BlackBerry Device Software. Protecting BlackBerry Smartphones Against Malware. Security Note

Transcription

1 BlackBerry Device Software Protecting BlackBerry Smartphones Against Malware Security Note

2 Published: SWD

3 Contents 1 Protecting smartphones from malware System requirements Managing the risk of malware attacks... 6 Using BlackBerry Enterprise Solution tools to protect smartphones from malware Installing and managing applications on smartphones... 7 Creating an application for a smartphone... 7 Specifying the methods that users can use to install applications on a smartphone Using IT policy rules to help protect smartphones from malware... 9 Creating new IT policy rules to control applications that your organization creates IT policy rules take precedence on smartphones Specifying the resources that applications can access on a smartphone Using application control policy rules to control the resources that applications can access on a smartphone Using application control policy rules to specify the types of connections that applications can open Application permissions for applications that users install on a smartphone Application permissions for applications that users install as trusted applications on a smartphone Application control policy rules How code signing controls the resources that applications can access on a smartphone Permitting an application to encode data on a smartphone Best practice: Controlling the resources that applications can access in your organization's network Managing third-party applications on a smartphone that a user uses for personal purposes Removing applications from smartphones Removing applications that a user installed when a user deletes all smartphone data Using a segmented network to help prevent the spread of malware Using a segmented network to help reduce the spread of malware on a work Wi-Fi network that uses a VPN MAPI attacks Best practice: Protecting your organization's network from a MAPI attack Related resources Glossary Legal notice... 35

4 Protecting smartphones from malware Protecting smartphones from malware 1 Applications that are designed with malicious intent to cause harm to computer systems are commonly known as malware. Malware can include the following examples: Viruses replicate themselves by attaching to legitimate applications on a computer. Trojan horses disguise themselves as or embed themselves within other applications. To attack a smartphone, a user must install and run the application that contains the Trojan horse. A Trojan horse relies on social engineering to convince the user to install the application rather than on the ability of the attacker to exploit flaws in the security design or configuration of the smartphone. Worms replicate themselves to spread across networks and potentially overwhelm computer systems. A worm is selfcontained and does not need to be part of another program to spread itself. Spyware is designed to log user activities and personal data and send that information to an unauthorized user. Some malware attacks might target BlackBerry smartphones. Malware may be used to perform attacks that are designed to do the following: Steal personal and work data. Create a denial of service attack to make a work network unusable. Access a work network using work smartphones. To help protect smartphones in your organization from malware, you can use the application control features that are available as part of the BlackBerry Enterprise Server. You can use the features to contain the threat of malware on the smartphones in your organization and on your organization's network. Related information Using a segmented network to help prevent the spread of malware, 28 4

5 System requirements System requirements 2 To help protect BlackBerry smartphones from malware, your organization's environment should meet the following requirements: Smartphones that run BlackBerry Device Software 4.1 or later BlackBerry Enterprise Server for Microsoft Exchange 4.1 SP2 or later BlackBerry Enterprise Server for IBM Lotus Domino 4.1 SP2 or later BlackBerry Enterprise Server for Novell GroupWise 4.1 SP2 or later BlackBerry Enterprise Server Express for Microsoft Exchange 5.0 SP1 or later BlackBerry Enterprise Server Express for IBM Lotus Domino 5.0 SP 2 or later To manage smartphones that classify applications for both work use and personal use in your organization s environment, you must use either BlackBerry Enterprise Server for Microsoft Exchange (5.0 SP3 or later), BlackBerry Enterprise Server for IBM Lotus Domino (5.0 SP3 or later), or BlackBerry Enterprise Server Express (5.0 SP3 or later), and smartphones that are running BlackBerry 7 or any of the following smartphones that are running BlackBerry 6: BlackBerry Bold 9700 smartphone (bundle 1478 or later) BlackBerry Bold 9780 smartphone (bundle 1478 or later) BlackBerry Curve 9300 smartphone (bundle 1478 or later) BlackBerry Pearl 9100 smartphone (bundle 1478 or later) BlackBerry Torch 9800 smartphone (bundle 1478 or later) BlackBerry Bold 9650 smartphone (bundle 1830 or later) BlackBerry Curve 9330 smartphone (bundle 1830 or later) BlackBerry Style 9670 smartphone (bundle 1830 or later) 5

