionality.
Q: Is the spyware risk unique to BlackBerry?
Not at all, it's just the platform we decided to research. Similar work has been done on other mobile platforms such as iPhone, including this presentation from Nicolas Seriot delivered at BlackHat 2010 in Washington, DC last week. His proof-of-concept application, SpyPhone, takes the same approach as txsBBSpy by demonstrating what can be accomplished using public APIs. Any mobile platforms that can run third-party applications have similar risks.
Q: Wouldn't you still have to trick a human into installing the spyware?
Yes, but this doesn't negate the risk. Consider the parallel in the PC world. People inadvertently install spyware on their computers because they wanted a cool toolbar or because some message told them they were supposed to. Users make bad choices. If they didn't, we wouldn’t have a multi-billion dollar anti-virus industry.
The same risks apply to mobile devices. People will install applications. It's fair enough to say that most users wouldn't install an app called txsBBSpy, but many would happily download a game featuring dancing bears. All joking aside, there is nothing to prevent an otherwise legitimate program from including unadvertised, malicious functionality. What assurances do you have that the Twitter client, RSS aggregator, or video game that you installed on your BlackBerry isn't also stealing your emails or intercepting your text messages? Case in point, the Etisalat spyware would have gone completely unnoticed had it not been for a poorly architected "phone home" routine.
Q: RIM requires all apps to be signed. Doesn't that protect against the spyware risk?
Not at all. It's a minor hurdle at best. Anyone with $20 and a name (doesn't have to be your actual name) can get a code signing key. There are plenty of ways to obtain a key anonymously, if you think hard enough; Tyler alluded to a couple during his ShmooCon presentation.
Once a developer has a key, he simply submits a SHA-1 hash of the .cod file to RIM, who will respond back with a RIM signature which gives the application permission to use the requested controlled APIs at runtime. RIM never receives the source code or the compiled application, so they have no way of inspecting its functionality. Further, there is no revocation list for malicious applications. If a developer releases a malicious application, RIM can refuse to sign his apps in the future, but they can't prevent an app from running once it's been signed, nor can they prevent the developer from obtaining another anonymous key and creating additional code any time he wants.
Q: Isn't this whole thing overblown, since BlackBerry users can set permissions for each app they install?
The BlackBerry OS does provide granular controls for application permissions that are configurable by the user. Access to connections, interactions, and user data are split into about 20 categories, each of which can be set to Allow, Deny, or Prompt. The problem is that most users don't take advantage of these features. According to a Trend Micro survey of 1,016 U.S. smartphone users in June 2009, only 23% of smartphone owners use the security software installed on the devices. During a webinar we held earlier today, we posed this question to attendees: "Do you enable application level security for each application on your BlackBerry device?" Only 15% of attendees answered yes, and that's for a technical audience. I'd assume the number would be well below 15% across a representative sampling of BlackBerry users.
The other misconception around application permissions is that you'll always be prompted before the application can access any user data. In reality, the DEFAULT application permissions in both the 4.x and 5.0 BlackBerry OS allow third-party applications to access emails, organizer data (contacts, etc.), files, device settings, media, and many other categories without prompting. Tyler's slide deck provides a complete listing of default permissions for third-party apps.
Now, the defaults are already pretty loose, but the OS is even more permissive for applications that have been granted "trusted" status. At installation time, the user is asked "Is this a trusted application?" and if they answer "Yes", the application is given even greater freedom to access phone connections, location data, the Internet, and more, without further prompting. Users don't think twice about granting trusted access because they hate being inconvenienced by prompts every time the app wants to do something. How does a user know whether or not it's safe to give an application trusted status?
Q: Aren't enterprise users immune to spyware, due to BES features that prevent unwanted applications from being installed?
IT Policies on the BlackBerry Enterprise Server (BES) can be configured to restrict which third-party apps employees can install, but this raises a similar question: how does the IT staff know whether or not to whitelist an application? They have no way to objectively assess whether they should trust the application.
Q: Don't the mobile app stores already screen applications for spyware before making them available for download?
The app stores have a unique opportunity to screen submitted applications for malicious behavior, but none of them have come out publicly saying that they do so. There are several references in Tyler's presentation of malicious apps that have been accepted into various mobile app stores, so we know that the screening processes are not rigorous. Anecdotally, we know that RIM is concerned mostly with ensuring that third-party applications do not crash the operating system. From media reports, we know that the iTunes App Store is concerned with profanity, supposed "misuse" of Apple trademarks, and apparently even mentioning the names of other handsets (but harvesting phone numbers is fine).
The intersection of bad user behavior and app store inaction creates a target rich environment for malicious mobile applications.