We've heard a lot about security issues with the iPhone, but the BlackBerry isn't immune to threats from malicious apps.

Tyler Shields, a senior researcher at the Veracode Research Lab, has written a piece of spyware that allowed me to shoot an SMS command to his phone and have his contact list forwarded to my e-mail address in a demonstration. With another short text command, I was able to get his BlackBerry to e-mail me any SMS messages he sends.

And if I had wanted--and he had allowed me--I could have seen a log of all his calls, monitored his inbound text messages, tracked his location in real-time based on the GPS (Global Positioning System) in his device and turned his microphone on to listen to conversations in the room and record them.

"It's trivial to write this type of code using the mobile provider's own API [application programming interface] they provide to any developer," Shields said in an interview in advance of his talk on the spyware scheduled for the ShmooCon security show on Sunday.

He calls his program "TXSBBSpy" and is releasing the source code but not an executable version of it. "My goal is to show how easy it is to create mobile spyware," he said.

TXSBBSpy "can take data from the phone, both in real-time and in snapshots, and send it off via SMS or e-mail to any Web server or TCP [Transmission Control Protocol] or UDP [User Diagram Protocol] network connections," Shields said.

While I was able to control the spyware using text messages sent from my mobile phone, the spyware had to be first installed on his BlackBerry for the snooping to work. This can be done by sending the target victim an e-mail or text with a link to a Web page where the spyware is surreptitiously installed. Or it can be hidden inside a legitimate-looking app downloaded from the App Store.

The risks are similar to those posed by Swiss researcher Nicolas Seriot in his iPhone spyware demo at the Black Hat DC security conference on Wednesday.

"These types of behaviors we're demonstrating will be universal across all mobile platforms," Shields said.

The BlackBerry platform has a "significant number" of security mechanisms in place that could be used to mitigate against these types of attacks, he said. For instance, the user can set the options to limit what access to specific types of data a particular app can have, he said.

Read More