6 Managing the risk of malware attacks Managing the risk of malware attacks 3 You should plan your organization's network architecture and design the security policies for your organization to help manage the risk of malware attacks. When you plan and set up your organization's network, you should set security policies to help protect the network components and BlackBerry smartphones. You should consider separating your organization's network infrastructure into segments that are separated by firewalls, and restricting internal user access and external user access to the segments. You might require multiple security products and methods to protect each gateway from one segment of your organization's network to another and each gateway to and from the Internet. Using BlackBerry Enterprise Solution tools to protect smartphones from malware Detection is the process where you determine whether or not a program is malware. Effective malware detection requires a constant connection to a comprehensive local or online database of known malware. On computers, you can implement processes that have access to these databases to help detect and contain malware. BlackBerry smartphones do not have enough storage space for a malware database and cannot guarantee a constant connection to the Internet. The BlackBerry Enterprise Solution is designed to use IT policies, application control policies, and code signing to help contain malware by controlling third-party application access to smartphone resources and applications. IT policies, application control policies, and code signing help prevent malware that might gain access to smartphones from causing damage to the applications and data on smartphones or to your organization's environment. By default, users can install all applications until you use IT policies or application control policies to control applications on smartphones. 6

7 Installing and managing applications on smartphones Installing and managing applications on smartphones 4 You can install and manage applications on BlackBerry smartphones. To send applications to smartphones, you must first add the applications to the application repository of the BlackBerry Enterprise Server. You can use the application repository to store and manage all versions of the applications that you want to install on, update on, or remove from smartphones. In the BlackBerry Administration Service, you create software configurations to apply to smartphones. Software configurations specify which applications are required, optional, or not permitted and the versions of the applications that you want to install on, update on, or remove from smartphones. When you create a software configuration, you must also specify whether users can install applications that are not listed in the software configuration. When you add an application to a software configuration, you must assign an application control policy to the application to specify what resources the application can access. If you permit users to install applications that are not listed in the software configuration, you must create an application control policy for unlisted applications that specifies what resources the unlisted applications can access. The BlackBerry Administration Service has two standard application control policies for unlisted applications: one for unlisted applications that are optional, and one for unlisted applications that are not permitted. You can change the default settings of the standard application control policy for unlisted applications that are optional, or you can create custom application control policies for unlisted applications that are optional. Creating an application for a smartphone An application developer can create an application for BlackBerry smartphones using a variety of developer tools. Applications can perform the following actions on a smartphone: Share application data with other applications Access user data such as calendar entries, messages, and contacts Control smartphone resources, such as the camera or GPS Some applications are preloaded on smartphones. You can use the BlackBerry Administration Service to install and manage applications on smartphones. A user can also download and install applications on a smartphone using a computer or over the wireless network. For more information on the tools available for application developers, visit 7

8 Installing and managing applications on smartphones Specifying the methods that users can use to install applications on a smartphone BlackBerry smartphone users can install applications using the following methods: Using the BlackBerry App World storefront Using a browser Using a media card Over a USB connection (for example, using the BlackBerry Desktop Software or BlackBerry Application Web Loader) You can use the Application Installation Methods IT policy rule to specify which application installation options are available to a user. You can also use the Installation from Specified URLs Only IT policy rule to specify a list of web addresses that a user can download applications from. For more information about using IT policy rules, visit to see the BlackBerry Enterprise Server Policy Reference Guide. 8

9 Using IT policy rules to help protect smartphones from malware Using IT policy rules to help protect smartphones from malware 5 You can configure the following IT policy rules to prevent users from downloading applications over the wireless network and specify whether applications on the BlackBerry smartphone can open specific types of connections. For more information comfiguring IT policy rules, visit to see the BlackBerry Enterprise Server Policy Reference Guide and the BlackBerry Enterprise Server Administration Guide. IT policy group IT policy rule Description Default value Desktop Desktop Allow Desktop Add-ins This rule specifies whether the BlackBerry Desktop Software can run add-on applications, such as COMbased extensions that access smartphone databases during synchronization. Yes This rule is not applicable for BlackBerry Desktop Software 6.0. BlackBerry Desktop Software 6.0 does not support add-on applications. Personal Devices Enable Separation of Work Content This rule specifies whether a smartphone distinguishes between work data and personal data, and whether only authorized applications on the smartphone can access work data. If you set this rule to Yes and a user tries to delete a Desktop service book, the smartphone prompts the user to delete the work data on the smartphone. No The "Is access to the corporate data API allowed" application control policy rule affects this rule. The "Is access to the corporate data API allowed" application control policy rule specifies whether an application or an add-on application is authorized to access work data. To make this rule affect applications, you must set the "Is access to the corporate data API allowed" application control policy to Disallowed for the application. Security Allow External Connections This rule specifies whether applications can initiate external connections (for example, to WAP gateways). Yes 9

