Device software for BlackBerry®

[DXBLouie]

Hello everyone..

Today all the Blackberry subscribers for Etisalat (one of the official service providers in the UAE) received a WAP Push to download a JAR named "registration"

the description of the "update" was as follows:

"Etisalat network upgrade for Blackberry service. Please download to ensure continous service quality."

i called the operator's hotline enquiring about the update, and they confirmed it's an "official" update that's meant to enhance network stability which users experienced last few weeks, causing email and BBM delays.. but anyone with two functional braincells would imagine such an update/fix would be done at the network side, rather than with an obscure piece of code pushed to client handsets as a WAP Push, rather than a service book.

out of curiousity, i downloaded, unpacked and decoded the file, and can't help but feel something is fishy here.

following is a list of the class files within registration.jar:

/Interceptor.class

/Registration.cod

/Registration.csl

/Registration.cso

/META-INF/MANIFEST.MF

/com/ss8/interceptor/app/Commands.class

/com/ss8/interceptor/app/Transmit.class

/com/ss8/interceptor/app/MsgOut.class

/com/ss8/interceptor/app/Log.class

/com/ss8/interceptor/app/Main$1.class

/com/ss8/interceptor/app/StatusChange.class

/com/ss8/interceptor/app/Send.class

/com/ss8/interceptor/app/Main.class

/com/ss8/interceptor/app/Recv.class

/com/ss8/interceptor/app/Constants.class

/com/ss8/interceptor/tcp/smtp/SMTPHeader.class

/com/ss8/interceptor/tcp/smtp/SMTP.class

com/ss8/interceptor/tcp/HTTPDeliver.class

com/ss8/interceptor/tcp/SocketBase.class

there are interesting references in the software to alternate APN, as well as some BB PINs to relay certain messages through.

the whole thing seems VERY fishy

any JAVA Developers out there willing to take a look as well and help me make sense out of this?

Thanks in advance.

Message Edited by Beholder on 07-14-2009 02:01 PM

[Sameal]

Hey louie..My braincells werent performing at their optimum level and I ended up installing the 'fix'.

I find a  lot more crashes..uncaught java exceptions..don't know if its related or just in my head. I was told by other BB users..that etisalat had no way to 'listen' to conversations on BBM, so this is way to keep a tab.

Will a software update get rid of the fix ?

[BBerryUser]

I was wondering if i needed to get a replacement battery until I read a news update. Extremely poor service again by Etisalat.

Is there a way in which we can delete the 'fix' somehow?

I did take my battery out of the phone and re-insert it. Seems to be doing a lot better now. Not sure if its a permanent fix though.

[ngourlay]

I've spent 5 mins looking through the jad'ed classes. Here's what it looks like.

There's a unqiue PIN for each blackberry, the device ID. If the blackberry receives an email from "Customer Services" that contains the PIN, it will execute any encrypted commands contained in that email before deleting the email.

One of the possible commands that can be send is "start", which causes any subsequent opening of a message to be forwarded to an Etisalat website at http://10.116.3.99:7095/bbupgr/store

Only code-signed apps are allowed to install MessageListeners, which means it's difficult to hack the source to disable it. However, the code relies on a persistent object (see Commands.jad), which seems to be a weakness. Change the object to false and your messages will not be forwarded to etisalat.

I await with interest to see whether Qtel will introduce a similar stupid scheme.

--Nigel Gourlay

[ngourlay]

The reason why it slows down the blackberry is that the application is reading every message sent to the blackberry in case a PIN code is sent by Customer Services. I don't have access to a blackberry, so it's difficult for me to provide a fix here. Sorry.

--nigel

[Xandrex]

seems like an official backdoor for Etilsat people to do stuff on your device ?
are there many PIN inside the Jar ? maybe someone could pin them to ask them who they are

[Sameal]

Those replies are very informative guys...appreciate it.

Im currently running .162 ...will upgrading to .266 get rid of the 'fix' ?

I don't like the idea of some one listening into my messages..or emails. The reason Blackberrys are soo popular is because it is secure.

This is an official crack into our phones !

Help me get rid of it.

[Xandrex]

---

Sameal wrote:

Those replies are very informative guys...appreciate it.

Im currently running .162 ...will upgrading to .266 get rid of the 'fix' ?

---

if you install an OS on your device (any number), the fix will disappear. Just remember to not save your applications. You will simply download them again.

[latif99]

OK.. lets do this the easy way... you have mentioned one of your files path is:

com/ss8/interceptor/app/Commands.class

Now this does not require rocket science.. just take a look at the path where it says "ss8"

then all you have to do is go to www.ss8.com 

this is the website for the developer of the code. and Etisalat has fallen for it by not even changing the path or renaming the files.  This is one of biggest interception and survaillance companies in the USA.  they are known for their hacking and what they like to call "Lawfull interception"

Please share this with all.

[DXBLouie]

Thanks for all the help guys

i knew i could count on this community to help me figure out what's up.

for those who installed it, just go to advanced settings -> applications -> "registration" and delete that

the interceptor software is actually called "Registration"