// you’re reading...

BlackBerry

Kiss your BlackBerry spyware goodbye

kissesI have released the latest version of Kisses.  I promised everyone in my Hack In The Box presentation that I would release newer versions of the toolkit Bugs & Kisses.  Today, I hopefully deliver on that promise.  As far as I’m aware, this tool is the first of its kind to be offered to BlackBerry users that is free.  In short, the tool detects hidden programs installed on your handheld.  If any are found, it allows you to reveal them so that you can remove them more easily.  If you recall the Etisalat fiasco, their spyware tool would hide itself and make it very difficult for an average user to remove from his BlackBerry [whitepaper here].  With Kisses, you will be able to reveal such programs very easily.  Additionally, Kisses also shows you any hidden processes on your handheld.  It also allows you to drill down further into each program and reveal information about its vendor, download date/time, size and process id.

Before I released the tool, I had a lot of people asking me if it will detect the FlexiSpy program.  While I didn’t want to spend close to $200 just to find out if it does, I am very certain that Kisses can detect it.  How do I know? Because Kisses will probe 2 areas of your handheld:  1) All running processes belonging to all applications on your handheld 2) All installed applications regardless of whether they are hidden or not.  This gives you an idea of exactly what is running on your handheld at any one time.  By letting you drill down further, you can discover more details of each application module.  With these capabilities, you’re bound to find not only FlexiSpy, but other bits of spyware  or suspicious applications as well (provided an undiscovered variant exists).

This is a project I’m very keen in and will be actively pursuing its upkeep.  I have a whole list of enhancements and features to add to it.  You can check the website for updates.  Alternatively subscribing to this blog, following me on twitter or LinkedIn will also keep you updated.

Share this on:
  • Digg
  • del.icio.us
  • Facebook
  • Google Bookmarks
  • Reddit
  • StumbleUpon
  • Tumblr
  • Twitter
  • Slashdot

Discussion

Comments for “Kiss your BlackBerry spyware goodbye”

  • GTC Research Engineer
    Hi Chirashi,

    Thanks a lot for a wonderful tool. As you mentioned that your tool can detect FlexiSpy and I would assume so but user will not be able to find out which module or app belongs to flexispy because it is installed with a different name and almost impossible for anyone to detect it manually.
  • Ch0pstick
    Hi there,

    I did anticipate that which is why the user is able to drill down to each module and gather more details. I haven't done so in this release, but will also eventually display the signer id and hash so that I can compare it with FlexiSpy. Sure, I'd have to drop about $200 on it just to get this information, but hey, I figure its worth it to grab the signature and reverse engineer the COD. :)

    Right now, a user can list processes that are running, but do not show up in the visible applications. This list is significantly small (for me, I have only one hidden process which is Google Sync). Then, by drilling down further, a user can look at each and every process including the download date to figure out if and when he did install it. If it looks suspicious, he can search for it in his installed programs; if its hidden there as well, then there really is something fishy. Lastly, he can use Kisses to reveal the hidden program and remove it.

    I notice you work for SMobile Systems. You should try it out if you've already got a version of FlexiSpy. ;)
  • GTC Research Engineer
    We already got AV for BlackBerry which prevents it from FlexiSpy and other malwares.
  • Name
    One minor bug, when you look at the Processes screen, it shows the same apps a few times
  • Ch0pstick
    Its not a bug actually because some modules have more than one Application Descriptor and I list all of them. In some cases you will notice different PIDs for each process. Right now, I don't check for distinct PIDs, but plan to do so in the next revision. Thanks for your feedback.
  • z___
    Are you going to release the source for the application? How can we trust security software if we cannot verify and build it ourselves?
  • z___
    Are you going to release the source for the application? How can we trust security software if we cannot verify and build it ourselves?
  • Ch0pstick
    I will release the source as soon as I clean it up. There are so many discerning people out there that I'd be embarrassed to post my source as is. Please keep checking back on the site and thanks for your comment.
blog comments powered by Disqus