Slashdot Mirror

← Back to Stories (view on slashdot.org)

Palm WebOS Hacked Via SMS Messages

Posted by Soulskill on from the and-a-sausage dept.

gondaba writes "Security researchers at the Intrepidus Group have hacked into Palm's new WebOS platform, using nothing more than text messages to exploit a slew of dangerous web app vulnerabilities. The white hat hackers found that the WebOS SMS client did not properly perform input/output validation on any SMS messages sent to the handset, leading to a rudimentary HTML injection bug. Coupled with the fact that HTML injection leads directly to injecting code into a WebOS application, the attacks made possible were quite dangerous (especially considering they could all be delivered over an SMS message)."

4 of 99 comments (clear)

  1. Anonymous Coward by Anonymous Coward · · Score: 2, Informative

    This has been fixed with the 1.4 update, not sure why it's news.

  2. Re:WebOS 1.4 by X0563511 · · Score: 4, Informative

    1.4 explicitly fixed these issues.

    --
    For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
  3. Re:Intrepidus are straight up losers. by zullnero · · Score: 2, Informative

    Oh, darn it. Slashdot's login script didn't execute in time for me to post this as myself.

  4. Nohing to see here, please move along by loftwyr · · Score: 2, Informative

    From the source release:

    (Note: the findings herein affect WebOS 1.3.5. Palm has since released WebOS 1.4, which fixes these vulnerabilities, though not all handsets or carriers are running this version. Due to contractual agreements, the public disclosure of this information was delayed.)