A group of security researchers has discovered a simple attack that enables them to intercept Internet traffic moving over a wireless network using gear that can be picked up at any electronics store and an easily downloadable piece of freeware.
Its the stuff of Popular Science. A group of security researchers has discovered a simple attack that enables them to intercept Internet traffic moving over a wireless network using gear that can be picked up at any electronics store and an easily downloadable piece of freeware.
The attack, accomplished by @Stake Inc., a security consulting company in Cambridge, Mass., affects a popular consumer version of Research In Motion Ltd.s BlackBerry devices as well as a variety of handhelds that send unencrypted transmissions over networks such as Mobitex.
By design, the Mobitex specification, like other wireless standards such as Global System for Mobile Communications and General Packet Radio Service, sends packets in unencrypted form. The network, which handles data transmissions only, has been in operation since 1986 and has a large base of installed devices, with customers using it for everything from point-of-sale verification to e-mail.
"The attack is fairly simple," said Joe Grand, one of the researchers who perfected the technique. "The problem is, this isnt a bug. Its part of the spec that data is transmitted in the clear, just like its part of the spec that Internet data is transmitted in the clear. The risk depends on who is using the network and when and what data theyre sending."
Using a scanner with a digital output, an antenna and freely downloadable software, the researchers were able to intercept traffic destined for BlackBerry Internet Edition devices. And, because the packets arent encrypted, the attackers can read the messages they intercept without further work.
The Internet Edition handhelds are sold mainly through co-branding relationships with ISPs such as AOL Time Warner Inc.s America Online service, EarthLink Inc. and Yahoo Inc.
Executives at RIM said they dont see the attack as a problem because they have never touted the Internet Edition devices as being secure.
"Internet traffic isnt supposed to be secure," said Jim Balsillie, chairman and co-CEO of RIM. "Its kind of like a company making beer and cola and someone saying that theres alcohol in the companys drinks when the children are drinking cola."
However, the attack serves as a reminder to users that e-mail and other Internet traffic is open to snooping and is inherently insecure.
"I always figure that anything thats sent via e-mail can be read by at least hundreds of people which have either legitimate or compromised access to systems sitting between me and my recipient; this just adds another potential access point," said Christopher Bell, chief technology officer of People2People Group, a relationship services company in Boston, and a user of the BlackBerry Internet Edition. "I am disappointed that they didnt make at least a modest attempt to obscure the content."
Balsillie said the messages are only as secure as the networks of the ISPs that relay them, none of which provide encrypted e-mail.
Chris Darby, CEO of @Stake, said RIM has done a thorough job including security in its other devices, which use a server that sits behind corporate firewalls.
"RIM is incredibly progressive about the way theyre addressing security in their Enterprise Edition," Darby said.
The attack also applies to other devices on the Mobitex network, many of which are proprietary solutions developed for in-house corporate uses.
This attack does not work on the BlackBerry Enterprise Edition, which uses Triple Data Encryption Standard encryption in addition to other security features, @Stake officials said.
"Typically, Mobitex operators will advise customers that they should choose the security scheme that fits their particular needs," said Jack Barse, executive director of the Mobitex Operators Association, based in Bethesda, Md. "It was a conscious decision not to put network-level security in because customers have said that they dont want the overhead associated with security if theyre just doing things like instant messages. Customers can absolutely add on their own encryption to whatever application theyre using [the network] for. And we encourage that."
Related stories:
Living with Worms, Viruses and Daily Security
Programs Design Is No. 1 Cause for Flaws
RIM Gives BlackBerry a Voice
Network Security & Hardware 
