HTC Security Flaw Lets Malicious Apps Steal Wi-Fi Passwords

HTC recently acknowledged a security flaw in its handsets that allowed malicious apps to steal Wi-Fi passwords.  This type of flaw could potentially allow for targeted exploitation of a company or residential network.  Luckily, HTC and Google were very responsive and a fix has already been developed and deployed.  It was actually discovered in September 2011, but was kept a secret publicly until Google and HTC had time to address it and provide the appropriate fixes.

According to the U.S. Computer Emergency Readiness Team (US-CERT), the devices affected by the security flaw include the Desire HD, Glacier, Droid Incredible, Thunderbolt 4G, Sensation Z710e, Sensation 4G, Desire S, EVO 3D and EVO 4G.

This is a prime example of why Apple has such a strict acceptance policy of the apps that are allowed in the iTunes App Store.  They monitor the code and test the apps before releasing them to the public to avoid problems.  That said, there have been apps that mistakingly made their way into the store.

http://www.gadgetbox.msnbc.msn.com/technology/technolog/htc-security-flaw-lets-malicious-apps-steal-wi-fi-passwords-24096

http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html

Carrier IQ

About a month and a half ago it was revealed that there has been tracking software pre-installed on over 141 million cell phones. The software designed by Carrier IQ is responsible for recording and reporting metrics to your phone carrier. This discovery forces a dialogue about the trust relationship that is established between the customers and their carrier and exactly how the carrier treats the information that is being is being stored. There have been many allegations about what is exactly being tracked by the software, some true and some more along the lines of half-truths.

As it turns out Carrier IQ was intended to be a utility that allows for a carrier to be able to intelligently diagnose network and phone issues that a customer might be experiencing. For example, prior to the development of Carrier IQ, a carrier might only be detecting that 1 out of every 100 phone calls being placed on their network are being dropped; when in reality it might be much closer to 8 or 9 calls out of those 100 placed. This disparity between the actual numbers and the ones being recorded by the carrier allowed Carrier IQ to see a possible use case and ended up meeting the needs of the carrier.

They haven’t explicitly admitted everything they track, but have specifically said that they track call drops correlated with GPS information, SMS information, web history and application/CPU usage.

Carrier IQ has made an effort to create a line in the proverbial sand in what they do and do not want to collect from users. They say that they don’t collect any content, whether it be what was actually sent in an SMS text message or the contents of a webpage that you access. They do however track the metadata for your activity, this includes who you sent your SMS message to and if it was successfully sent. The same can be said about your web history, they are tracking the URLs being accessed not what is actually being displayed on your screen.

Carrier IQ thinks that what they are collecting is harmless to the consumer but a debate is now forming on what type of information should be okay to track and what really shouldn’t be. Carrier IQ has stated that they don’t capture the content of what the user is doing. Content is really an ambiguous term. Carrier IQ might not consider my URL history to be a private matter. I consider pretty much all of my usage history sans maybe CPU utilization to be a private matter (no matter how mundane my life really is). Its something that really shouldn’t existing in a database somewhere, ready to be hacked, subpoenaed or looked at by a rogue employee that has decided that they want to know more about me. What becomes even more disconcerting is that this information is being tracked even while I am out of the country, on a Wi-Fi network not even connected to their cellular network.

Who knows, maybe I’m just being a paranoid parrot. Maybe no one really cares anymore about their privacy, it has been said by numerous individuals that “Privacy is dead – get over it.” I for one don’t like it and I think I’ll take my ball and go home. In all seriousness though, this software really should be industry vetted to make sure that it cannot be exploited by malicious individuals and it should be established exactly what information each carrier is tracking and for how long. This would allow consumers to identify what tabs the carriers are keeping on their customers; which I’m sure most consumers won’t like and allow for free market forces to stifle the ones being over exuberant with this tracking technology.

http://www.theverge.com/2011/12/5/2609662/carrier-iq-interview

http://www.wired.com/threatlevel/2011/11/rootkit-brouhaha/

http://www.edition.cnn.com/2011/12/02/tech/mobile/carrier-iq-reactions/

Android Updates taking to long?

Through some searching online and reading multiple articles I found that many users are not on the latest Android version. This can obviously be seen as a security problem. As with many different software updates often include important security fixes. I doubt Android is any different. Although phones are shipped with a fairly recent version of the Android OS, the problem seems to be with how long it takes before the user even gets an update to the latest version. It can be a long process before the provider offers the update to its users. An article on computer world explained it better:

Google releases code that is in turn adapted by hardware manufacturers, and that in turn is adapted by various service providers. The software release latency from Google to device is long in the best of situations, and insurmountably long in many others.

With smart phone becoming some of the more popular devices to target for attacks, I feel this long process for updates could soon become a big issue. That is if it’s not already.

http://www.computerworld.com/s/article/9221844/Kenneth_Van_Wyk_The_security_implications_of_being_stuck_with_an_old_Android_OS

Facial recognition on Android 4.0 has some bugs

A new feature of the new Android 4.0, a.k.a. Ice Cream Sandwich, has a new feature that will allow you to unlock the phone using facial recognition. Though if you prefer security over convenience you should try not to use this new feature.

As seen in a video created by a mobile blog, the face unlock feature can be fooled by showing it an image of the face used to set up the locking mechanism.  You can do this by taking a picture with one phone and holding it up to another to try to fool the unlock feature.

A google representative has stated that it is considered a low security and experimental way of locking your phone and the interface warns users the face unlock is less secure than a pattern, pin, or password and that someone who looks similar to you could unlock your phone.