10 Using IT policy rules to help protect smartphones from malware IT policy group IT policy rule Description Default value Allow Internal Connections Allow Resetting of Idle Timer Allow Screen Shot Capture Allow Split-Pipe Connections Allow Third Party Apps to Access Screen Contents Allow Third Party Apps to Use Serial Port Application Installation Methods Application Installation from Specific URLs Only This rule specifies whether applications can initiate internal connections (for example, to websites behind your organization's firewall using the BlackBerry MDS Connection Service). This rule specifies whether a smartphone permits applications to reconfigure the inactivity-timeout value on the smartphone and bypass the timeout value for the smartphone password. For more information about the inactivity timeout, visit to read the EventInjector class and Backlight.enable() method in the API reference for the BlackBerry Java Development Environment. This rule specifies whether a smartphone permits applications to take screen shots. This rule specifies whether applications can open internal and external connections on a smartphone at the same time. An application may create a security issue if it opens internal and external connections at the same time because the application can collect data from inside the firewall and send it outside the firewall. This rule specifies whether an application on a smartphone can access the data that is displayed on the smartphone screen. This rule specifies whether applications can use the serial port, IrDA port, or USB port on a smartphone. This rule specifies which application installation options are not available to the user. Each application installation option provides a unique method for the user to install applications onto the smartphone. This IT policy rule takes priority over the Disallow Third Party Application Downloads IT policy rule. If both IT policy rules exist, this IT policy rule takes precedence. This policy rule does not affect applications that are already installed on the smartphone. This rule specifies a list of web addresses that a user can download applications from. Separate multiple web addresses with a comma (,). Each address must be a fully qualified domain name or a wildcard domain name that starts with a period (.). Yes No No No Yes Yes None None 10

11 Using IT policy rules to help protect smartphones from malware IT policy group IT policy rule Description Default value Disallow Third Party Application Downloads Password Required for Application Download Reset to Factory Defaults on Wipe Security Transcoder Cod File Hashes A BlackBerry smartphone does not use this IT policy rule if you set the Application Installation Methods IT policy rule to Disallow Browser. If you specify a web address in this IT policy rule, the browser uses the BlackBerry MDS Connection Service to connect to the web address, even if the web address is not listed in the MDS Browser Domains IT policy rule. This rule specifies whether a user can install or update applications on a smartphone using the BlackBerry Browser or the BlackBerry App World storefront. If you set this rule to Yes, the user cannot install or update applications on the smartphone using the BlackBerry Browser or BlackBerry App World. The user can install or update an application that Research In Motion creates using the BlackBerry Desktop Software. This rule does not apply to add-on applications developed by RIM in software configurations. This rule affects the "Application Restriction Rule" IT policy rule. If you set this rule to Yes, it takes precedence over the "Application Restriction Rule" IT policy rule. This rule affects the "Category Restriction Rule" IT policy rule. If you set this rule to Yes, it takes precedence over the "Category Restriction Rule" IT policy rule. This rule specifies whether a smartphone prompts a user for the smartphone password when using the browser to download applications. This rule specifies whether a smartphone resets to the factory default settings when it receives the Delete all device data and disable device IT administration command over the wireless network. For smartphones that are running BlackBerry Device Software 5.0 and later, this rule is enforced both remotely (when an administrator erases the data on a smartphone remotely) and locally (for example, when a user types the device password incorrectly more times than the Set Maximum Password Attempts IT policy rule or the password option on the device permits). This rule specifies the hashes for the.cod files of a transcoder that a smartphone needs to register the transcoder. Set each hash in hexadecimal format and separate multiple values with a comma (,). No No No None 11

