Vulnerability hits Java for cell phones
96627
com October 22, 2004, 5:05 PM PT. Cyber threats, chiefly viruses like NetSky and Sasser, make security an ongoing concern as it holds steady over software infrastructure as the third top priority.
693229
(InfoWorld) - A team of security experts in Baltimore said it has found a flaw inÂ Apple's iPhone handsetÂ that can be used by attackers to access private data stored on it. Independent Security Evaluators (ISE) said on a Web site dedicated to explaining the flaw and its exploitation that an attacker could gain access to the iPhone through a wireless access point, or through a Web site controlled by the attacker. Numerous hackers have beenÂ working to gain access to the iPhoneÂ in order to activate certain features or to allow it to be used on cellular networks other than AT&T's. However, this is the first major exploitation of an iPhone security flaw. Because the iPhone connects to wireless Internet access networks, such as Wi-Fi, by name, an attacker could create a network with the same name and encryption method as one the handset already uses. The attacker could then substitute a Web page with exploit code to gain access to the phone, ISE said on its Web site. An attacker could also use a link planted on an unedited or unmoderated online forum, or a link sent by SMS or e-mail to use make use of the flaw and gain access to the handset, ISE said. The company said its researchers had required two weeks of part-time work to find the flaw and exploit it. When the iPhone's Safari browser opens a malicious Web page, malicious code can be run on the phone via the flaw, allowing the attacker to read the iPhone's SMS log, address book, call history, and voice-mail information, which are also then sent to the attacker, ISE said. ISE said it would be presenting full details of the exploit and its procedure at the Black Hat 2007 conference in Las Vegas on August 2. Â
738304
Mobile devices are slowly becoming the targets of hackers, but a more serious threat could be the arrival of the intriguing software-defined radio, which uses software instead of circuitry.
320036
(InfoWorld) - Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple's iPhone, a flaw that allows them to steal any data from the device or even to turn it into a remote surveillance tool. The trio -- Charles Miller, formerly with the National Security Agency; Jake Honoroff; and Joshua Mason of Baltimore-based Independent Security Evaluators (ISE) -- have notified Apple of the vulnerability and given the company less than two weeks to fix the bug before Miller presents more information at the Black Hat conference on Aug. 2. According to a paper posted by the three, they rooted out a vulnerability in the iPhone's version of Safari using "fuzzing" tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using "man in the middle" tactics to trick users into connecting to a malicious wireless access point. Once the exploit runs, it's essentially game over, the researchers said: The iPhone is owned. "In our proof of concept, this code reads the log of SMS messages, the address book, the call history, and the voicemail data," the researchers wrote on the ISE site. "It then transmits all this information to the attacker." But wait -- there's more! That, however, could be just the beginning. The researchers claimed that a second exploit actually operated the iPhone remotely once the device was hijacked. "When we viewed a second HTML page in our iPhone, it ran the second exploit payload which forced [the iPhone] to make a system sound and vibrate for a second," they said in the paper. "Alternately, by using other API functions we discovered, the exploit could have dialed phone numbers, sent text messages, or recorded audio (as a bugging device) and transmitted it over the network for later collection by a malicious party." The vulnerability was reported to Apple last Tuesday, July 17. "We proposed a fix Apple could include in a future iPhone update," the researchers said, "but we don't know if they plan to do so. They responded and are looking into it." In an e-mail late Sunday night, Apple spokeswoman Lynn Fox would only say: "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We're looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security." She declined to answer questions about the Aug. 2 deadline, whether Apple would issue a patch before then, or what the company thought of the way the trio disclosed the vulnerability. Miller will provide more information on the vulnerability and exploit at the upcoming Black Hat 2007 security conference, which opens next Saturday, July 28, in Las Vegas. But is this the ethical way? ISE's president, Avi Rubin, defended the decision to announce the existence of the vulnerability prior to a patch being made available by Apple. "Why are we doing that? Well, I believe that there is a social responsibility to report it when a device is vulnerable to