Mobile security


Researchers Reveal Fundamental SMS Flaws at Black Hat

There are several architectural and implementation problems in mobile phone networks that can be used to force users to open malicious files, allow attackers to gain control of users’ phones and change phone settings to redirect mobile Internet traffic to a proxy controlled by the attackers.
In a presentation at the Black Hat conference in Las Vegas on Thursday, Luis Miras, and independent security researcher, and Zane Lackey of iSec Partners, demonstrated a number of techniques for taking advantage of the implementation and design problems. The pair also announced the release of a tool they called TAFT (There’s an Attack for That), which runs on jailbroken iPhones and can be used to execute several different attacks.

The Future of Mobile Malware – Digitally Signed by Symbian?

From ZDNet (Dancho Danchev)
Earlier this month, a mobile malware known as Sexy View or Sexy Space slipped through Symbian’s mobile code signing procedure, allowing it to act as a legitimate application with access to device critical functions such as access to the mobile network, and numerous other functions of the handset.
Upon notification, the Symbian Foundation quickly revoked the certificate used by the bogus Chinese company XinZhongLi TianJin Co. Ltd, however, due to the fact the revocation check is turned off by default, the effect of the revocation remains questionable. What are the chances that future malware authors could bypass the code signing procedure again?   Read the full story [zdnet.com]

An Analysis of the BlackBerry Spyware

From Zero in a Bit (Chris Eng)
Yesterday it was reported by various media outlets that a recent BlackBerry software update from Etisalat (a UAE-based carrier) contained spyware that would intercept emails and text messages and send copies to a central Etisalat server. We decided to take a look to find out more. Read the full story [Zero in a Bit].


From Zero Day (Dancho Danchev)
Researchers from NetQin Tech. are reporting on a newly discovered mobile malware variant (Transmitter.C) distributed through a modified version of legitimate mobile application. Upon execution, the malware attempts to automatically spread by SMS-ing hundreds of messages linking to a web site where a copy of it (sexySpace.sisx) can be found. Read the full story [ZDNet.com].

From The H Security
Symbian, found in many mobile phones, especially those from Nokia, is one of the most widely used mobile operating systems and has now been in use for more than ten years. It continues to be viewed as a very secure operating system, with special security functions and a certification system which help to ensure that only signed code can run with high privileges. Anti-virus vendors occasionally report new malware capable of running on the Symbian platform, but so far none have managed to spread widely. Read the full story [The H Security].

From SC Magazine (Angela Moscaritolo)
A financial services technology group is developing standards for making secure mobile payment transactions.  The goal of the project,  an effort of the Financial Services Technology Consortium (FSTC),  is to develop standards and processes so that banking customers are able to securely pay a merchant or another bank customer using their phone, no matter what mobile device or carrier they use.  Read the full story [scmagazine.com]

From DarkReading (Kelly Jackson Higgins)

Texting just keeps getting riskier: Researchers at next month’s Black Hat USA in Las Vegas will demonstrate newly discovered threats to mobile phone users, as well as release a new iPhone application that tests phones for security flaws.

“We set out to create a graphical SMS auditing app that runs on the iPhone,” says Luis Miras, an independent security researcher. The tool can test any mobile phone, not just the iPhone, for vulnerabilities to specific exploits that use SMS as an attack vector.  Read the full story [darkreading.com]

T-Mobile is now saying that the information that was posted to the Full Disclosure security mailing list this weekend is in fact the company’s data. But the company stopped short of confirming that the anonymous hackers have access to customer data and other sensitive information, as they have claimed.

From Reuters (Tarmo Virki)
Accessing your bank account using your mobile phone might seem safe, but security experts say would-be hackers can access confidential information via a simple text message seemingly from your service provider.
People in the industry aware of the risk see it as extremely small, as only a few people use handsets to access their bank accounts, but it is growing as mobile Internet usage rises.  Read the full story [reuters.com]

There is a series of vulnerabilities in the widely used BlackBerry Enterprise Server software that could allow an attacker to compromise BlackBerry devices by sending a malicious PDF file. Research in Motion, the software’s maker, has issued a patch that fixes the problem in BES, as well as in BlackBerry Professional Software.

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.