Setting up Proxy for Blackberry Simulators

Setting up Proxy for Blackberry Simulators:

1. Install MDS and email simulator

2. Install Device simulator

3. Open the rimpublic.property file. The rimpublic.property file can be found at \Program Files\Research In Motion\BlackBerry Email and MDS Services Simulators #.#.#\MDS\config

(Please note location differs if you are using a Blackberry JDE (Java Development Environment))

4. Under the [HTTP HANDLER] section, update the following:

application.handler.http.proxyEnabled = true

application.handler.http.proxyHost=hostname

application.handler.http.proxyPort=hostport

5. Use charles proxy as localhost at port 8888 for best results.

Interested Further: http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/348583/800738/800792/801079/How_To_-_Configure_the_BlackBerry_MDS_simulator_to_work_behind_a_proxy.html?nodeid=800740&vernum=0

This link suggests reverse proxy usage for SSL traffic interception: http://gursevkalra.blogspot.com/2011/06/intercepting-blackberry-application.html

Android 4.0 Face Unlock bypass

Google recently launched its latest Android version (4.0). One of the new features it has is Face Unlock. This is in news with some videos demonstrating how this feature can be fooled by simply showing it a digital image of the user.


A key learning for any developer/vendor is to make sure that they have tested their product for the basic test cases before launching. Think about the bypass vectors for your feature, frame test cases for these vectors, and finally test it to see the result. If you find the test case to fail, then fix the code.

A simple test case for a feature like Face Unlock is to "show it a printed photograph" or "show it a digital image". I am sure Google must have done their part well. Lets wait to listen some official announcement on this.

About IPT & 2FA

I read an article today which says-


MasterCard today became the latest company to employ Intel's Identity Protection Technology (IPT) -- which basically converts a laptop or client device into a second factor of authentication -- for online commerce.


Full details here: http://www.darkreading.com/authentication/167901072/security/client-security/231903013/baking-strong-authentication-into-client-devices.html


My thoughts-


Hardcoded Intel chip plays the role of software token, thus providing the token for Two Factor Authentication (2FA). Entire security lies on the fact that it is very very difficult to break into the hardcoded chip. This sounds promising for now.