Green orange e life

RIM Customers Working On Contingency Plans

RIM Customers Working On Contingency Plans

By Scott Moritz and Olga Kharif

Research In Motion Ltd. (RIM) customers from GoDaddy Group Inc. to asset manager Thames River Capital UK Ltd. are preparing for the worst: the loss of the BlackBerry service their employees depend on to communicate.
RIM's stock has slumped more than 70 percent in the past year, and tumbled 19 percent on June 29 after the company posted a quarterly loss and delayed the BlackBerry 10 operating system, increasing the pressure on RIM to find a buyer or sell assets. While RIM has built infrastructure to ensure continued service, some customers are devising backup plans as RIM prepares to face shareholders at its annual meeting tomorrow.

"In the past three months there's been a lot of concern that the BlackBerry platform won't be around in the future," said Maribel Lopez, founder of Lopez Research, a wireless- industry consultant based in San Francisco. "It's not unheard of for a large phone manufacturer to go out of business."

Corporate customers, the backbone of RIM's business, are fortifying contingency plans so they won't be affected by a possible breakup of the BlackBerry-maker or other setbacks. With millions of employees connecting to the office through mobile e- mail, companies have been eager to establish a fallback or replacement plan, said Avi Greengart, a technology research director at Current Analysis.

Thames River Capital supplies about 140 of its 170 employees with smartphones, most of them BlackBerrys, said Robert Cockerill, head of infrastructure at the London-based money manager. With the delay of BlackBerry 10 and a service contract with RIM expiring this year, Cockerill said he expects much of his staff to switch to Apple Inc.'s (AAPL) iPhone or devices based on Google Inc.'s Android platform.

Service Disruption

Cockerill has brought in MobileIron Inc., a Mountain View, California-based developer of software that helps companies manage and protect data on mobile devices and tablets. MobileIron provides security for Thames River Capital including encryption and password protection for non-BlackBerry devices such as iPads, he said.

Thames River Capital is preparing for scenarios where BlackBerry service may be shut down, disrupted, or if a competitor such as Microsoft Corp. (MSFT) acquires RIM and converts the operating system to its Exchange e-mail service, he said.

"There is a risk of RIM getting bought," Cockerill said in an interview. "But if you have the right support you can be agnostic and it won't really matter."

MobileIron Chief Executive Officer Bob Tinker said his customer list includes 100 Fortune 500 companies, and about a quarter of those customers are financial services firms.

Embrace Innovation

"Large enterprises don't want to be locked in with a single vendor anymore," Tinker said in an interview. Customers want to embrace all the innovation in mobile and RIM's delay of BlackBerry 10 doesn't help that, he said.

"CIO's are now asking us: 'What do we do if RIM gets acquired or if they restructure,'" said Tinker.

Norton Rose LLP, a law firm with 6,000 BlackBerry-equipped employees, is using MobileIron's software to support iPhones and iPads, which were given to some staff members as secondary devices, said Vlad Botic, group enterprise architect at the London-based firm.

Botic, who said Norton Rose would like to continue using BlackBerrys, began exploring alternatives last year after the three-day BlackBerry outage that caused users around the world to lose data services amid a network failure.

"RIM isn't in a good position right now," Botic said in an interview. "The problem with BlackBerry, which was highlighted when the service went down, was that the only way to solve it is with an entirely new device."

'Significant Outage'

While the chance of BlackBerry service getting shut down is slim, Botic said he has scheduled a meeting with RIM this week to seek assurances that there won't be a disruption in the event of a takeover.

GoDaddy, an Internet domain-name and hosting company, could switch users to iPhone or Android devices "within hours," said Auguste Goldman, chief infrastructure officer at the Scottsdale, Arizona-based company.

In the event of a "significant outage" for BlackBerry devices, GoDaddy has a plan to migrate users to other platforms, Goldman said in an interview.

"The BlackBerry infrastructure and services are among our most valuable assets," said Nick Manning, a spokesman for Waterloo, Ontario-based RIM. "BlackBerry customers depend on our robust network and they can continue to depend on it going forward."

RIM shares fell 5.3 percent to $7.67 at the close in New York.

iPhone, Android

Six staffers at Nationwide Mutual Insurance Co. first began planning for the possibility of a disruption in BlackBerry service last year. To prepare, Nationwide retained Good Technology Inc., whose software for servers and phones can provide secure corporate e-mail and calendar services to iPhones and Android devices.

"You could see that RIM started to decline," Robert Burkhart, director of new technology innovation at Nationwide, said in an interview.

Today, the number of BlackBerrys Nationwide associates use is down to 7,000 from about 8,500 a year ago, while the number of non-BlackBerry devices used has risen from zero to 4,450, Burkhart said.

"We are well on our way to having a dual environment, so if RIM did go out, we'd be okay," Burkhart said. "If people are starting contingency plans now, they are behind the eight ball. They should have been looking at this all along."

Good Technology, which works with 4,000 corporate customers worldwide, including eight of the top 10 financial services companies, has seen an inflow of customers concerned about RIM's prospects and making contingency plans.

Contingency Plans

"We've had two meetings this month with large financial services firms on this topic," Brian Carr, senior vice president of worldwide sales at Sunnyvale, California-based Good Technology, said in an interview. "In the last year, I talked with half of Fortune 100 companies, and it's a concern for all of them. Every single one of them is looking at contingency plans."