12 Using IT policy rules to help protect smartphones from malware Creating new IT policy rules to control applications that your organization creates You can create IT policy rules to control the applications that your organization creates for BlackBerry smartphones that are running in your organization's environment. After you create an IT policy rule, you can add it to a new or existing IT policy and assign a value to it. Only applications that your organization creates can use the IT policy rule that you create. You cannot create new IT policy rules to control smartphone applications and features. For more information about creating IT policy rules, visit to see the BlackBerry Enterprise Server Administration Guide. IT policy rules take precedence on smartphones IT policy rule settings override application control policy rule settings. For example, if you change the Allow Internal Connections IT policy rule to No for BlackBerry smartphones, and if the smartphones have an application control policy set that allows a specific application to make internal connections, the application cannot make internal connections. The smartphone revokes an application control policy and resets if the permissions of the application it is applied to become more restrictive. Smartphones permit users to make application permissions more restrictive, but not less restrictive, than the permissions that you specify. 12

13 Specifying the resources that applications can access on a smartphone Specifying the resources that applications can access on a smartphone 6 You can use application control policy rules to specify which applications a user can download and install on a BlackBerry smartphone and the resources on the smartphone that the applications can access. If you control the applications that a user can install and limit the resources that the applications can access, you can help protect the smartphone from malware. You can also help prevent damage to the smartphone software, applications, smartphone data, and your organization s network. Code signing can also help control the resources that applications can access on smartphones and can help to prevent malware on smartphones. Using application control policy rules to control the resources that applications can access on a smartphone You can use application control policy rules to specify whether users can install applications on BlackBerry smartphones and to specify the permissions for applications. You can use application control policy rules to specify whether applications can access the following resources on smartphones: Data or applications (for example, Messages application, phone) Smartphone key store Network connections Near field communications Secure element Smartphone settings Security timer 13

14 Specifying the resources that applications can access on a smartphone BlackBerry APIs (for example, GPS API, User Authenticator API, Module Management API) When you assign an application control policy to a software configuration and assign the software configuration to user accounts or groups, users might not be able to use all of the features of the applications that are included in the software configuration. For example, if you set the "Are External Network Connections " application control policy rule to "Not permitted", a game that is installed on a smartphone may not be able to send high scores back to a central server since the game is not permitted to access the Internet. You can assign application control policies to software configurations so that the BlackBerry Enterprise Server limits the permitted application behavior to a subset of user accounts that it trusts. Smartphones revoke the application control policy and reset if the permissions for applications that the application control policy is applied to become more restrictive. Smartphones permit users to make application permissions more restrictive, but never less restrictive, than the permissions that you specify. For more information about configuring application control policies, visit to see the BlackBerry Enterprise Server Administration Guide. Using application control policy rules to specify the types of connections that applications can open You can use the following application control policy rules to specify whether an application that is running on the BlackBerry smartphone can open local, internal, and external network connections: Are External Network Connections Are Internal Network Connections Are Local Connections application An application can connect to both the Internet and your organization's intranet at the same time, which might be a security issue because applications can collect data from inside your organization's firewall and send it outside your organization's firewall. You should consider preventing applications on a smartphone from opening both internal and external connections at the same time. Although you can use the Allow Split-Pipe Connections IT policy rule to allow an application to open both internal connections and external connections at the same time, this setting applies to all applications on the smartphone and the user is prompted to allow the connections each time an application starts. You can use the Are External Network Connections application control policy rule and the Are Internal Network Connections application control policy rule to specify the types of connections that each application can open and remove the prompts that a user receives each time an application starts. You can also configure a single application control policy rule for all applications that are running on the smartphone. For IT policy rule and application control policy rule descriptions, visit to see the BlackBerry Enterprise Server Policy Reference Guide. For more information about configuring IT policy rules and application control policy rules, visit to see the BlackBerry Enterprise Server Administration Guide. 14

