Security Revealed
Massive amounts of fake New Year greetings card are being sent by Tibs.jy (aka Luder).
According both our public and private virus statistic systems, the numbers are big enough. So we’ve just raised Luder.A to Radar alert Level 2.
In any case, this is hopefully the last post of 2006. Have a Goodyear.
On 31/12/06 At 10:41 AM
On late Friday 29th of December Collin Mulliner published proof-of-concept exploits of MMS vulnerabilities that he had discoverd six months ago. When Collin first discovered the vulnerabilities he informed the software vendors, but as he has not received report in half a year he decided now to publish the exploit in the 23rd Chaos Communication Congress in Berlin.
The proof-of-concept exploits target vulnerbilities in SMIL presentation control language in MMS messages. Region tags in MMS SMIL are vulnerable to buffer overflow causing arbitrary code execution. In other words if those tags get too large content it makes to possible for malicous MMS message to execute code on target device.
It is still unknown which phones are vulnerable to this exploit. Collin’s research has confirmed vulnerability in IPAQ 6315 and i-mate PDA2k, but it is quite likely that all Pocket PC 2003 and Windows Smartphone 2003 devices are also vulnerable.
The good news is that the only devices to which proof-of-concept code is available are the IPAQ 6315 and i-mate PDA2k. And even in those devices attacker needs to guess correct memory slot where the MMS processing code is executing and send correctly crafted exploit code. This means that a malicious MMS message will most likely be only able to crash the device, not to to exploit it.
So while Collins discovery is very significant, it does not pose immediate danger to large groups of users. And although it is possible to create MMS worm or other malware that uses the vulnerability, this particular exploit cannot directly be used in creating malware.
But to be safe, we have included detection of the exploits on Saturday 30th in F-Secure Mobile Anti-Virus for the platforms that can be affected by this vulnerability.
As the device vendors have not given confirmation that the exploit has been fixed, we cannot confirm that patches are available. But as always it is very good idea to have latest updates installed in your devices.
On 31/12/06 At 08:41 AM
| M | T | W | T | F | S | S |
|---|---|---|---|---|---|---|
| « Nov | Jan » | |||||
| 1 | 2 | 3 | ||||
| 4 | 5 | 6 | 7 | 8 | 9 | 10 |
| 11 | 12 | 13 | 14 | 15 | 16 | 17 |
| 18 | 19 | 20 | 21 | 22 | 23 | 24 |
| 25 | 26 | 27 | 28 | 29 | 30 | 31 |