HTC phone can be used as bugging device

Powered by SC Magazine
 

Palm Pre and Android flaws also discovered.

A flaw in the HTC smartphone can allow an attacker to use it as a remote bugging device.

After it warned of flaws in the Palm Pre and Google Android platform, MWR InfoSecurity has now discovered that a HTC phone can also be compromised and used as a remote bugging device.

Revealing its findings at this week's Black Hat Security Conference in Dubai, principal information security researcher at MWR InfoSecurity ‘Nils' said that mobile phone users globally are open to exactly the same risks as a user of a poorly secured desktop computer and the more it was testing devices, the more security flaws it was finding.

The first flaw in the Palm Pre phone allows the complete compromise of the operating system via the receipt of a crafted message, resulting in the ability to upload a back door and then force the phone to transmit and/or record audio and stored data.

The impact of this vulnerability is magnified, as the exploit can be executed from anywhere in the world and the data can be harvested via the normal networks.

Nils said: “It is not just the manufacturers that are to blame, it is also the mobile network providers who are not doing enough to protect their customers. Mobile phone manufacturers have a responsibility to the end-user to be ensuring security. They are clearly not doing it and thus are allowing the release of insecure builds and applications onto the market, putting users at ever increasing risk of cyber attack.

“Mobile phone and network providers have got to ensure security is a central component of the design and software provided. The situation is serious enough for MWR to recommend that users should review what personal information, bank details, passwords and identity information is stored on their phone.”

He also claimed that a major issue is the inability of phone manufacturers and network providers to ‘push' security fixes to the end-users when available.

“A user would never know that every word they were saying was being recorded and transmitted back to the attacker and the attack (once executed) would be trivial to perform,” said Nils.

“The more investigations we undertake the more problems we are uncovering and this is almost certainly the tip of the iceberg. It asks some fundamental questions about whether security has really been considered in the rush to release new phones and operating systems.”

As a result of its initial findings, the company expanded its mobile research programme and is identifying the breadth of the problem in multiple phone platforms. It is sharing its information with manufacturers and network providers but says that some are not paying attention.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition


HTC phone can be used as bugging device
 
 
 
Top Stories
How hard do you hack back?
[Blog post] Taking the offensive could have unintended consequences.
 
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
 
The big winners from Defence’s back-office IT refresh
Updated: The full list of subcontractors.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  68%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1015

Vote