Slashdot Mirror
Windows Mobile Security Software Fails the Test
boebert_ms writes "Windows Mobile security software is insecure and buggy, according to a report from Airscanner. In a paper posted at msmobiles.com, roughly 20 different Windows Mobile programs (e.g. MS Money, Password Master 3.5, etc) were examined and found to have a wide range of issues from broken protection schemes to poor encryption algorithms, and more. The paper goes into some details about each program and their flaws and also provides some tips on how to protect your data."
The paper goes into some details about each program and their flaws and also provides some tips on how to protect your data.
Tip #1: Use a Palm OS device.
The theory of relativity doesn't work right in Arkansas.
More details on this shocking discovery at Eleven. ....
perpetually dwelling in the -1 pits
Sounds like they are application design problems, not platform problems. How is Palm OS any better? I'm seriously interested, does Palm OS immune to these issues?
How is Palm more secure? Are we talking about the platform or the apps which run on it?
It would be interesting to along with each application and its security flaw(s) see how many users they have. Some of these seem to be rather poor shareware that is probably as bad on a desktop as on a PDA.
Still, an informative article, I've never really considered security at all on a PDA. Since they are nowadays wifi connected and used as password managers and for company email, obviously the concern should be greater.
Those who actually RTFA will find that most of the complaints have nothing to do with Microsoft or Windows Mobile itself. (The exceptions are MS Money and complaints about the lack of a Task Manager / msconfig / regedit etc.) The issue is that vendors are writing 'security' software (password managers, antivirus) using terrible methods. In analyzing these programs, they found passwords stored as plaintext, some ROT-N encrypted, and other very poor methods of 'securely' storing data. OS security matters, but in this case it wouldn't matter if you were running OpenBSD, assuming you had chosen to (and could) run these programs.
Right - it just hangs and doesn't do anything. and after poking at it for a while, soft-reset time.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
no, it just freezes up for no reason and requires a reset, without any indication of what's wrong. The reset requires removing the battery cover, which usually requires removing the case.
so this is good how?
The Linux that runs on phones is the same code that runs on desktops, servers etc. This means that by looking at Linux for servers etc, those paranoid security people have also verified Linux for mobile.
Of course you can still do dumb thing with mobile Linux (eg. running as root) and mobile-specific software can still give some vulnerabilities, but at least you have a half-decent start.
Engineering is the art of compromise.
This article is more or less obvious. A lot of programs for mobile devices aren't designed with security in mind. For some - like the handful of FTP clients listed - the password is insecure anyway, so it doesn't make sense to encrypt it. For many others, like the SSH client on my phone, even if you did encrypt the data, anyone who stole my phone would be able to log in to my account - after all, that's the point of saving the password.
My device is relatively expensive and is a smartphone, so if anyone stole it I'd be far more worried about them receiving the monetary value of my device and unfettered access to my phone account than about my passwords (which I could change from a PC anyway). I have my university account password saved, but I use SSH and encrypted IMAP to access these services so there isn't any significant risk so long as I possess the device.
People who use services like Remote Keyboard that don't ask for a login on the PC should expect that this service is unencrypted and unauthenticated. Similarly, people who use ActiveSync over the network should anticipate that if they haven't just plugged in their device, any password prompt must be spoofed.
I can write a similar article about a "vulnerability" in Facebook: I received 5 e-mails yesterday asking me to confirm account creation. I've had an account for over a year now, so I knew these requests weren't legitimate. Had I clicked on the verification links, I would've surrendered to this attacker my Facebook identity (they'd've had a blank profile under my e-mail address), but I'm smart enough not to. Or perhaps someone can submit an "insecurity" in Firefox, that even with a master password, JavaScript from a plug-in can read my passwords through the DOM once I've accessed a site.
Yup. My Pocket PC hangs at least twice a year.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Actually, I believe that the lack of a BSOD is a missing feature. It is internationally known that when your machine blue screens, you have no choice but to reboot. With my Windows Mobile device, it just stops... but every now and then gives me a glimer of hope that it is still alive. As a result, the lack of a BSOD feature in my cell phone wastes hours of precious time per month.
"Insecurity is better than NO security!"
Actually, what is pretty cool is that you can be modded +4, Insightful when you clearly haven't read the article (or even the summary, actually).
Hint: the article is not about security vulnerabilities in Windows Mobile, it's about security problems in the apps people run on it, with the apps using poor/no encryption, or leaking data/passwords into the registry, etc. Most of these apps are not written by MS (although the example of MS Money, and it's 'pmoney' algorithm is amusing, if a little familiar).
Twice a year? You're lucky.
In my case it is literally more than twice a day.
But then, I am developing for the platform, which is IMHO the most awful development environment known to mankind. The "ActiveSync" product has received lots of flack at the MEDC2006 conference for being buggy. And, I can't for the life of me figure out why VS2005 won't give me a full stack trace when I pause the program while debugging (and yes, I have compiled with debug information on).
It's amazing the garbage that people put up with to develop MS products.
f u cn rd ths, u r prbbly a lsy spllr.
Here I was using unsecured wifi at Hong Kong international, you know the one by the shady young-looking guys milling around with stolen laptops? Anyhoo, I was working on an unprotected pocket excel document which I stored in my Shared files folder containing all the Soc. Security numbers of my company's employees while trying to connect to the bluetooth device of this stewardess I had taken a liking to when I happened upon this article. For shame, Microsoft, for shame.
the mods may say you posted flamebait, but to me it's a flame that warms my heart. rock on, brother! --chebucto
While mostly true, I'd say the low end of pc users is a lot further down than the low end of expensive pda/cellphone users, so the "average" windows mobile user likely is a lot more intelligent than the "average" desktop user. Whether they have the time or desire to keep up on security is another issue entirely, of course.
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
For people who can't code they're quite successfull doing it.
I have seen a few people use their stuff (and being quite happy with it).
They mus do something right, and more than marketing, looking at all he repeat orders (and happy users actualy).
What I never really understood is why 802.1X connections on Windows Mobile 5 claim to require a client certficate. PEAP works fine without, and on XP the supplicant doesn't complain at all. WTF? If anyone knows how to convince the thing to do PEAP without client certs, I'd be happy!
Continuous positive slashdot karma since... uh, maybe next year.
I don't think my current one (Orange SPV600, that I've had for around 3 months) has crashed/frozen once yet. The SPV500 that I had for 18 months before that managed about 3-6 months between crashes and that's far better than most of my previous phones ever did (a Nokia, a Motorola and a Samsung one that not only froze about once per month, it was also so badly designed that it shorted on a metal chain that I had in my pocket melting a hole in my trousers).