[dicks-webos]

A news today came out that 10.2.1.537 has a bug where when the policy is set for apps to not allow access to the address data, any Android app can still access it.

BlackBerry said they know about it and will be issuing an update...

In German: Peinliches Loch in BlackBerrys Gesch�ftsdaten-Tresor | heise online

[Elite1]

Interesting. Have a link to BBRY's response?

I guess this only affects BES users.

[Rjinswand]

Interesting. Have a link to BBRY's response?

I guess this only affects BES users.

There's a quote from BlackBerry in the article:
"We have investigated an issue in the Android player involving specific app permissions, and we have addressed it in our latest software builds. We will work with our carrier partners to help ensure the update is available to customers."

Yes, this is only relevant to BES users. It basically states that there is a bug in one BES policy which manages the app access to contact info on the mobile.
One can choose between allowing all apps access to contact data (name and phone number) stored in the business part, allow only native apps to it or none at all. Setting to the second option grants Android app access, too, atm. But they fixed it and wait for the carriers to make the update available.

[lnichols]

Awesome, so glad it went through stringent carrier testing.

Posted via CB10

[grahamf]

Awesome, so glad it went through stringent carrier testing.

Posted via CB10

Yeah, you would think they would check the combination of locked down access to contacts with completely open access to officially unsupported applications.

or does this include Android apps in BBW?

[Gerii]

According to the report it includes all Android apps.
However two comments point out that it only happens when this setting is set to only allow BlackBerry apps to access contacts. It doesn't seem to happen if it is set to none according to them.

Posted via CB10

[webbert]

Posted via CB10

[ssbtech]

I'm confused about this. I didn't think you had any control over what content Android apps accessed? You either accepted all the required permissions or didn't use the app.

[Rjinswand]

You get more options when using BES. Or more likely: Your BES administrator gets more options. In this case, more options for managing access to the business part, which is not present at non-BES connected devices.

If you are a consumer without BES this is of no relevance to you at all and you're right: We can only accept all permissions an Android app asks for or none at all, which is kinda annoying.

[chasdrury]

I can't recreate this leak in my BES environment - can anyone else?

[Prem WatsApp]

You get more options when using BES. Or more likely: Your BES administrator gets more options. In this case, more options for managing access to the business part, which is not present at non-BES connected devices.

If you are a consumer without BES this is of no relevance to you at all and you're right: We can only accept all permissions an Android app asks for or none at all, which is kinda annoying.

This will get fixed. Permissions whack-a-mole is no fun.

iPhone for me? Scr... ahem Q that! (posted from the latter)

[Superfly_FR]

What we're looking at is how fast the correction will be ready and available among all BES10 installations.
... 3 ... 2 ... 1 ...
Wondering if they have to patch devices and/or BES10 policy rules and if they have to update via carrier OTA or if it'll be pushed by BES servers. Let's see security in action. If < 3 working days, this may turn a flaw into demonstration of strength. Be it !!!

(P.S: still wondering why direct android install was not marketed ?)

[Sith_Apprentice]

I can't recreate this leak in my BES environment - can anyone else?

Yes I can. Use the Go Launcher Ex app and it works no matter what the settings in your IT policy, work space locked or unlocked, etc. This means android apps have access to work perimeter. In BES 10.2 you can disallow installation from non BlackBerry sources, so I am going to set that and see if I can effectively block third party APK installation. I also need to test to see if this will remove any installed apps currently, but I doubt it seriously. This doesnt obviously help anything in BB World. Next step would be to turn on advanced data at rest encryption, and see if that prevents the app from reading contacts. Also not sure if this would have any success.

[Sith_Apprentice]

Yes I can. Use the Go Launcher Ex app and it works no matter what the settings in your IT policy, work space locked or unlocked, etc. This means android apps have access to work perimeter. In BES 10.2 you can disallow installation from non BlackBerry sources, so I am going to set that and see if I can effectively block third party APK installation. I also need to test to see if this will remove any installed apps currently, but I doubt it seriously. This doesnt obviously help anything in BB World. Next step would be to turn on advanced data at rest encryption, and see if that prevents the app from reading contacts. Also not sure if this would have any success.

Test 1 (Blocking third party installation) - Does not remove previously installed applications, nor does it block anything already in App World.
Test 2 (Advanced Data at Rest Protection) - Only with Work Space locked is this applied. Does not help, Contacts are still in the launcher app (even though they are supposed to be separately encrypted)
Test 3 (Personal Apps access to Work Contacts) - Set to None. No result
Test 4 (Chaning Work Space password to something other than Device password) - Does not work

[Gerii]

Are you sure the launcher hasn't cached anything from your previous tests?

Posted via CB10

[Superfly_FR]

Test 1 (Blocking third party installation) - Does not remove previously installed applications, nor does it block anything already in App World.
Test 2 (Advanced Data at Rest Protection) - Only with Work Space locked is this applied. Does not help, Contacts are still in the launcher app (even though they are supposed to be separately encrypted)
Test 3 (Personal Apps access to Work Contacts) - Set to None. No result

Sith, from you experience, do you think the update is server/device/both side ?
If server and device, can BES push it ?
thx

[FOR RIM]

Blackberry said this about this bug“We have Investigated at issue in the Android app player Involving specific permissions, and we have it in our Addressed latest software build We will work with our carrier partners to help Ensure the update is available to customers.”

[Sith_Apprentice]

Are you sure the launcher hasn't cached anything from your previous tests?

Posted via CB10

I create a test contact each time

[Sith_Apprentice]

Sith, from you experience, do you think the update is server/device/both side ?
If server and device, can BES push it ?
thx

My guess, and purely a guess, is that the Android runtime, being a signed BB app, is considered part of the OS and has access it shouldnt. This would have to be changed, if it isnt a fundamental part of the android runtime.

[Sith_Apprentice]

One thing I did not do is remove the app, reboot, and reinstall the app to see if the changes (blocked the install turned back OFF) have any effect. If you remove and reinstall the app, with no reboot, the app data is most definitely cached somewhere on the device. (doesn't explain the test contacts that I created). So I am going to clear that cache if possible, reinstall, with work space locked, and see what happens.

[Sith_Apprentice]

Blackberry said this about this bug“We have Investigated at issue in the Android app player Involving specific permissions, and we have it in our Addressed latest software build We will work with our carrier partners to help Ensure the update is available to customers.”

This is not a bug, this is a full blown vulnerability. Android apps, at no time, are supposed to have access to the work space. Work space does not even have an android runtime (from what BB has said). If an app can access simple contacts, who is to say it doesnt touch the work environment, or VPN connections, or messages, or encryption keys, etc etc etc etc.

This is enough to block rollouts for many agencies, and should concern any company with BES10.

[Jimberry Storm]

Awesome, so glad it went through stringent carrier testing.

Posted via CB10

Yes and now it has to do the same apparently useless test

[Superfly_FR]

My guess, and purely a guess, is that the Android runtime, being a signed BB app, is considered part of the OS and has access it shouldnt. This would have to be changed, if it isnt a fundamental part of the android runtime.

I smell a more basic opened door ... 100% guessing too.

[Superfly_FR]

Yes and now it has to do the same apparently useless test

Carriers don't test this.

[imcurved]

When it comes to BES issue, you bet it'll be quickly addressed

? CB10 ?