Wired: Researcher: Middle East Blackberry Update Spies on Users
Wired News reports:
A BlackBerry update that a United Arab Emirates service provider pushed out to its customers contains U.S.-made spyware that would allow the company or others to siphon and read their e-mail and text messages, according to a researcher who examined it.
The update was billed as a “performance-enhancement patch” by the UAE-based phone and internet service provider Etisalat, which issued the patch to its 100,000 subscribers.
The patch only drew attention after numerous users complained that it drained their BlackBerry battery and slowed performance, according to local publication ITP. [...]
The spying part of the patch is switched off by default on installation, but switching it on would be a simple matter of pushing out a command from the server to any device, causing the device to then send a copy of the user’s subsequent e-mail and text messages to the server. [...]
Wired.com spoke with Chris Wysopal, co-founder and chief technology officer of Veracode, who pointed out that the fact that the interception is done on the client device rather than on the ISP’s server — where it would normally be done — helps law enforcement, or whoever else might want to intercept the messages, circumvent encryption used by the sender of an e-mail, since it’s grabbing the message after it’s been decrypted on the recipient’s BlackBerry.
Possibly related posts: