Blackbe;rry ENTERPRISE SOLUTION SECURITY - SECURITY FOR DEVICES WITH BLUETOOTH WIRELESS TECHNOLOGY -... Installation guide

Security Technical Overview
BlackBerry Devices with Bluetooth Technology

SWDT391201-391201-0613044539-001

Contents
1BlackBerry Enterprise Solution security........................................................................................................................ 3
2Bluetooth technology......................................................................................................................................................... 5
Bluetooth profiles........................................................................................................................................................................ 5
Bluetooth profiles that BlackBerry devices support .............................................................................................................. 5
3Risks of using Bluetooth technology on wireless devices.......................................................................................... 7
Bluejacking................................................................................................................................................................................... 7
Bluesnarfing................................................................................................................................................................................. 7
Bluebugging................................................................................................................................................................................. 8
4Managing Bluetooth enabled BlackBerry devices ...................................................................................................... 9
Bluetooth technology security measures on BlackBerry devices......................................................................................... 9
Using IT policy to manage Bluetooth technology on BlackBerry devices.......................................................................... 11
IT policy rules that control Bluetooth technology on BlackBerry devices...................................................................... 11
Educating users about how to protect their Bluetooth enabled BlackBerry devices........................................................ 20
5 Glossary................................................................................................................................................................................ 21
6 Legal notice ......................................................................................................................................................................... 23

Security Technical Overview BlackBerry Enterprise Solution security
2

BlackBerry Enterprise Solution security 1
The BlackBerry® Enterprise Solution is designed to encrypt data in transit at all points between the BlackBerry device and
the BlackBerry® Enterprise Server to protect your organization from data loss or alteration. Only the BlackBerry Enterprise
Server and the BlackBerry device can access the data that they send between them. If events that threaten the wireless
security of your organization occur, third parties, including wireless service providers, cannot access your organization's
potentially sensitive information in a decrypted format.
The BlackBerry Enterprise Solution uses symmetric key cryptography to encrypt messages and user data that it sends over
the transport layer to provide the following criteria for the security of wired and wireless solutions.
Criteria Description
confidentiality TheBlackBerryEnterpriseSolutionusesencryptiontomakesurethatonlytheintended
message recipients can view the contents of the message.
integrity The BlackBerry Enterprise Solution protects each message that the BlackBerry device
sends with one or more message keys. To prevent third-party decryption or alteration
of the message data, the message keys are designed to consist of random data.
Only the BlackBerry Enterprise Server and the BlackBerry device know the value of
the master encryption key, recognize the format of the decrypted and decompressed
message, and automatically reject a message that is not encrypted with the correct
master encryption key.
authenticity The BlackBerry device authenticates itself to the BlackBerry Enterprise Server to prove
that it knows the master encryption key before the BlackBerry Enterprise Server can
send data to the BlackBerry device.
Security Technical Overview BlackBerry Enterprise Solution security
3

Security Technical Overview Bluetooth technology
4

Bluetooth technology 2
Bluetooth® technology is a standard for short-range wireless technology. It enables two devices to communicate using radio
waves that operate at 2.4 GHz. A BlackBerry® device that uses Bluetooth technology can open a wireless connection with
other Bluetooth enabled devices, such as hands-free car kits or headsets, that are within a 10 m range.
The wireless industry considers Bluetooth technology to be a nonsecure channel. If Bluetooth technology is implemented
incorrectly, using it might introduce security vulnerabilities into your organization's network.
Bluetooth profiles
Bluetooth® profiles specify how applications on BlackBerry® devices and on Bluetooth enabled devices connect and are
interoperable. Bluetooth profiles provide use-case scenarios and information about how to configure applications that are
interoperable. Many Bluetooth profiles are available for implementation.
Bluetooth profiles that BlackBerry devices support
Bluetooth® enabled BlackBerry® devices currently support Bluetooth profiles and provide specific IT policy rules to control
their use.
Profile Description
A2DP This profile defines how a BlackBerry device can send and receive audio in an
audio stream format for two-channel stereo over a Bluetooth connection to
another Bluetooth enabled device.
You can use the Disable Advanced Audio Distribution Profile IT policy rule to
specify whether to prevent the BlackBerry device from using this profile.
AVRCP This profile defines how a Bluetooth enabled device controls audio/video
functionality on a BlackBerry device.
You can use the Disable Audio/Video Remote Control Profile IT policy rule to
specify whether to prevent the BlackBerry device from using this profile.
DUN This profile is based on the SPP and allows a BlackBerry device to access dial-
up services, such as the Internet, using Bluetooth technology.
You can use the Disable Dial-up Networking IT policy rule to specify whether to
prevent the BlackBerry device from using this profile.
Security Technical Overview Bluetooth technology
5