attackers," said Rubin on his own blog Sunday. "People buy these things and use them in ways that put their identity and their online accounts at risk, and by exposing these vulnerabilities, we can make users better judges of how to use their high-tech devices." Rubin is familiar to many security observers from his research into problems with electronic voting systems. The paper by Miller, Honoroff, and Mason also spelled out a number of weaknesses in the iPhone's security architecture, although it didn't specifically pin the vulnerability on any of those flaws. One, however, most likely contributed to the reach of the exploit. "There are serious problems with the design and implementation of security on the iPhone," the paper said. "The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device." Other deficiencies the trio cited in the iPhone's operating system included not using address randomization -- a technique applied by Windows Vista that's designed to make it tougher for hackers to write reliable attack code -- and allowing code in the heap to execute. Those last two shortcomings have been criticized in the desktop version of Mac OS X for some time. Three months ago, during the fallout after a hacking contest that jacked a MacBook Pro notebook, HD Moore -- the vulnerability researcher noted for the Metasploit hacking and attack testing software -- took on the claim that Mac OS X is safer than Windows. "The Mac OS X platform is years behind Linux, Windows, and OpenBSD in terms of operating-system security," said Moore then. "All of the above platforms support some form of address randomization (ASLR) and include features that make exploitation slightly more difficult." The ISE researchers have also posted a short video of their hack in action on YouTube.
19025
Kernel bogey Security researchers have discovered you can crash an iPhone through the medium of a cleverly crafted webpage.â¦
594014
Excessive text messaging may be bad for you, or at least for your fingers.
762398
A team of security experts said it has found a flaw in the iPhone handset that can be used to access private data stored on it.
679761
Looks like the time has come when mobile users would have to seriously consider getting some protection for their devices. Mobile viruses are coming out pretty regularly now and trend seems to be pointing towards a frantic future.
103850
Owners of the Nokia 7610 are warned to look out for a malicious program that makes phones almost useless.
453054
A vulnerability in radio-frequency ID chips could put millions of users of wireless car key tags or speed pass payment devices at risk, according to a recent study by researchers at Johns Hopkins University and RSA Laboratories.
112205
Software update patches bug in wireless drivers that left systems vulnerable.
331980
InfoWorld - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet&#39;s addressing system, prompting the software&#39;s maintainers to retire the affected version.
302649
Beta search app creates vulnerabilities that may threaten your data's   security.
181551
A virus aimed at users of next-generation mobile phones is making the rounds, casing headaches for those using handhelds based on the popular Symbian operating system.
576338
(InfoWorld) - Apple's iPhone is a toughÂ target for hackers, but a security researcher warned Friday that there are ways the sleek device could potentially be compromised. TheÂ iPhoneÂ has no security software, but Apple doesn't let people load third-party programs on the device, reducing the risk of infection from malicious software. But when the iPhone is connected to the Web, possibilities emerge, said Marius van Oers, a security researcher with McAfee's AVERT Labs in Amsterdam. He doesn't claim to have uncovered a specific security hole in the device, but listed several ways thatÂ determined hackersÂ could use the Web to try to find a way in. Apple is relying on developers to create rich Web-based applications that will be accessed through the mobile version of the company's Safari Web browser. Browser flaws are a proven way for hackers to get unauthorized code running on a system, van Oers said. "It's fairly easy to send someone an SMS (Short Messaging Service) or an e-mail with a Web link," he said. "And once you go to the Web link, then that server can inject code into the iPhone, and if that happens, [a hacker] can have full control." That's what happened with aÂ Safari flawÂ found by Independent Security Evaluators, a company that detailed its findings at the Black Hat security conference in August. By constructing a malicious Web site, the researchers injected code into the iPhone and pilfered recent text messages, phone numbers and e-mail. Apple has since patched the flaw. "Once you get access to the system, it's all over," van Oers said. He presented his view ofÂ iPhone securityÂ Friday at the Virus Bulletin security conference in Vienna. Although he is based in Europe, he examined an