Be careful when changing application permissions on your BlackBerry

Your BlackBerry can perform a great number of tasks, but unless you give it permission only native applications can access the truly sensitive information. When a third party application requires access to this walled information, it requires you to change the application permissions. This happens when you first run the application after installation. You can either grant the application the proper permissions and start using, or deny the changes and not use the application. I’m as guilty as anyone else of blindly accepting permission changes from time to time. Like everyone else, I should stop and pay more attention. Grant the wrong application certain permissions, and you can compromise your device’s security.

Tyler Shields, a senior researcher at the Veracode Research Lab, recently demonstrated just how easy it is to write code for mobile spyware. Using only a mobile provider’s API, he crafted software that could allow a malicious coder to gain access to personal and supposedly secure information from another person’s BlackBerry. Specifically:

I could have seen a log of all his calls, monitored his inbound text messages, tracked his location in real-time based on the GPS (Global Positioning System) in his device and turned his microphone on to listen to conversations in the room and record them.

That’s quite a scary proposition. Thankfully, as RIM is quick to point out, the only way a user can fall victim to this type of attack is if they install an application and allow it the right permissions. Unfortunately, many popular applications require permissions changes. So how do you avoid this risk? The only answer I can provide is by remaining cautious about software not recommended by a reliable source.

If you want to check on which applications on your BlackBerry have altered permissions, head to Options, Advanced Options, Applications. As you can see in the above screenshot, some applications are bolded. Those run with altered permissions. If you see any on the list that you don’t trust and are worried about the possibility of a spyware attack, you can delete them. I will add, though, that I’m not sure how common this type of attack is. It’s all a judgment call on your part.

For the super-geeky, here’s a video demo: