NoScript security tool released for Android, Maemo

The mobile version of the Firefox extension includes protection for cross-site scripting attacks and clickjacking

The developer of the widely used Firefox extension NoScript has released a version for the Android and Maemo operating systems.

NoScript is a security tool that can be used to block the execution of JavaScript, Java, Flash, and plugins by websites that are viewed as being potentially malicious. Many Web-based attacks on computers are initiated by JavaScript.

[ Learn how to manage iPads, iPhones, Androids, BlackBerrys, and other mobile devices in InfoWorld's 20-page Mobile Management Deep Dive PDF special report. | Keep up on key mobile developments and insights via Twitter and with the Mobile Edge blog and Mobilize newsletter.

NoScript's developer, Giorgio Maone, wrote on his blog on Saturday that porting the application for Firefox on Android and Maemo was not easy, as it was a full rewrite of the extension, and "there's still a lot of work ahead."

The mobile version, called NoScript 3.0a8, includes protection against cross-site scripting attacks, in which a script drawn from another website is allowed to run that shouldn't. Cross-site scripting can allow an attacker to steal information or potentially cause other malicious code to run.

It also can block "clickjacking," another kind of attack where a user is tricked into clicking on certain parts of a Web page with hidden buttons that perform malicious actions. Those hidden buttons are delivered by an invisible iframe, which is a window that brings other content into the target website.

In 2008, researchers Robert Hansen and Jeremiah Grossman discovered a clickjacking attack involving Adobe Systems' Flash application that could give remote access to a victim's Web camera and microphone.

There are around 1,000 pieces of malware circulating for mobile devices, which pales in comparison to malware built for Windows desktop operating systems. But security analysts predict that mobile phones will increasingly be attacked for the sensitive data stored on the devices.

The NoScript mobile version shares many of the same functions as the desktop one. For example, users can built an "easy blacklist," where they select untrusted sites on which JavaScript and plugins should be blocked. Another option is the "classic whitelist," where sites that are trusted are added to a list that NoScript doesn't block.

Maone wrote that NoScript does not require the browser to be restarted after updates are installed, which "means that hot fixes for new security threats can be deployed in a more effective, timely, and convenient way." Read More...

BlackBerry outage made roads safer, police claim

According to media reports, police in the United Arab Emirates have given a surprising explanation for a dramatic fall in traffic accidents last week: drivers' BlackBerrys weren't working.

It's claimed that last week's worldwide BlackBerry outage, which frustrated business people around the world who were unable to communicate with their colleagues, had one positive result - less texting and reading of emails by people who should have been concentrating on driving instead.

Road traffic accidents in Abu Dhabi are said to have dropped by 40%, and there was a 20% reduction in Dubai in the past week.

According to The National newspaper, Lt Gen Dahi Khalfan Tamim, the chief of Dubai Police, and Brig Gen Hussein Al Harethi, the director of the Abu Dhabi Police traffic department, both linked the drop to the service disruption experienced by BlackBerry users.

"Absolutely nothing has happened in the past week in terms of killings on the road and we're really glad about that," Brig Gen Al Harethi told the newspaper. "People are slowly starting to realise the dangers of using their phone while driving. The roads became much safer when BlackBerry stopped working."

There may be another explanation for the reduction in mobile-phone related traffic accidents in the UAE, however.

At the end of last month, popular UAE footballer Theyab Awana was killed in a high speed crash near Abu Dhabi, and it was claimed that he was sending a message on his BlackBerry when he hit a lorry.

The football star's father, Awana Ahmad Al Mosabi, made an emotional plea to people not to use smartphones while driving, and a Facebook campaign against the use of BlackBerry Messenger while driving has grown in popularity.

Of course, texting messages or reading emails while you are in charge of a motor vehicle is insane. You aren't just putting yourself at risk, you're putting other innocent travellers in peril as well.

If you need any convincing, here's a shocking video that was made to highlight the danger. Please note: the video is graphic and may be upsetting to some people.

Whether you believe the police are right that the BlackBerry outage contributed to the reduction in road traffic accidents or not, please don't text and drive.

