| New User, Welcome! Login |
Next Page >>
mobile phones
--- BEGIN ADVISORY ---
Manufacturer: Nokia (www.nokia.com)
Device: Nokia 6131 NFC
Firmware: V 05.12, 19-09-07, RM-216
Device Type: mobile phone
OS: Symbian Series40
Subsystem: Near Field Communication
-----------------------------
--- BEGIN ADVISORY ---
Manufacturer: Nokia (www.nokia.com)
Device: Nokia 6212 Classic
Firmware: V 05.16, 29-09-08, RM-396
Device Type: mobile phone
OS: Nokia Series40
Subsystem: Near Field Communication
-----------------------------
Where: Remote (man-in-the-middle)
3) Vendor's Description of Service
"LiqPAY is global open high-secure payment system that lets anyone
easily send money using mobile phones, Internet and payment cards
worldwide.
...
LiqPAY Benefits: Strong security. Strong identification and
verification using the OTP technology."
The selected papers for EUSecWest 2008 are:
* PhlashDance, discovering permanent denial of service attacks against
embedded systems - Rich Smith, HP Labs
* Attacking Near Field Communications (NFC) Mobile Phones - Collin Muliner,
trifinite
* Abusing X.509 certificate features - Alexander Klink, Cynops GmbH
* Phoenix, and automated vulnerability finding - Tim Burrell, Microsoft
CSRF can be used to cause denial-of-service attacks against mobile phones by
flooding the phone with SMS and service messages.
Mobile phone service providers in Israel, and throughout the world, provide
a web interface to send SMS messages. Fortunately, they limit the SMS
sending web interface to 20 messages per day, and they also require the user
to authenticate in order to send an SMS.
Unfortunately, at-least when referring to the Israeli providers, they also
give attackers a way to send endless SMS and service messages without any
kind of authentication and with a simple HTTP request.
#2009-014 Android denial-of-service issues
Description:
Android, an open source mobile phone platform, is affected by two bugs
that lead to denial-of-service (DoS) conditions.
Two separate DoS issues have been independently reported to oCERT.
The most recent report concerns Android handling of SMS messages: a
Program:
Attacking Telco Core Network - Philippe Langlois (TSTF)
Real World Kernel Pool Exploitation - Kostya Kortchinsky (Immunity)
Cyber Crime: Follow the Money - Pedro Bueno (McAfee)
The Powerful Evil on Mobile Phone - Nanik (COSEINC)
Securing Your Web Application Codes - Kurt Grutzmacher (Pacific Gas)
Hacking RFiD Devices: Octopus Card?? - Adam Laurie (RFIDI0T.org)
Attacking Anti-Virus - Sowhat (Nevis Lab)
Anti-Forensic: Leaving the Police No Trails (the Grugq)
Media Security in VOiP Systems - Shao Weidong (Secure Minded Consulting)
HTC devices running Android 2.1 and Android 2.2 are prone to a directory traversal vulnerability in the Bluetooth OBEX FTP Service. Exploiting this issue allows a remote authenticated attacker to list arbitrary directories, and read arbitrary files, via a ../ in a pathname.
Description:
In the present HTC / Android phones include a Bluetooth stack, which provides Bluetooth communications with other remote devices. The File Transfer Profile (OBEX FTP) is one among all the Bluetooth services that may be implemented in the stack.
The OBEX FTP service is a software implementation of the File Transfer Profile (FTP). The File Transfer Profile (FTP) is intended for data exchange and it is based on the OBEX communications client-server protocol. The service is present in a large number of Bluetooth mobile phones. This service can be used for sending files from the phone to other remote devices and also allows remote devices to browse shared folders and download files from the phone.
In HTC / Android phones, the default directory of the OBEX FTP Server is the SDCard. Only files placed in the directory of the SDCard can be shared. The user cannot select other directory so sensitive files related to the operating system are not exposed.
There exists a Directory Traversal vulnerability in the OBEX FTP Service in the Bluetooth Stack implemented in HTC devices running Android 2.1 and Android 2.2. The OBEX FTP Server is a 3rd party driver developed by HTC and installed on HTC devices running Android operating system, so the vulnerability affects to this vendor specifically.
and in the end, compare:
STAT {{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{{*},{.}}}]}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
hovever in vsftpd, command lenght is allowed to 4096 bytes. So it's no problem to create request with a huge complexity
To bypass max_per_ip, use ISP with dynamic ip. Disconnect and connect (example for bt mobile phone):
cx@cx64:~$ hciconfig hci0 down
cx@cx64:~$ hciconfig hci0 up
and connect again.
