http://www.eweek.com/article/0,3658,s=1884&a=23806,00.asp March 11, 2002 By Dennis Fisher and Carmen Nobel It's the stuff of Popular Science. A group of security researchers has discovered a simple attack that enables them to intercept Internet traffic moving over a wireless network using gear that can be picked up at any electronics store and an easily downloadable piece of freeware. The attack, accomplished by @Stake Inc., a security consulting company in Cambridge, Mass., affects a popular consumer version of Research In Motion Ltd.'s BlackBerry devices as well as a variety of handhelds that send unencrypted transmissions over networks such as Mobitex. By design, the Mobitex specification, like other wireless standards such as Global System for Mobile Communications and General Packet Radio Service, sends packets in unencrypted form. The network, which handles data transmissions only, has been in operation since 1986 and has a large base of installed devices, with customers using it for everything from point-of-sale verification to e-mail. "The attack is fairly simple," said Joe Grand, one of the researchers who perfected the technique. "The problem is, this isn't a bug. It's part of the spec that data is transmitted in the clear, just like it's part of the spec that Internet data is transmitted in the clear. The risk depends on who is using the network and when and what data they're sending." Using a scanner with a digital output, an antenna and freely downloadable software, the researchers were able to intercept traffic destined for BlackBerry Internet Edition devices. And, because the packets aren't encrypted, the attackers can read the messages they intercept without further work. The Internet Edition handhelds are sold mainly through co-branding relationships with ISPs such as AOL Time Warner Inc.'s America Online service, EarthLink Inc. and Yahoo Inc. Executives at RIM said they don't see the attack as a problem because they have never touted the Internet Edition devices as being secure. "Internet traffic isn't supposed to be secure," said Jim Balsillie, chairman and co-CEO of RIM. "It's kind of like a company making beer and cola and someone saying that there's alcohol in the company's drinks when the children are drinking cola." However, the attack serves as a reminder to users that e-mail and other Internet traffic is open to snooping and is inherently insecure. "I always figure that anything that's sent via e-mail can be read by at least hundreds of people which have either legitimate or compromised access to systems sitting between me and my recipient; this just adds another potential access point," said Christopher Bell, chief technology officer of People2People Group, a relationship services company in Boston, and a user of the BlackBerry Internet Edition. "I am disappointed that they didn't make at least a modest attempt to obscure the content." Balsillie said the messages are only as secure as the networks of the ISPs that relay them, none of which provide encrypted e-mail. Chris Darby, CEO of @Stake, said RIM has done a thorough job including security in its other devices, which use a server that sits behind corporate firewalls. "RIM is incredibly progressive about the way they're addressing security in their Enterprise Edition," Darby said. The attack also applies to other devices on the Mobitex network, many of which are proprietary solutions developed for in-house corporate uses. This attack does not work on the BlackBerry Enterprise Edition, which uses Triple Data Encryption Standard encryption in addition to other security features, @Stake officials said. "Typically, Mobitex operators will advise customers that they should choose the security scheme that fits their particular needs," said Jack Barse, executive director of the Mobitex Operators Association, based in Bethesda, Md. "It was a conscious decision not to put network-level security in because customers have said that they don't want the overhead associated with security if they're just doing things like instant messages. Customers can absolutely add on their own encryption to whatever application they're using [the network] for. And we encourage that." - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Wed Mar 13 2002 - 04:28:17 PST