HTC phone can be used as bugging device

By on
HTC phone can be used as bugging device

Palm Pre and Android flaws also discovered.

A flaw in the HTC smartphone can allow an attacker to use it as a remote bugging device.

After it warned of flaws in the Palm Pre and Google Android platform, MWR InfoSecurity has now discovered that a HTC phone can also be compromised and used as a remote bugging device.

Revealing its findings at this week's Black Hat Security Conference in Dubai, principal information security researcher at MWR InfoSecurity ‘Nils' said that mobile phone users globally are open to exactly the same risks as a user of a poorly secured desktop computer and the more it was testing devices, the more security flaws it was finding.

The first flaw in the Palm Pre phone allows the complete compromise of the operating system via the receipt of a crafted message, resulting in the ability to upload a back door and then force the phone to transmit and/or record audio and stored data.

The impact of this vulnerability is magnified, as the exploit can be executed from anywhere in the world and the data can be harvested via the normal networks.

Nils said: “It is not just the manufacturers that are to blame, it is also the mobile network providers who are not doing enough to protect their customers. Mobile phone manufacturers have a responsibility to the end-user to be ensuring security. They are clearly not doing it and thus are allowing the release of insecure builds and applications onto the market, putting users at ever increasing risk of cyber attack.

“Mobile phone and network providers have got to ensure security is a central component of the design and software provided. The situation is serious enough for MWR to recommend that users should review what personal information, bank details, passwords and identity information is stored on their phone.”

He also claimed that a major issue is the inability of phone manufacturers and network providers to ‘push' security fixes to the end-users when available.

“A user would never know that every word they were saying was being recorded and transmitted back to the attacker and the attack (once executed) would be trivial to perform,” said Nils.

“The more investigations we undertake the more problems we are uncovering and this is almost certainly the tip of the iceberg. It asks some fundamental questions about whether security has really been considered in the rush to release new phones and operating systems.”

As a result of its initial findings, the company expanded its mobile research programme and is identifying the breadth of the problem in multiple phone platforms. It is sharing its information with manufacturers and network providers but says that some are not paying attention.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

New Windows 10 users, are you upgrading from...
Windows 8
Windows 7
Windows XP
Another operating system
Windows Vista
How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?