# Keynote by Richard Stiennon
# Highly Technical Conference with 2 days of Technical Briefing and 1-day of hand-on training workshop
# 11 Technical Talks from information security experts from around the world
# Specialized hands-on training workshop for Network Admins, DBAs,Developers, Researchers, Architects, Govt. Agencies, Auditors, Students.
# Live hacking demo of secure networks, mobile phones, corporate wireless networks, Facebook etc
# Cloud based Capture-the-Flag, 1st time in India.
**** Technical Briefings ****
Dhruv Soi - Exploit the Exploit Kits
Please send data to cfp@toorcon.org :
000. Name (or leet alias, non-leet aliases are subject to heckling)
001. Email Address
010. Mobile Phone Number (In case we need to contact you at the con)
011. Brief Bio
100. Title of the Talk
101. Brief Abstract
110. Any supporting materials, links, outlines, etc
111. What talk format are you submitting for:
The schedule of all presentations can be found on our web site:
https://deepsec.net/schedule.html
Duncan Campbell will talk about how terrorists use encryption in their
communication. Alex Plaskett will talk about owning Windows Phone 7 (WP7).
Bogdan Alecu shows how to compromise mobile phones by sending a special
crafted SIM Toolkit command message. Laurent 'kabel' Weber describes the
enhancement of scapy, the powerful interactive packet manipulation program,
by the layer-3 of the Global System for Mobile Communications (GSM) protocol.
Alan Kakareka offers insights into the Russian black market. Mitja Kolsek
explains how to rob an online bank (and get away with it). Juan Pablo Perez
Please send data to cfp@toorcon.org :
000. Name (or leet alias, non-leet aliases are subject to heckling)
001. Email Address
010. Mobile Phone Number (In case we need to contact you at the con)
011. Brief Bio
100. Title of the Talk
101. Brief Abstract
110. Any supporting materials, links, outlines, etc
111. What talk format are you submitting for:
independent development company named Opera Software ASA.
Today, Opera Software develops the Opera Web browser, a high-quality,
multi-platform product for a wide range of platforms, operating systems
and embedded Internet products - including Mac, PC and Linux computers,
mobile phones and PDAs,game consoles and other devices like the
Nintendo Wii and DS, Sony Mylo and more.
Opera's vision is to deliver the best Internet experience on any
device. Opera's key business objective is to earn global leadership in
the market for PC / desktops and embedded products. Opera's main
http://hackerati.com/post/57314994/rfid-on-the-cheap-hacking-tikitag
These devices contain an NXP PN532 reader chip, which, it turns out, is
also capable of running in emulator mode (it is the chip used in a lot
of NFC mobile phones), and, after looking at documentation from NXP, I
was able to get this functionality working, and I'm delighted that NXP
have also agreed to allow me to release the code despite it being based
on information that was provided under NDA, so massive props to NXP for
supporting the open source security research community! :)
ADDRESS AND COOKIES and disable the session when the ip changed?
<http://www.foxnews.com/scitech/2010/01/16/network-flaw-causes-scary-web-error/>
SAN FRANCISCO – A Georgia mother and her two daughters logged onto
Facebook from mobile phones last weekend and wound up in a startling
place: strangers' accounts with full access to troves of private
information.
The glitch — the result of a routing problem at the family's wireless
carrier, AT&T — revealed a little known security flaw with far reaching
For ToorCamp we will be having 50-minute talks on Thursday, 20-minute talks on Friday, and then hands-on workshops throughout the weekend. To submit a talk for the conference, please fill out the information below and email to cfp@toorcamp.org:
0. Name
1. Email Address
2. Mobile Phone Number
3. Brief Bio
4. Title of the Talk
5. Brief Abstract
6. Any supporting materials, links, outlines, etc
7. What talk format are you submitting for:
We aim to show that it is possible to find and exploit bugs on Symbian
smartphones, even in preinstalled system applications, without having
access to special development hardware, and that exploits and worms
similar to those found on desktop systems may be possible on Symbian.