The concerns are prompting many companies to speed up their transition from BlackBerries to other types of mobile devices, Carr said.

RIM has struggled to keep up with Apple's iPhone and devices based on Google's (GOOG) Android platform. Last month, RIM said it would cut 5,000 jobs and posted a quarterly loss that was five times bigger than projected. Sales last quarter plunged 43 percent as RIM's share of the global smartphone industry fell by more than half to 6.4 percent in the first three months of the year, according to research firm IDC.

BlackBerry Migration

"RIM's situation is dire, but even in a worst-case scenario, RIM's servers aren't likely to get turned off anytime soon," said Current Analysis's Greengart. "Still, IT managers are looking more seriously at alternatives to BlackBerry. There's a whole industry ready to provide security and management around Apple and Android," he said.

The migration from BlackBerrys started two years ago for Ken Lawonn, senior vice president of strategy and technology at Alegent Health, an Omaha, Nebraska-based health-care provider.

The shift was prompted by user preferences, rather than concerns about the future of RIM, said Lawonn who uses Good Technology's software. The number of Alegent's 300 smartphone users with BlackBerrys has shrunk to 10 percent from about 50 percent two years ago, he said.

"Should something occur, we believe that's going to be a fairly easy transition," Lawonn said. "If my BlackBerry broke down, I'd look at the options, and if a BlackBerry wasn't available, I'd pick up an iPhone and be on my way."

Yahoo Defends Android App, Botnet Questions Remain

Security firm traces torrent of spam to Yahoo's failure to activate HTTPS by default in its Android app.

By Mathew J. Schwartz

Is a big, bad Android botnet sending mountains of spam to unsuspecting email users?

That was the warning issued by Microsoft researcher Terry Zink last week, who said that spam traps had been capturing inordinate amounts of bogus email that had been sent using Yahoo IP addresses associated with the search giant's Android app. As security experts questioned what exactly might be happening, a Google spokesman cautioned that the available evidence didn't add up to a botnet, but rather "that spammers are using infected computers and a fake mobile signature to try to bypass anti-spam mechanisms in the email platform they're using."

Facing criticism for suggesting that there was a new Android botnet sending spam, Zink fired back, saying that whether or not the email signatures are faked, something's been sending spam via Yahoo's Android channels. "The reason these messages appear to come from Android devices is because they did come from Android devices," he said in a blog post.

Other information security researchers backed up that finding. "Many, including Google, have suggested the messages are forged. We see no evidence of this. The messages are delivered to our spam traps from genuine Yahoo! servers with valid DKIM [DomainKeys identified mail] signatures," said Chester Wisniewski, a senior security advisor at Sophos Canada, in a blog post.

Yahoo, meanwhile, defended its Android app. "While our investigation into claims of a potential malware compromise operating as a botnet is ongoing, we can confirm that there is not a problem with our official Yahoo! Mail app for Android and there is no reason for users to uninstall the app," said a Yahoo spokeswoman Friday via email.

What's going on? "One of two things is happening here," said Wisniewski at Sophos. "We either have a new PC botnet that is exploiting Yahoo!'s Android APIs or we have mobile phones with some sort of malware that uses the Yahoo! APIs for sending spam messages."

But in fact, the culprit may not be malware-infected PCs, botnets, or some never-before-seen type of Android malware. According to mobile security firm Lookout Security, in fact, the problem is rather the Yahoo mail Android app's default use of HTTP. "Yahoo! Mail for Android does not encrypt its communications by default--it performs all its functions over HTTP, not HTTPS," according to a blog post from Lookout. "This means that any traffic that is sent by the Yahoo! Mail Android app can easily be intercepted over an open network connection such as a public Wi-Fi network. This exposes Yahoo! Mail for Android to session hijacking, a form of attack that gained mainstream attention with Firesheep."

Introduced in 2010, Firesheep is a Firefox plug-in that can be used on any unsecured Wi-Fi connection to hijack the session cookies of anyone sharing the same connection who logs onto a website that uses HTTP, but not HTTPS. Created by Eric Butler, the plug-in was designed to illustrate how--in his words--"on an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy." Attackers had long been able to execute credential-hijacking attacks using free, open source tools. But in the wake of Butler's plug-in release, numerous online service providers, including Facebook, added HTTPS as an option--if not always a default.

A Yahoo spokeswoman didn't immediately respond to an emailed request for comment on Lookout's theory. But according to Lookout, Yahoo's failure to use HTTPS by default means that an attacker could easily create an open Wi-Fi network, then wait for people using the Yahoo Mail app on Android to join the network, and check their email. "The attacker intercepts a particular cookie and can use it to impersonate that user, over whatever networks are available to them, including by tethering to a mobile network," said Lookout. "This allows the attacker to send spam emails that appear 100% legitimate."

Given that revelation, all Android users who employ the official Yahoo Mail app on their smartphone or tablet should immediately set the app to only check for email using HTTPS, as opposed to the default HTTP setting. According to Lookout, "from within Yahoo! Mail, simply open Options > General Settings and select 'Enable SSL.'"

Furthermore, while this latest attack targets only users of the Android Yahoo Mail app, it reinforces the need to use HTTPS whenever possible. "All mobile users should exercise caution when connecting to open Wi-Fi networks from a laptop or mobile device. We recommend that desktop users of Firefox or Chrome install the plug-in HTTPS Everywhere to ensure that their traffic to popular sites is properly secured," according to Lookout.