iPhone purchased in the U.S. His view of the iPhone's security is more cautionary and speculative, but rooted in the well-known ways that hackers work. Apple also allows the use of JavaScript when the iPhone interacts with Web pages, a programming language that has been used to exploit software problems, van Oers said. Further, Apple's multimedia application QuickTime has been prone to trouble, and there are several proof-of-concept exploits circulating the Web now for version 7, van Oers said. How that proof-of-concept code could affect QuickTime on the iPhone remains to be seen. Nonetheless, with the iPhone already popular in the U.S. and due toÂ go on sale in EuropeÂ in about six weeks, Apple can expect more aggressive attempts by malicious hackers to meddle with it. Hacking mobile devices is less prevalent than hacking desktop computers. But interesting malicious programs have been written for mobiles, including some that repeatedly autodial or send text messages to a premium number. The number is owned by the hackers, who collect the revenue. The chance of those kinds of malicious software affecting the iPhone today is probably low, but "that's the future. Let's hope it will not come to that," van Oers said. Â
358044
Researchers find that Apple's wildly popular phone is vulnerable to hacking, a weakness that could put your iPhone in somebody else's hands.
701756
(InfoWorld) - Uncertainty about how to secure mobile phones in the face of increasing threats is slowing enterprise adoption of mobile applications, experts exhibiting at theÂ 3GSM World CongressÂ in Barcelona this week said. Over two-thirds of mobile operators in Europe that took part in a survey said that they detected more than 100 incidents involvingÂ mobile virusesÂ orÂ mobile spywareÂ in 2006, according to a study by conducted by Informa for security software developer McAfee. The number of European operators reporting more than 1,000 such incidents more than doubled in 2006 compared to the previous year, the report said. IT administrators, uncertain how to protect their users from such attacks, are unwilling to enable mobile access to applications for workers. "Enterprise security professionals haven't really worked this out yet," said Lorcan Burke, CEO of AdaptiveMobile. Companies such as banks, with strict security requirements, simply block access to any service, including Internet access, that could open doors to security issues, he said. At the recent RSA Conference in San Francisco, some of the most crowded events were those tackling mobile security issues, said Simeon Coney, vice president of marketing for AdaptiveMobile. That was an indication that IT administrators are trying to find out how serious mobile security problems are and how to address them, he said. Mobile services can be secured in the application, the network or in hardware or software on the device. Among operators responding to the McAfee study, most found that virus protection was most important at application and device levels, although more of them had deployed network-level security systems than the other options. Over 200 respondents from the operator community took part in the study. AdaptiveMobile makes network-level security products for operators, including a system for filtering viruses in e-mail, SMS (Short Message Service), MMS (Multimedia Messaging Service) and WAP (Wireless Application Protocol) traffic. Beyond viruses, AdaptiveMobile can also control content, so it can stop phishing and other fraudulent attacks, or limit the types of content end users can access. If an operator has deployed AdaptiveMobile's platform, an IT administrator in a company can set and manage such controls down to the level of individual users. For the mass market, AdaptiveMobile's product allows operators to notify a user by text message if their phone becomes infected with a virus and offer a download, either for free or for a fee, to disinfect the device. Without such software, operators will replace a user's device or ask them to send it off for disinfection, both costly propositions. A network-based security mechanism offers some advantages over anti-virus software that sits on the handset, Burke said. Handset software doesn't prevent phishing and other nonviral scams. In addition, anti-virus software isn't compatible with all phones, making it logistically difficult for the software developers to tweak their products for each version of every phone and make sure to sell the proper software to end users. He calls anti-virus software on the handset "the minimum acceptable response. It's a tick in the box to make people feel comfortable." Some developers also sell security mechanisms that sit in the phone's hardware. Such solutions are ideal for organizations with very strict security requirements, such as government users, Burke said. One downside to the hardware-based solutions is that they take about two years to make it into a handset, he noted.