Here is what I tweeted to blackberry tech support @blackberryhelp
"Is my blackberry classic running on BBOS 10.3.3.2031 safe from
1. KRACK
2. Blueborne
3. Stagefright
4. Dirtycow
5. Spectre
Vulnerabilities.
If not can I expect updates in coming days since these are pretty serious and catastrophic issues that users are needed to be protected from."
And here is what they replied,
"@SaptarshiKar200 Thanks for reaching out. BlackBerry 10 devices utilize processors based on the ARM architecture. ARM architectures perform speculative execution in a more limited fashion than other modern architecture, reducing any potential impact. Due to processor architecture and OS design, this would be difficult to exploit in practice. ^NP"
Please can somebody make me understand what are they trying to say since I am not much of a tech geek but a medical student?
Also please comment if there is any workaround or escape plan to avoid any of these if I still want to keep using my blackberry classic? Thank you in advance.
Two things first, they only answered about Spectre; and I wonder why you didn't ask about Meltdown.
The answer is quite clear at the depth they answered at. I suspect that, if that doesn't satisfy you, what you are looking for would require that you become an expert in modern CPU design.
What specifically do you not understand about their answer?
Well what I don't understand the fact that what is ARM and how is it effective against these vulnerabilities. Also does that feature reallly make a big deal saving our arses against these threats.
Also is there really any escapeplans for these threats (except ditching my classic)
Posted from my BlackBerry Classic (SQC100-1) 10.3.3.2031
A little use of your favourite search engine will answer some of these questions. For example ARM is the type of processor used in most mobile devices, and all BB10 devices. https://en.m.wikipedia.org/wiki/ARM_architecture as opposed to an Intel processor.
As they said, ARM processors implement speculative execution differently. Some, such as the version used in the Raspberry Pi don't do it at all. On top of that there are features of the software running on the processor that can reduce or eliminate the effectiveness of the techniques used to exploit the various kinds of speculative execution. Some of the difference stems from the fact that ARM is a Reduced Instruction Set Computer (RISC) and Intel is a Complex Instruction Set Computer (CISC). Others because BB10 is built on QNX which is a micro-kernel design; Windows, iOS, Android, Linux Mac OS are all monolithic kernel designs.
LeapSTR100-2/10.3.3.2205
BlueBorne didn't impact BB10,
BlackBerry response to impact of the vulnerabilities known as BlueBorne on BlackBerry products
Stagefright is still an on going issue on Android so no device is really "safe" from it but the initial Stagefright vulnerability was difficult to exploit on BB10 before it was patched. I don't think we know if newer Stagefright vulnerabilities also impact the BB10 runtime.
If updates are an expectation you might want to look at a different platform.
No... you should not expect any updates for phones that have been out of production for over two years.
I expect the vulnerability to some of these is very little and would require a targeted attack. If you worked for a big company or major government, this might be an issue... if they hadn't already started phasing BB10 out. But an average user... very little to be worried about. If you are, buy a new modern phone that does get updates.
Are you sure the horse is dead? Perhaps if we try a bigger whip!
Posted via CB10
or steel-toed boots.
Yea it would take a pretty complex and specific attack, and like you said organizations should have phased out BB10 by now. If a ceo is still using them I feel you..but wake up!
Posted via CB10
Personally I would have not connect any device that is ot patched for KRACK to a WiFi network.
There are ways to counter KRACK... but yeah at this point you need to be very vigilant in keeping aware of all the work arounds to stay secure.
This might be overkill, but it is 100% effective against KRACK.
Also, KRACK cannot compromise an unsecured WiFi connection. So, you are no more vulnerable to public WiFi than you always were. No need to change your policies for public WiFi.
Posted with my trusty Z10
True for KRACK issues, but I generally stay off public WiFi. If I use a WiFi network the network is a private network, home, work etc.. For those networks KRACK is an issue.
Right. Whether to use public WiFi is a different policy decision unrelated to the KRACK vulnerability.
I no longer connect to client networks via secure WiFi with my BB10 devices, in case they are subject to a KRACK-related threat; however, I still use my secure WiFi at home, as I have zero reason to suspect that anyone would go to the trouble of targeting me personally.
Posted with my trusty Z10