Vulnerability hits Java for cell phones
298773
Researcher finds two flaws that under unusual circumstances could let a malicious program read private data or render a phone unusable.
508082
A possible Trojan horse hidden in an illegal cell-phone game hits smart phones using the Symbian operating system.
234843
Vulnerabilities in the Sun Java Runtime Environment are described by one security expert as being "as bad as it gets."
480568
As first prototype surfaces Mobile phone handsets based on Google's Android platform are due to appear some time in the second half of this year but hackers have already got a cut-down version of the software running on devices.â¦
632602
New FCC rules say open-source code for next-gen mobile tech has "high burden" to show it's secure. Some industry and security experts beg to differ.
444544
InfoWorld - A team of security experts in Baltimore said it has found a flaw in&#160;Apple&#39;s iPhone handset&#160;that can be used by attackers to access private data stored on it.
769056
New software addresses a vulnerability that allowed previous versions to crash and execute arbitrary code.
14529
Blog: Feature designed to dial Web page phone numbers is subject to cross-site scripting attack.
320036
(InfoWorld) - Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple's iPhone, a flaw that allows them to steal any data from the device or even to turn it into a remote surveillance tool. The trio -- Charles Miller, formerly with the National Security Agency; Jake Honoroff; and Joshua Mason of Baltimore-based Independent Security Evaluators (ISE) -- have notified Apple of the vulnerability and given the company less than two weeks to fix the bug before Miller presents more information at the Black Hat conference on Aug. 2. According to a paper posted by the three, they rooted out a vulnerability in the iPhone's version of Safari using "fuzzing" tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using "man in the middle" tactics to trick users into connecting to a malicious wireless access point. Once the exploit runs, it's essentially game over, the researchers said: The iPhone is owned. "In our proof of concept, this code reads the log of SMS messages, the address book, the call history, and the voicemail data," the researchers wrote on the ISE site. "It then transmits all this information to the attacker." But wait -- there's more! That, however, could be just the beginning. The researchers claimed that a second exploit actually operated the iPhone remotely once the device was hijacked. "When we viewed a second HTML page in our iPhone, it ran the second exploit payload which forced [the iPhone] to make a system sound and vibrate for a second," they said in the paper. "Alternately, by using other API functions we discovered, the exploit could have dialed phone numbers, sent text messages, or recorded audio (as a bugging device) and transmitted it over the network for later collection by a malicious party." The vulnerability was reported to Apple last Tuesday, July 17. "We proposed a fix Apple could include in a future iPhone update," the researchers said, "but we don't know if they plan to do so. They responded and are looking into it." In an e-mail late Sunday night, Apple spokeswoman Lynn Fox would only say: "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We're looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security." She declined to answer questions about the Aug. 2 deadline, whether Apple would issue a patch before then, or what the company thought of the way the trio disclosed the vulnerability. Miller will provide more information on the vulnerability and exploit at the upcoming Black Hat 2007 security conference, which opens next Saturday, July 28, in Las Vegas. But is this the ethical way? ISE's president, Avi Rubin, defended the decision to announce the existence of the vulnerability prior to a patch being made available by Apple. "Why are we doing that? Well, I believe that there is a social responsibility to report it when a device is vulnerable to attackers," said Rubin on his own blog Sunday. "People buy these things and use them in ways that put their identity and their online accounts at risk, and by exposing these vulnerabilities, we can make users better judges of how to use their high-tech devices." Rubin is familiar to many security observers from his research into problems with electronic voting systems. The paper by Miller, Honoroff, and Mason also spelled out a number of weaknesses in the iPhone's security architecture, although it didn't specifically pin the vulnerability on any of those flaws. One, however, most likely contributed to the reach of the exploit. "There are serious problems with the design and implementation of security on the iPhone," the paper said. "The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device." Other deficiencies the trio cited in the iPhone's operating system included not using address randomization -- a technique applied by Windows Vista that's designed to make it tougher for hackers to write reliable attack code -- and allowing code in the heap to execute. Those last two shortcomings have been criticized in the desktop version of Mac OS X for some time. Three months ago, during the fallout after a hacking contest that jacked a MacBook Pro notebook, HD Moore -- the vulnerability researcher noted for the Metasploit hacking and attack testing software -- took on the claim that Mac OS X is safer than Windows. "The Mac OS X platform is years behind Linux, Windows, and OpenBSD in terms of operating-system security," said Moore then. "All of the above platforms support some form of address randomization (ASLR) and include features that make exploitation slightly more difficult." The ISE researchers have also posted a short video of their hack in action on YouTube.
