Following the recent Pwn20wn hacking challenge to crack the WebKit browser engine utilised in both Android and Blackberry OS6 powered devices, RIM, the makers of Blackberry handsets, have advised users to disable Javascript to avoid the loophole discovered during the challenge.
The hacking challenge took place during the CanSecWest conference last week. The exploit discovered allows users misdirected to a malicious website to hack the phone via the use of Javascript commands. While Google, the creator of the Android operating system, were able to act quickly enough to release a security patch to avoid the security loophole affecting their devices, RIM offered the following advice to customers:
‘Users of BlackBerry [OS] 6.0 and later can disable the use of JavaScript in the BlackBerry Browser to prevent exploitation of the vulnerability. Important: Turning off JavaScript may impact the ability to view web pages, or result in a diminished browsing experience.’
The security hole allows access to information on the phone itself and any external media currently inserted; photographs and other saved documents may be accessible. It does not allow access to application data such as personal e-mail, contacts or calendars, as these are stored in a separate internal file system to the main device.
RIM realise this is a temporary solution and anticipate the release of a security patch imminently. In the meantime, users can be careful when browsing websites, not following suspicious or unsolicited links.
