A recently identified BlackBerry Browser bug that affects the vast majority of RIM smartphones makes BlackBerry owners more vulnerable to phishing attacks. BlackBerry maker RIM claims to have released new software to address the issue to carriers, yet most of those updated builds are not yet publicly available via U.S. carrier sites. Here's how to stay safe, now and later. BlackBerry smartphone users who frequently surf the Web via handheld will want to keep checking with their wireless carriers for BlackBerry Handheld Software updates in the coming weeks. That’s because a new bug found in most current versions of Research In Motion’s (RIM) device software, which makes it easier for malicious parties to execute “phishing” attacks on unsuspecting smartphone users, has been addressed via handheld software updates from RIM. Flawed BlackBerry Browser Certificate Handling Dialogue Box From RIM’s online security advisory: “This advisory relates to a BlackBerry Browser dialog box that provides information about web site domain names and their associated certificates. The BlackBerry Browser dialog box informs the BlackBerry device user when there is a mismatch between the site domain name and the domain name indicated in the associated certificate, but does not properly illustrate that the mismatch is due to the presence of some hidden characters (for example, null characters) in the site domain name.” SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe The flaw relates to the BlackBerry software’s certificate-handling functionality. A hacker could potentially recreate, or “spoof,” a site commonly visited by BlackBerry users, such as RIM’s BlackBerry.com, by purposely adding “null characters” to the site certificate’s Common Name (CN) field. The recently discovered flaw keeps the BlackBerry Browser from correctly identifying mismatched site certificates due to an inability to render said null characters. (See screenshot below for an example of how the BlackBerry Browser box should look when it encounters site certificate issues due to the presence of null characters in site CN fields.) Accurate BlackBerry Browser Certificate Handling Dialogue Box w/ “Null Character” The flaw was rated 6.8 (Medium Risk) on a Common Vulnerability Scoring System (CVSS) scale of one to ten, with one representing little or no risk and ten representing very serious risk. CVSS is a vendor agnostic, open standard for the security industry meant to depict the seriousness of vulnerabilities, according to RIM. The BlackBerry-maker recommends that all BlackBerry users running handheld OS 4.5 or higher check in with their wireless carriers to see if device software updates are available. The problem: I just did a quick search of both AT&T and Verizon’s BlackBerry download pages, but in a number of cases I could only locate earlier software versions than those recommended by RIM. Here’s a list that specifies which software should be updated and to which new versions. Current Software Version BlackBerry Device Software v4.5.0.x to v4.5.0.173 or later BlackBerry Device Software v4.6.0.x to v4.6.0.303 or later BlackBerry Device Software v4.6.1.x to v4.6.1.309 or later BlackBerry Device Software v4.7.0.x to v4.7.0.179 or later BlackBerry Device Software v4.7.1.x to v4.7.1.57 or later Until you’re able to sit down and update your device–or while you wait for your carrier to issue an update–RIM says to use caution when clicking unknown links in SMS text or e-mail messages, even if they’re from what appears to be a trusted source. If you encounter a BlackBerry Browser dialogue box like the ones shown in this post, you should choose to close the connection rather than subject yourself to potential phishing-related risk, according to RIM. More information on BlackBerry security can be located on the company’s website. AS Via @Banthon FREE CIO BlackBerry NewsletterGet better use out of your BlackBerry and keep up-to-date on the latest developments. Sign-up » Related content feature Mastercard preps for the post-quantum cybersecurity threat A cryptographically relevant quantum computer will put everyday online transactions at risk. Mastercard is preparing for such an eventuality — today. By Poornima Apte Sep 22, 2023 6 mins CIO 100 CIO 100 CIO 100 feature 9 famous analytics and AI disasters Insights from data and machine learning algorithms can be invaluable, but mistakes can cost you reputation, revenue, or even lives. These high-profile analytics and AI blunders illustrate what can go wrong. By Thor Olavsrud Sep 22, 2023 13 mins Technology Industry Generative AI Machine Learning feature Top 15 data management platforms available today Data management platforms (DMPs) help organizations collect and manage data from a wide array of sources — and are becoming increasingly important for customer-centric sales and marketing campaigns. By Peter Wayner Sep 22, 2023 10 mins Marketing Software Data Management opinion Four questions for a casino InfoSec director By Beth Kormanik Sep 21, 2023 3 mins Media and Entertainment Industry Events Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe