Attacks/Breaches
12/7/2011
11:20 AM
Eric Zeman
Eric Zeman
Commentary
Connect Directly
RSS
E-Mail
50%
50%

RIM's PlayBook Security Patch Doesn't Last Long

Research In Motion hoped to close a security breach with a software update to its PlayBook tablet, but coders cracked the patch in only a few hours.

Research In Motion provided a system update to the BlackBerry PlayBook tablet late Tuesday. According to the changelog, the primary purpose of the update was to plug a security hole being exploited by the Dingleberry Playbook jailbreak tool.

The log said that version 1.0.8.6067, which is only 5 MB in size, "offers support for Flash 10.3 and updates to Adobe AIR to support developers in addition to DST and security fixes."

Researchers had recently released a tool--called Dingleberry--that unlocks the PlayBook, a first for RIM's tablet, which included government-grade security features. Once unlocked, PlayBook users are granted access to the entire PlayBook codebase, allowing them to do a lot more with it than through the generally available tools.

For example, the Android Market--and its hundreds of thousands of apps--is available for the first time on the PlayBook. While RIM is still developing PlayBook OS 2.0, which will bring support for Android apps in an emulator, impatient PlayBook owners can dive in now if they don't mind cracking the tablet's code. (The patch isn't yet available to developers already using the PlayBook OS 2.0 beta.)

[ No doubt, RIM's had a bad year. Will RIM Make It To 2013? ]

RIM responded to the news of a jailbreak for its beleaguered tablet. "RIM will follow its standard response process to develop and release a software update that is designed to minimize adverse impact to our customers or carrier partners," RIM said in a statement last week. "RIM is aware that the security researchers have stated they intend to release a tool to jailbreak the BlackBerry PlayBook tablet. If such a tool is released, RIM will investigate it."

As stated, the security patch was able to close up the breach discovered by the Dingleberry developers--but not for long.

Chris Wade, one of the researchers behind the rooting tool, released a new version of Dingleberry that uses a different exploit to punch through the PlayBook's security to achieve jailbreak.

RIM has yet to make any statements about the new jailbreak, but surely it is cursing and already looking at ways to plug the new hole.

Earlier this year, the PlayBook was awarded FIPS certification by the National Institute of Standards and Technology (NIST). It is the only tablet that has received this level of security certification.

FIPS certification is required for devices to be used by the federal government. This clears the PlayBook for use by government agencies, and means the PlayBook meets RIM's own stringent security requirements for features such as native email and contact management.

RIM has to stand by the PlayBook, especially with respect to security. I'd expect RIM to distribute a new security update as quickly as it can.

Database access controls keep information out of the wrong hands. Limit who sees what to stop leaks--accidental and otherwise. Also in the new, all-digital Dark Reading supplement: Why user provisioning isn't as simple as it sounds. Download the supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.