15 Specifying the resources that applications can access on a smartphone Application permissions for applications that users install on a smartphone Users can set permissions that control how applications that users install on a BlackBerry smartphone interact with the other applications on the smartphone. For example, a user can control whether an application that the user installs on the smartphone can access data or the Internet, make calls, or use Bluetooth connections. If a user adds an application to the smartphone, the smartphone is designed to prevent the application from sending or receiving data without the user's knowledge. For a selected application or all your third-party applications, before an application sends or receives data, you can turn on a prompt that allows you to accept or deny the connection request for a specific location or resource. Smartphones permit users to make application permissions more restrictive, but never less restrictive, than the permissions that you specify. The following table shows the application permissions and their default settings: Permission Category Default setting Description USB Connections Allow A user can set whether applications can use physical connections, such as a USB cable, that a user set up for the smartphone. Bluetooth Connections Allow A user can set whether applications can use Bluetooth connections. Phone Connections Prompt A user can set whether applications can make calls or access call logs. Location Data Connections Prompt A user can set whether applications can use the GPS location information on the smartphone. Server Network Connections Allow (BlackBerry 7 and later) Prompt (BlackBerry Device Software 6.0 and earlier) Internet Connections Allow (BlackBerry 7 and later) Prompt (BlackBerry Device Software 6.0 and earlier) A user can set whether applications can access the Internet or your organization's intranet using your organization's network. A user can set whether applications can access the Internet through a wireless service provider (for example, using a direct Internet connection or WAP gateway). 15

16 Specifying the resources that applications can access on a smartphone Permission Category Default setting Description Wi-Fi Connections Allow A user can set whether applications can use Wi-Fi connections. Near Field Communication Connections Allow A user can set whether applications can use NFC connections. Cross Applications Communication Interactions Allow A user can set whether applications can communicate and share data with other applications on the smartphone. Device Settings Interactions Allow A user can set whether applications can turn on or turn off the smartphone or change smartphone options, such as display options. Media Interactions Allow A user can set whether applications can access media files on the smartphone. Application Management Interactions Allow A user can set whether applications can add or delete application modules or access module information such as an application name or version. Themes Interactions Allow A user can set whether the smartphone can use applications as a source for customized themes. Input Simulation Interactions Deny A user can set whether applications can simulate actions, such as pressing a key on the smartphone. Browser Filtering Interactions Deny A user can set whether applications can register browser filters with the browser on the smartphone to add, change, or delete website content before it appears in the browser. Recording Interactions Prompt A user can set whether applications can take screen shots of the smartphone screen or use other applications on the smartphone to take pictures or recordings. Security Timer Reset Interactions Deny A user can set whether applications can reset the duration that the smartphone remains unlocked after the user stops using it. 16

17 Specifying the resources that applications can access on a smartphone Permission Category Default setting Description Display Information While Locked Interactions Deny A user can set whether applications can display information while the smartphone is locked. User Data Allow A user can set whether applications can access messages, SMS text messages, MMS messages, or PIN messages on the smartphone. Organizer Data User Data Allow A user can set whether applications can access organizer data such as contacts, calendar entries, tasks, or memos on the smartphone. Files User Data Allow A user can set whether applications can access files that the user stores on the smartphone. For example, a user can set whether applications can access files that a user transfers to the smartphone using the media manager tool of the BlackBerry Device Software or Bluetooth technology. Security Data User Data Allow A user can set whether applications can access certificates or keys in the key store on the smartphone. Secure Element User Data Allow A user can set whether applications can access confidential information, such as credit card numbers, coupons, loyalty cards, and public transit passes, that are stored on the smartphone's secure element. Depending on the smartphone model and wireless service provider, the smartphone might not use a secure element. Application permissions for applications that users install as trusted applications on a smartphone Some applications that a user installs on a BlackBerry smartphone prompt the user to install the application as a trusted application. If the user accepts the prompt and installs the application as a trusted application, all permissions for the application are set to Allow except for the following permissions: 17