Read More...

BlackBerry outage, video apologies, a hoax and Ronnie Corbett [video]

Millions of BlackBerry owners around the world have been feeling the pain this week as messaging and email systems collapsed in a service outage.

With many turning to social networks to vent their anger, and even newspaper cartoonists making fun of the situation, bosses at Research in Motion (RIM) have clearly been feeling the heat.

RIM founder Mike Lazaridis has appeared on video explaining that although services are "approaching normal BlackBerry service levels in Europe, the Middle East, India and Africa" the company can not give an estimated time for systems to have recovered globally.

Lazaridis has also warned that there could be more instability to come. Clearly BlackBerry users aren't entirely out of the woods yet.

Things aren't helped, of course, when nonsensical BlackBerry-related hoax messages are spread. A message has been distributed via BlackBerry Messenger (BBM) claiming that users have to forward the message to all of their contacts, or else their BlackBerry account will be disabled.

Broadcast this message to every single contact on your BBM to reset your display picture, sorry for any inconvenience. This message is to inform all of our users, that our servers have recently been really full, so we are asking for your help to fix this problem. We need our active users to re-send this message to everyone on your contact list in order to confirm our active users that use BlackBerry Messenger, if you do not send this message to all your BlackBerry Messenger contacts then your account will remain inactive with the consequence of losing all your contacts Symbol will automatic update in your BBM ,when you broadcast this message. Your blackberry will be updated within 24 hours it will have a new lay out and a new color for chat.

Of course, the message is nonsense - and it should not be forwarded.
If you need some cheering up, and want a more humorous take on a blackberry not working, check out this sketch by British comedy veteran Ronnie Corbett:

Update: RIM is now reporting that its services are "fully restored." The BBC reports that at a press conference, RIM said they would begin a full investigation into what went wrong and caused the biggest crash in the company's history.

Read More...

Russian security company adds BlackBerry password cracker

Elcomsoft says its software can extract a master device password from an encrypted BlackBerry memory card

A Russian security company has upgraded a phone-password cracking suite with the ability to figure out the master device password for Research in Motion's BlackBerry devices.

Elcomsoft said on Thursday that before it developed the product, it was believed that there was no way to figure out a device password on a BlackBerry smartphone. BlackBerry smartphones are configured to wipe all data on the phone if a password is typed incorrectly 10 times in a row, the company said.

[ Learn how to manage iPhones, Androids, BlackBerrys, and other smartphones in InfoWorld's 20-page Mobile Management Deep Dive PDF special report. | Keep up on key mobile developments and insights via Twitter and with the Mobile Edge blog and Mobilize newsletter. ]

Elcomsoft said it figured a way around the problem using a BlackBerry's removable media card, but only if a user has configured their smartphone in a certain way. In order for Elcomsoft's software to be successful, a user must have enabled the feature to encrypt data on the media card.

The feature is disabled by default, but Elcomsoft said around 30 percent of BlackBerry users have it enabled for extra security.

The company's software can then analyze the encrypted media card and use a brute-force method to figure out a password, which involves trying millions of possible password combinations per second until one works.

Elcomsoft said it can recover a seven-character password in less than an hour if the password is all lower-case or all capital letters. The software does not need access to the actual BlackBerry device but just the encrypted media card.

The new feature is wrapped into Elcomsoft's Phone Password Breaker. It costs £79 ($123) for the home edition and £199 for the full-featured suite, which can also recover plain-text passwords used to access encrypted backup files for Apple's iPhone, iPad and iPod Touch devices. To crack those passwords, a user does need to have the Apple device in hand.

The BlackBerry password recovery feature is only available in the professional edition. Elcomsoft has published a chart comparing the two versions.
The backup files contain sensitive data including call logs, SMS archives, calendars, photos, email account settings, a person's Web browsing history and more.

Elcomsoft reserves some of its password-cracking software strictly to vetted law enforcement, such as its iOS Forensic Toolkit, which can extract passwords and decrypt a device's file system.

 

Read More...