Slashdot Mirror
Palm WebOS Hacked Via SMS Messages
gondaba writes "Security researchers at the Intrepidus Group have hacked into Palm's new WebOS platform, using nothing more than text messages to exploit a slew of dangerous web app vulnerabilities. The white hat hackers found that the WebOS SMS client did not properly perform input/output validation on any SMS messages sent to the handset, leading to a rudimentary HTML injection bug. Coupled with the fact that HTML injection leads directly to injecting code into a WebOS application, the attacks made possible were quite dangerous (especially considering they could all be delivered over an SMS message)."
These are always my favorite posts to read. Nothing like hiring 12 year olds to code your software.
this bug and vulnerabilities are bad, even severe, but dangerous? I can think of no scenario where lives or property would be at stake. I guess the personal data could be used for something untoward....
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
After watching that, I somehow feel compelled to review all the security risks and exploits on the iPhone, and use my sausage *cough* on the touch screen...
I cannot belive that: a) An exploit like this exists. SANITIZE ALL INPUTS! b) It took this long to find. This reminds me a lot of the exploit on android where it acted like all text entered was typed into a terminal.
"...rudimentary HTML injection bug...."
There are so many wrongs going on at once there. I'll just pick one, load a round in the chamber and mutter 'rudimentary' is redundant. Ok, two...'injection bug'? WTF? --- now get off my lawn!
My Pre is running the latest 1.4.1.1 WebOS version. I tried their "exploits" on it, it did nothing, had no affect on it. In the video they're running an outdated version of WebOS, 1.3.5. WebOS will download updates OTA automatically, and install them if you don't do it after a certain number of days. To me, the likeliness of these still being issues is close to null and void.
Sometimes when I'm working on projects things disappear, I suspect gremlins.
This has been fixed with the 1.4 update, not sure why it's news.
Those aren't randon text messages; they're student records.
http://xkcd.com/327/
This isn't at all surprising. Even infratructure equipment is hackable using SMS messages.
Automatic uploading of videos to Youtube, integration of MyFace contacts.
Since this was fixed in the 1.4, this can only be some no name "security" company trying to make a name for itself. A really poor one at that, they can take already known issues and exploit them... And hey with results like these, they should have no problems exploiting any unpatched Windows 95 machine still running out there.
Palm? I'm surprised they still even exist. The last contact I had with them was a b&w PDA ten years ago.
Other 'news' - Apparently, Apple is going to make a phone! Maybe it's will be as big as the Ipod!
No, I don't trust in god. He'll have to pay up front, like everybody else.
Or, alternatively, it was the security company that found the exploit and warned Palm about it so they could fix it for 1.4, and is now releasing the vulnerability for discussion.
But hey, that would have required reading the article.
At least noone will actually be affected because noone owns a palm phone anymore
Basically, here's the deal: Palm fixes all these bugs, but Intrepidus wants to drum up more business, so they release a mocking video of all the bugs that Palm ALREADY FIXED in an OS that updates itself really well (and most users want the updates badly because Palm releases features with each of them). Would you want to pay a company to pull that kind of crap with your product? I wouldn't think so.
Oh, yeah...and the OS itself has only been out for less than a year. Of course you're going to find exploits...what do you expect, absolute perfect security right out of the gate?
Not only that, Intrepidus takes the biggest cop out for a security company there is: "Well, uhhh, because it's browser based or something...uhhh...there's like, security holes and whatever." It's NOT browser based. webOS is LINUX BASED. It has a UI that incorporates a modified WebKit engine. Not only that, just saying there's a browser integrated into the front end isn't an instant security hole. Browsers are software. Software can have bugs, and bugs can be fixed. Would you say that unrelated software product A is instantly vulnerable to the same holes as unrelated software product B? When I hear a security engineer take that track with me, he/she loses all credibility. Security outfits are specialized QA houses and nothing more. Their job is to take money, use a systematical process to find bugs, then report them. They are paid for their confidentiality and their work. When they cop out on both fronts, they prove themselves to be nothing more than a scam shop of 14 year old jackoffs with a 23 year old douchebag boss trying to make a name for themselves.
You have to explicitly enable the "I know what I'm doing, stop protecting me" flag in your app to allow these types of exploits.
http://developer.palm.com/index.php?option=com_content&view=article&id=1756
and it failed.
Security Team: 0
Palm: 1
From the source release:
(Note: the findings herein affect WebOS 1.3.5. Palm has since released WebOS 1.4, which fixes these vulnerabilities, though not all handsets or carriers are running this version. Due to contractual agreements, the public disclosure of this information was delayed.)
These bugs can all be traced back to that fact that WebOS is essentially a web browser and the applications are written in JavaScript and HTML.
The article is accurate in so far as JavaScript is concerned. Palm has a long way to go if they ever hope to implement javascript securely on the scale they're using it. Checks have to be built into the SDK and the client engine, and they have to be updated regularly (quite frequently if Firefox' Noscript is any benchmark).
I've authored enough JS (not to be confused with CSS) to doubt that Palm will be able to do it. Nobody else has implemented JS securely, so WebOS device owners should expect to be hacked and use their cell phones accordingly.
Yay, Slashdot. Some days I wonder if my time wouldn't be better spent in the comments section of Digg.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
This is why "software engineering" fails to be taken seriously. How in this day and age an OS can be released without simple checks and balances like input validation is beyond me. The only excuse is "the developer couldnt be bothered, and no-one checked up on him".
Most programmers these days are the equivalent or tradespeople and artisans - sure many of them are very talented, but as a group still lack the formal QA and inherent attention to risk management that any real engineering should have.
How are things like this even possible? Did someone someday decide it would be a good idea to interpret data as code?
404: sig not found.
FacePALM!
--- Illogical Spock
See the 26th Chaos Communications Congress: Fuzzing the Phone in your Phone. http://events.ccc.de/congress/2009/Fahrplan/events/3507.en.html