Profile Description
HFP This profile works with the SPP to enable wireless voice capabilities with most
headsetsand somecar kits.If boththe HSPand HFPare available,consider using
the HFP because it offers more functionality and performance than the HSP. For
example, the HFP can support wireless transfer of contact lists for car kits that
use commands that control modems.
You can use the Disable Handsfree Profile IT policy rule to specify whether to
prevent the BlackBerry device from using this profile.
HSP This profile works with the SPP to enable wireless voice capabilities with most
headsets and some car kits. You use the HSP for wireless voice transmission only
if the target peripheral does not support the HFP.
You can use the Disable Headset Profile IT policy rule to specify whether to
prevent the BlackBerry device from using this profile.
SPP This profile provides procedures that describe how to configure serial
connections between a BlackBerry device and a Bluetooth enabled peripheral
that uses a virtual serial port. The Bluetooth enabled peripheral accesses the
serial port through the BlackBerry Software Development Kit.
You can use the Disable Serial Port Profile IT policy rule to specify whether to
prevent the BlackBerry device from using this profile.
SIM Access Profile This profile allows another Bluetooth enabled device to control the SIM card on
a BlackBerry device. For example, a car kit could use the SIM card to control its
own GSM communication. This might be useful if functioning of the BlackBerry
device degrades significantly inside a high-end car because the car is well
insulated. When the car controls the SIM card, the BlackBerry device prevents
any applications that might use the SIM card from running on the device.
Security Technical Overview Bluetooth technology
6

Risks of using Bluetooth technology on wireless devices 3
The wireless industry considers that Bluetooth® enabled devices have the following potential areas of vulnerability:
• Users with malicious intent can obtain confidential data from Bluetooth enabled devices without the knowledge or
consent of the authorized users.
•A previously trusted (or paired) source that has been removed from the Trusted list can access the memory contents of
some Bluetooth enabled devices.
• Users with malicious intent can gain access to higher-level commands and to voice, data, and messaging channels.
Security threats to Bluetooth wireless technology can be user based or device based.
Type of threat Description Examples
user based User-based threats occur when users change settings or
perform (or fail to perform) actions that leave their devices
vulnerable or open to attacks.
bluejacking
device based Device-based threats are the result of incorrect implementation
of Bluetooth wireless technology on devices, which leave the
devices vulnerable or open to attacks.
bluesnarfing and
bluebugging
Any Bluetooth enabled device is at risk for attack when all of the following conditions are present:
• The Bluetooth wireless transceiver is turned on.
• The device is set to use discoverable (visible) mode.
• The device is physically located within range of a user with malicious intent.
Bluejacking
Bluejacking is a user-based threat that occurs when users with malicious intent send text messages anonymously to
Bluetooth® enabled devices that are set to use discoverable mode and are physically located within 10 m of the attacking
devices. Users with malicious intent can target individuals or they can broadcast anonymous messages to all discoverable
devices in the area. Bluetooth enabled phones, personal device assistants, and laptops can search for other devices within
a short range, so users with malicious intent who are located in crowded public areas can send anonymous messages easily
and without detection.
Bluesnarfing
Bluesnarfing is a device-based threat that occurs when device manufacturers implement the specification for Bluetooth®
technology incorrectly, allowing users with malicious intent to use Bluetooth technology to connect to devices without
notifying the authorized users, and access device information without the knowledge or consent of the authorized users.
Security Technical Overview Risks of using Bluetooth technology on wireless devices
7

Typically, users with malicious intent gain access to the device users' contact lists although all OBEX-addressable data that
is stored on the devices is vulnerable. During bluesnarfing attacks, users with malicious intent can obtain sensitive
information, such as the unique network identifier of a device. They might also send text messages, make calls, or create
false address book entries.
By default, on BlackBerry devices, the ability to exchange files with supported OBEX devices is turned off, which helps to
protect the devices against bluesnarfing attacks by preventing users with malicious intent from using the OBEX
implementation to access core BlackBerry device data.
Bluebugging
Bluebugging is a device-based threat that occurs when device manufacturers implement security mechanisms for
Bluetooth® technology improperly. Bluebugging also occurs when users with malicious intent use Bluetooth technology to
access phone commands on devices without notifying or alerting the authorized users. This vulnerability enables the users
with malicious intent to make calls, send and read text messages, access and add contacts to contact lists, eavesdrop on
phone conversations, and connect to the Internet, all without detection or authorization.
Security Technical Overview Risks of using Bluetooth technology on wireless devices
8