So this poses the question do I use this new feature because of the ease of use and the convenience even though it has been show that it has weakness and vulnerabilities. Good has said that they have started looking into the problem and that because Android 4.0 has not been released yet they are still working out the experimental system.

Is the App store really safe?

Most people who lifted their shiny iPhones and pressed upgrade to iOS5 button, were looking for a better battery life that can get them more rounds of Angry Birds. The reality is that Apple’s latest updated was dealing with something a lot more important.

A week ago Accuvant LABS computer security researcher Charlie Miller uncovered a major security flaw that gives hackers a way to build apps that look and act legit but then downloads unproved code to your phone. Apple have always been known for having a tight grip on their app store and such incident shows that no system is fully secure from hackers attacks.

Miller even demonstrated by creating his own app that does that and got it fully approved by Apple and then did a video of what the app can do. His app have been now removed and his license revoked.

Don’t assume you’re safe playing in the sandbox

Very basically, sandboxing for those of you that don’t know, tries to control the rights of an application through permissions , or entitlements as Apple calls them, so that they don’t automatically have full control over the whole computer or smartphone. Sandboxing however gives the user a false sense of security “by implying that apps which run in a sandbox are automatically not malicious – which simply is not true.” On top of that the majority of malware dies not get onto a device through applications but rather through “drive by downloads”; again basically- surfing the wrong place. Another downfall of the sandboxing method of “protection” is that most users slide right past the permissions part of installing an application and simply click ‘ok’ to everything. Furthermore in the Andriod market the applications are not curated or vetted (examined by someone to make sure it’s safe) so a developer could install nearly anything within an application. Don’t think you’re safe if you use an iPhone however…even with the scrutiny there are still major holes

You think I’m blowing smoke up your. ..app…then just watch this video.

http://www.youtube.com/watch?v=ynTtuwQYNmk&feature=player_embedded

I could go on with my views about smartphone apps and malware but you’d be better off reading this article for yourself. Honestly I think anyone that either has a smartphone or is interested in security should definitely read it.

http://www.guardian.co.uk/technology/blog/2011/nov/08/sandboxing-malware-failure

Android users-Pay now or pay later

A study by AV Test recently showed that paid for security apps work much better than free apps do. The study was done on the Android but AV Test claims it should be true for all smart phones. The study results showed that Kaspersky’s and F-Secure’s Mobile Security suites worked the best. They both were able to detect 50 percent of active malware samples used. The best free app was Zoner AntiVirus Free, which detected only 32 percent.  Although the paid apps worked better, still 50 percent is not all that good. According to AV Test, a company that tests apps for security issues, suggests that you should avoid using apps from developers without a reputation. Also avoid apps that have no reviews or poor reviews. Also be leery of developers that don’t have a website. There’s a free android app called Lockout which PC WORLD suggests all Andriod users should have. It checks all apps against a malware blacklist and lets you know if it is suspect.

Here is the article and a link to a PC World best practices page.

http://www.techworld.com.au/article/407139/android_paid_mobile_security_better_study/

http://www.pcworld.com/article/221213/keep_malware_off_your_android_phone_5_quick_tips.html

Android facial recognition unlock

Android 4.0, also named Ice Cream sandwich came out with a new phone unlock feature. Rather than unlocking the phone via a pin or password, the front facing camera uses facial recognition software to unlock the phone when it ‘sees’ the correct face.

However it’s been pointed out that holding up another phone to the camera with a picture of the correct person, the phone can be unlocked.

Seems like a cool feature although it seems like it can be easily bypassed. I think a pin or password is still the better route to go. It would be a nice feature better implemented when the software is smart enough to detect when a picture is being held up.

The full article can be found here: http://news.cnet.com/8301-1009_3-57323508-83/digital-image-can-dupe-android-face-based-lock/?tag=txt;title

 

iPhone 4S Flaw?

Recently Macworld reported a flaw in the new iPhone 4S. A new feature called Siri is a voice-activated feature that allows users to make all sorts of voice commands. But, with the default setting on, Siri is accessible even while the phone is locked. This will allow anyone to send e-mails and text messages, and make calls without entering a passcode. Without entering a passcode, users have limited access. For example, calls and texts can’t be made to people that are not in the contact list. Although there is limited access, unwanted users could still perform unwanted actions.

Turning off the default setting would be the simple solution to this problem, but I don’t see why Apple would allow such access while the phone is locked. It somewhat defeats the purpose of locking the device despite the fact that there is limited access. It may be a convenience to not have to unlock the device to access certain things but is it worth it? It’s pretty much up to the user to have convenience over security.

http://news.cnet.com/8301-1009_3-20122632-83/bad-siri-shell-let-anyone-use-a-locked-iphone-4s/?tag=txt

Bypassing an iPad 2′s Passcode Lock

Only a few weeks ago, someone posted on this blog about the top devices that pose serious security risks to companies.  On that list was Apple’s iPad, and at first I cried bloody murder.  Apple’s application store provides a unique level of security in the device’s market that the android market has yet to provide.

I thought it was ridiculous that some security blog would consider the iPad to be a major security risk (unrooted) just because of the number of corporations that used such devices. Of course, I was wrong.

Above is a video of how to bypass the passcode lock of an iPad 2 using a very simplistic ‘hack’. You only need to bring up the screen asking for the passcode, hold the lock button down until the power off screen is brought up, close the screen, and hit cancel.

Granted, this method only allows you access to the application that was previously open when the device was ‘locked’.  So this could either do no damage to the user if the user had the home screen open, or it could do horrendous damage to the user and company if the email client was open.

Apple will certainly get around to patching this security risk, but how many users won’t update to it?  How many devices could be bricked because of the update?  How many other security flaws aren’t we seeing?