Blackberry JAVA DEVELOPMENT ENVIRONMENT - - FUNDAMENTALS GUIDE Especificaciones descargar pdf (Pagina 27)

Attack Surface Analysis of BlackBerry Devices

Backdoor

A malicious application could establish a connection to the attacker, and then accept commands that would

allow the attacker to access and modify sensitive data, and initiate further connections and messages.

Port Scan

Since an application can open sockets, it can perform a TCP scan on a network host or a range of network

hosts. Depending on the network configuration, this could include scanning the internal network (via MDS).

In a proof of concept implementation, the performance of such a TCP connect scan was measured (Non MDS

using GPRS). Here are the results:

Note that increasing the number of concurrent threads greatly increases the scan rate. Performance may

vary depending on a number of factors, such as the target configuration (e.g. whether the target responds

to connection requests on closed ports or simply drops the packets) and the Network Operator/Network

Coverage. The numbers above were recorded while scanning a target which responded to connection

attempts on closed ports. While this is not the most efficient way to scan a network, judging by these fig-

ures it is feasible.

Mitigation

You can set the following options to mitigate the attacks outlined above. See Mitigation Strategies for more

information.

Number of threads Number of ports Elapsed time Scan speed

1 200 351.4 seconds 34.15 ports/minute

4 200 69 seconds 173.91 ports/minute

IT Policy "Allow External Connections" = False

"Allow Internal Connections" = False

Application Controls "External Domains" = [list of allowed domains]

"External Network Connections" = Not Permitted

"Internal Network Connections" = Not Permitted

Device Firewall Status = Enabled

Application Permissions Connections > Carrier Internet = Deny

Other Device Settings

1 2 ... 22 23 24 25 26 27 28 29 30 31 32 ... 38 39

Sin comentarios

Blackberry JAVA DEVELOPMENT ENVIRONMENT - - FUNDAMENTALS GUIDE Especificaciones Pagina 27