Robert Lemos

Securing All Androids Proves Tricky

With Android, each mobile phone company has its own build of the Android operating system so that it can include its own user interface, graphics, and branding. Although Google released an updated version of Android that fixed the vulnerability soon after it was discovered, at least 42 percent of phones run an older version that is still vulnerable, according to data available on the Android developer site.

Technology Review

Open-Source Vulnerabilities Paint A Target On Android

In 2009, Red Hat, SuSE, and other Linux distributors fixed a major flaw that could have allowed any user to escalate his privileges and fully compromise a Linux system. The vulnerability, in theudev process, occurred because the device-resource-handling component did not verify that a certain type of message, known as a netlink message, came from the kernel.

A variant of the udev flaw, or CVE-2009-1185, is one component of the DroidDream attack identified earlier this month. That exploit, called exploid.c, uses a netlink message to create a user-controlled copy of the init process, which handles boot up, thus gaining root access. The init process reuses much of the code from the previously vulnerable udev process, according to Zach Lanier, a security consultant with mobile-security provider Intrepidus Group.

DarkReading

DroidDream turns Androids into zombies

The malicious code that led Google to remove more than 50 Trojan applications from the Android Marketplace appears to mainly be a "dropper" -- a program designed to load other code to further compromise the affected smartphone, according to a security firm's analysis.

The code, dubbed "DroidDream," attempts to use two exploits to gain root privilege on a compromised smartphone by breaking out of the sandbox designed to limit what applications can do on Android devices, mobile security firm Lookout stated in its most recent analysis.

CSO Online

InfoWorld Tech Watch Blog - Week of September 6

Published this week: Group sues Department of Homeland Security to stop laptop searches • Microsoft botnet 'decapitation' scores legal win against cyber crime

Fraud At Sprint Offers Lessons For Enterprises, Experts Say

The recently revealed abuse of insiders' system privileges to commit fraud at Sprint could be a wake-up call for other enterprises to implement more stringent security practices, experts said this week.

Last week, nine Sprint employees were charged with misusing their access to the telecommunications giant's systems to redirect phone charges to other customers by "cloning" their cell phones -- to the tune of more than $15 million in fraudulent charges in the first six months of this year.

DarkReading

Could USB Flash Drives Be Your Enterprise's Weakest Link?

On any particular day, a horde of devices with flash memory are carried behind corporate firewalls and connected to business networks. It's a threat that many companies are not equipped to handle.

Last week, the U.S. military highlighted this fact when it confirmed that an attack on its systems in 2008 originated with a flash drive plugged into a military computer located in the Middle East. The infection "spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control," U.S. Deputy Secretary of Defense William J. Lynn III wrote in an Aug. 25 essay.

DarkReading

Mobile Devices Threaten Enterprises From Within

Today, nearly every office worker carries a mobile phone into work. Much of the time, the devices are more advanced smartphones, such as Android-based phones, Blackberry devices, or Apple's iPhone. The employees almost never consider the security implications of bringing connected devices behind a company's firewall.

Yet the trend has not escaped the notice of chief security officers and information-technology administrators. Smartphones are becoming prolific within enterprises, but the security teams don't really have a handle on how to secure the devices, says John Hering, CEO of Lookout, a mobile security firm.

"They have spent a vast amount of resources in terms of dollars and time to defend their corporate networks and the traditional network security perimeter, but the mobile device … has trusted access to the very critical data at the soft and chewy center of the company," Hering says. "It's almost a Trojan horse into the enterprise itself.

DarkReading

InfoWorld Tech Watch Blog - Week of August 16, 2010

Published this week: Got Adobe ColdFusion? Start patching • Network Solutions versus the wily widget • Intel + McAfee = Desperate mobile move

Ferreting Out Rogue Access Points And Wireless Vulnerabilities

For almost 18 months starting in 2005, attackers used wireless networks at TJX and other retail chains to steal credit card data. The vulnerabilities were not an isolated instance: Subsequent research found that about half of all retail outlets in one shopping center had insecure wireless networks.

Today, WiFi security has improved somewhat, but insecurities in installations still remain far too common. Vulnerability assessments of more than two dozen companies found a quarter have rogue wireless access points that were installed by employees, and a third of their wireless networks had misconfigurations that undermined their security, according to wireless security firm AirTight Networks, which conducted the tests.

DarkReading

Mobile Flaw Could Cloak Clicks

It's possible to craft a malicious website so that a user's clicks are secretly redirected to a legitimate site in a way that steals a user's passwords and other data. Many Web developers have added protections to block the tactic on standard Web sites, but Stanford University researchers warn that there are not nearly enough defenses against the technique on mobile websites, which are accessed from devices such as the iPhone.

As a result, a smart-phone user could think he's tapping to check a baseball score but is actually tapping on a button in a hidden page to confirm a money transfer.

Technology Review