The Hacker News Logo
Subscribe to Newsletter

Hackers Exploit BlackBerry Browser Bug !

Research in Motion has found a security flaw and recommended that user disable JavaScript in browsers on certain phones, threatening the BlackBerry maker's iron-clad reputation for security.

"The issue could result in remote code execution on affected BlackBerry smartphones," the Waterloo, Ontario-based company said. "Successful exploitation of the vulnerability requires the user to browse to a website that the attacker has maliciously designed."

The flaw is in the WebKit browser that RIM includes in version 6 of its BlackBerry OS.

RIM said hackers can steal data from users' memory cards on some BlackBerry devices. They can also install malware by exploiting the hole, but the company said that even if attacked, the phone's emails and contacts would be safe.

The publicity is particularly bad for the company who stakes its reputation on the security and privacy of its service. RIM, which has been forced to use more third-party software to compete with the flashy features of other platforms, provides more targets to hack.

The vulnerability was discovered at the "Pwn2Own" hacking contest last week. Although the contest winners were not allowed to publicize specifics of the vulnerabilities until companies have patched them, it's possible that malware authors are already aware of it.

An iPhone 4 was also hacked during the contest.

The contest could actually help RIM, though, if it drives focus on security. According to the coders who discovered the flaw, RIM's smartphone software doesn't make use of some important security techniques, and the company is heavily reliant on "security by obscurity," the fallible strategy of hiding how software works to keep hackers at bay.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.
SHARE
Comments
Latest Stories
Best Deals

Newsletter — Subscribe for Free

Join over 500,000 information security professionals — Get the best of our cyber security coverage delivered to your inbox every morning.