The Mobile Application Hacker's Handbook

CHAPTER 15Attacking BlackBerry Applications

In the previous chapter you learned about the underpinnings of BlackBerry applications and how to analyze them primarily in a static fashion. To be able to put these analysis techniques into practice, you also need to know about the attack surface of an app. Knowing about the app enables you to choose the correct technique to employ. Although each app is different in terms of attack surface, several elements are more common than not.

In this chapter we look at each of these attack surface elements and how they might be attacked. In the previous chapter you looked at some of the BlackBerry 10 app security fundamentals, architectural elements, and base security analysis techniques for apps, but in this chapter you dig a little deeper by looking at a number of fundamental concepts for BlackBerry 10 apps and how they can be attacked.

As with apps on any other operating system, whether it’s a full-fledged, general-purpose OS or a proprietary, hardware-abstracting, real-time OS, the principles of analyzing and attacking apps are the same. Namely, you want to be able to perform the following tasks:

• Identify inputs that traverse trust boundaries over which an attacker has influence or control with the goal of disrupting, influencing, or changing app execution or behavior.
• Intercept secure transport mechanisms with the goal of inspecting or modifying the data protected by it.
• Intercept transport mechanisms with the goal of modifying the data. ...