RIM Patches BlackBerry Phishing Flaw

The vulnerability can make the smartphone think a malicious Web site is a trusted one.

Research In Motion (NSDQ: RIMM) issued a security patch that fixes a vulnerability that potentially leaves BlackBerry users open to phishing attacks.

The flaw enables a malicious coder to trick BlackBerry users into visiting a potentially malicious Web site by making the device think the site is a trusted one. To exploit this, attackers would need to create a site that uses null characters in the certificate's Common Name field. The device detects the mismatch between the domain name and the certificate, but the warning screen doesn't display the hidden character, making the user think the site is trusted.

Last month, the world learned that Dan Kaminsky had discovered a seriousl vulnerability with DNS, which he unveiled at this year's Black Hat Conference in Las Vegas. Dark Reading's Site Editor, Tim Wilson, talks with Dan about the flaw."The updated BlackBerry device software is designed to depict null characters in the BlackBerry browser dialog box that appears when the user visits a Web site with a certificate that does not match the site domain name," RIM said in a security note. "In the updated BlackBerry device software, the BlackBerry device represents previously hidden null characters with a block, and highlights the non-matching portion of the domain name in bold."

Information Week