620735
So far, mobile security threats have been rare and have been more annoying than dangerous.  That's changing rapidly, a security expert says.
319020
Security firms are warning about a smartphone virus that can spread much faster than similar bugs.
143123
Software security companies and  handset makers, including Finland's Nokia NOK1V.HE, are  gearing up to launch products intended to secure cell phones  from variants of the Internet viruses that have become a  scourge for personal computer users.
9540
The Hardened-PHP Project has released a new vulnerability for the PHProjekt groupware software.    While searching for applications that are vulnerable to a new class of vulnerabilities inside PHP applications we took a quick look into the current PHProjekt source code and discovered that a (remote) include vulnerability had been (re)introduced.   By overwriting a variable with user input it is possible to inject and execute arbitrary PHP code. Overwriting this variable is possible regardless of the register_globals setting.    They give a few more details further down the posting and note that users should download and install the latest version (at the time of this post, 5.1.2).
15069
Security researchers discover a serious vulnerability in older version of ICQ IM software.
331980
InfoWorld - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet&#39;s addressing system, prompting the software&#39;s maintainers to retire the affected version.
409990
Beta testers find flaws in a new feature of the instant messaging app.
576338
(InfoWorld) - Apple's iPhone is a toughÂ target for hackers, but a security researcher warned Friday that there are ways the sleek device could potentially be compromised. TheÂ iPhoneÂ has no security software, but Apple doesn't let people load third-party programs on the device, reducing the risk of infection from malicious software. But when the iPhone is connected to the Web, possibilities emerge, said Marius van Oers, a security researcher with McAfee's AVERT Labs in Amsterdam. He doesn't claim to have uncovered a specific security hole in the device, but listed several ways thatÂ determined hackersÂ could use the Web to try to find a way in. Apple is relying on developers to create rich Web-based applications that will be accessed through the mobile version of the company's Safari Web browser. Browser flaws are a proven way for hackers to get unauthorized code running on a system, van Oers said. "It's fairly easy to send someone an SMS (Short Messaging Service) or an e-mail with a Web link," he said. "And once you go to the Web link, then that server can inject code into the iPhone, and if that happens, [a hacker] can have full control." That's what happened with aÂ Safari flawÂ found by Independent Security Evaluators, a company that detailed its findings at the Black Hat security conference in August. By constructing a malicious Web site, the researchers injected code into the iPhone and pilfered recent text messages, phone numbers and e-mail. Apple has since patched the flaw. "Once you get access to the system, it's all over," van Oers said. He presented his view ofÂ iPhone securityÂ Friday at the Virus Bulletin security conference in Vienna. Although he is based in Europe, he examined an iPhone purchased in the U.S. His view of the iPhone's security is more cautionary and speculative, but rooted in the well-known ways that hackers work. Apple also allows the use of JavaScript when the iPhone interacts with Web pages, a programming language that has been used to exploit software problems, van Oers said. Further, Apple's multimedia application QuickTime has been prone to trouble, and there are several proof-of-concept exploits circulating the Web now for version 7, van Oers said. How that proof-of-concept code could affect QuickTime on the iPhone remains to be seen. Nonetheless, with the iPhone already popular in the U.S. and due toÂ go on sale in EuropeÂ in about six weeks, Apple can expect more aggressive attempts by malicious hackers to meddle with it. Hacking mobile devices is less prevalent than hacking desktop computers. But interesting malicious programs have been written for mobiles, including some that repeatedly autodial or send text messages to a premium number. The number is owned by the hackers, who collect the revenue. The chance of those kinds of malicious software affecting the iPhone today is probably low, but "that's the future. Let's hope it will not come to that," van Oers said. Â