18 Specifying the resources that applications can access on a smartphone Permission Input Simulation Browser Filtering Recording Security Timer Reset Display Information While Locked Secure Element Setting Deny Deny Prompt Prompt Deny Prompt Application control policy rules You can configure the following application control policy rules to control applications on BlackBerry smartphones. For more information about application control policy rules, visit to see the BlackBerry Enterprise Server Policy Reference Guide. Rule Description Default value Are External Network Connections Are Internal Network Connections Are Local Connections This rule specifies whether an application can make external network connections. You can configure this rule to prevent the application from sending or receiving any data on a smartphone using an external protocol (such as WAP or TCP). You can also configure this rule so that an application prompts a user before the application makes external connections through the smartphone firewall. The List of External Domains application control policy rule affects this rule. The List of External Domains application control policy rule takes precedence over this rule. This rule specifies whether an application can make internal network connections. You can configure this rule to prevent the application from sending or receiving any data on a smartphone using an internal protocol (for example, the BlackBerry MDS Connection Service). You can also configure this rule so that an application prompts a user before the application makes internal connections through the smartphone firewall. The List of Internal Domains application control policy rule affects this rule. The List of Internal Domains application control policy rule takes precedence over this rule. This rule specifies whether an application can make local network connections (for example, connections to a smartphone using a USB or serial port). Prompt user Prompt user 18

19 Specifying the resources that applications can access on a smartphone Rule Description Default value Can Device Settings be Modified Can the Security Timer be Reset Display information while locked Disposition Is Access to NFC Is Access to the Browser Filters API Is Access to the Corporate Data API Is Access to the API Is Access to the Event Injection API Is Access to the File API Is Access to the GPS API This rule specifies whether an application can change configuration settings and user settings on a smartphone. This rule specifies whether an application can reset the amount of time that must elapse before a smartphone locks automatically. This rule specifies whether an application can display information on a smartphone screen when the smartphone is locked. This rule specifies whether an application is optional, required, or not permitted on the smartphone. You can use this rule to make a specific application required on the smartphone or to prevent unspecified or untrusted applications from being installed on the smartphone. This rule specifies whether an application can access NFC on a smartphone. This rule specifies whether an application can access browser filter APIs to register a browser filter on a smartphone. You can use this rule to permit applications to apply custom browser filters to web-page content on a smartphone. This rule specifies whether a third-party application or an add-on application developed by Research In Motion can access work data on a smartphone. You can configure this rule to prevent third-party applications or add-on applications developed by RIM from accessing work data on the smartphone. The smartphone checks this rule to determine which applications can access work data. This rule specifies whether an application can send and receive messages using a smartphone. This rule specifies whether an application can simulate input events on a smartphone, such as pressing keys or performing trackpad actions. This rule specifies whether an application can access, change, delete, and move files on a smartphone. This rule specifies whether an application can access the GPS APIs on a smartphone. You can configure this rule to prevent the application from accessing the GPS APIs on a smartphone or to prompt the user before an application can access the GPS APIs. Not permitted Not permitted Optional Disallowed Prompt user 19

20 Specifying the resources that applications can access on a smartphone Rule Description Default value Is Access to the Handheld Key Store Is Access to the Interprocess Communication API Is Access to the Media API Is Access to the Module Management API Is Access to the PIM API Is Access to the Phone API Is Access to the Screen, Microphone, and Video Capturing APIs Is Access to the Secure Element This rule specifies whether an application can access the key store APIs on a smartphone. The Minimal Signing Key Store Security Level IT policy rule affects this rule. If you configure the Minimal Signing Key Store Security Level IT policy rule to use the high security level, this rule does not apply. The smartphone prompts a user for the keystore password each time that an application tries to access the private key. The Minimal Encryption Key Store Security Level IT policy rule affects this rule. If you configure the Minimal Encryption Key Store Security Level IT policy rule to use the high-security level, this rule does not apply. The smartphone prompts the user for the key store password each time that an application tries to access the private key. This rule specifies whether an application can perform crossapplication communication operations. You can use this rule to permit two or more applications to share data or for one application to use the connection permissions of another application. This rule specifies whether an application can run or create multimedia files on a smartphone. This rule specifies whether an application can add, change, or delete Java.cod files on a smartphone. This rule specifies whether an application can access the smartphone PIM APIs, which control access to a user's personal information, such as contacts, on a smartphone. If you permit an application to access PIM data APIs and use network connection protocols, the application might be able to send all of the user's personal information from the smartphone. This rule specifies whether an application can make calls, answer incoming calls, and access call logs on a smartphone. You can configure this rule to prevent an application from making calls on a smartphone or to prompt a user to permit calls before the application makes calls. This rule specifies whether an application can record media, such as audio and video, using the BlackBerry Browser or other applications on a smartphone. This rule specifies whether an application can access the secure element on a smartphone. Prompt user Not permitted 20