The bugs listed in this paper have been sent to Nokia and are currently
under review. Mobile phone manufacturers should be aware that remote
vulnerabilities of the kind discussed in this paper could be used in
targeted attacks to remotely compromise a smartphone (track GPS, turn on
mic, etc.), or as a means of propagation for mobile network worms.
--
modern society.
Dave 'h1kari' Hulton is a seasoned 'hardware hacker' and the organizer
of the annual Toorcon (www.toorcon.org) security conferences in
Seattle and San Diego. David will be presenting on intercepting mobile
phone and GSM traffic utilizing techniques and hardware that until
recently had been priced out of the range of most individuals and
companies.
John 'jur1st' Benson is a lawyer from Kansas City, MO who specializes
in electronic discovery and is also the chairman of the Kansas City
>
> <http://www.foxnews.com/scitech/2010/01/16/network-flaw-causes-scary-web-error/>
>
>
> SAN FRANCISCO – A Georgia mother and her two daughters logged onto
> Facebook from mobile phones last weekend and wound up in a startling
> place: strangers' accounts with full access to troves of private
> information.
>
> The glitch — the result of a routing problem at the family's wireless
> carrier, AT&T — revealed a little known security flaw with far reaching
Adium <= 1.3.5 [2].
According to their website [3], Libpurple is also used by:
. Apollo IM - IM application for the iPhone and iPod Touch.
. EQO - an IM program for mobile phones.
. Finch - a text-based IM program that works well in Linux and other
Unixes.
. Instantbird - a graphical IM program based on Mozilla's XUL framework.
. Meebo - a web-based IM program.
. Telepathy-Haze - a connection manager for the Telepathy IM framework.
Submition Topics:
------------------------------
1. One of the topics of interest to us is "Desi Jugaad"(Local Hack)
and has a separate track of it's own. Submissions can be any kind of
local hacks that you have worked on (hints: electronic/mechanical
meters, automobile hacking, Hardware, mobile phones, lock-picking,
bypassing procedures and processes, etc, Be creative :-D)
2. The topics pertaining to security and Hacking in the following
domains(but not limited to)
- Hardware (ex: RFID, Magnetic Strips, Card Readers, Mobile Devices,
Please send data to cfp@toorcon.org :
00. Name
01. Email Address
02. Mobile Phone Number
03. Brief Bio
04. Title of the Talk
05. Brief Abstract
06. Any supporting materials, links, outlines, etc
07. What talk format are you submitting for:
Original URL:
http://securityreason.com/achievement_securityalert/73
- --- 0.Description ---
Opera is a Web browser and Internet suite developed by the Opera Software company. The browser handles common Internet-related tasks such as displaying Web sites, sending and receiving e-mail messages, managing contacts, IRC online chatting, downloading files via BitTorrent, and reading Web feeds. Opera is offered free of charge for personal computers and mobile phones.
- --- 1. Opera 10.01 Remote Array Overrun (Arbitrary code execution) ---
The main problem exist in dtoa implementation. Opera has a very similar dtoa algorithm to the BSD, Chrome and Mozilla products. It is the same issue like SREASONRES:20090625.
====================================================
3) Summary
The Web Browser for S60 (formally called Nokia Mini Map Browser) is a web
browser for the S60 mobile phone platform developed by Nokia.
It is built upon S60WebKit, a port of the open source WebKit project to the S60
platform. According to several sources, the S60 software on Symbian OS is the
world's most popular software for smartphones.
This version of the Nokia Mini Map Browser does not properly validate JavaScript
Strom Carlson - Why your mother will never care about Linux (a rant)
Stephan Chenette - Ultimate Script Deobfuscation: Browser Hooking versus simulation
Luiz "effffn" Eduardo - a 30,000 feet look at wi-fi, the freezing spot
Adam Cecchetti - Nunchaku: Attack, Defense, and a lot of arm flailing
Dan Griffin - Hacking SharePoint
Zane Lackey & Luis Miras - Mobile Phone Messaging Anti-Forensics
Dan Hubbard - P0wn the Cloud. The good, the bad, and the pugly of Cloud Computing
Tom Stracener - Advanced Cross-Site Scripting Scenarios, Filter Evasion and Browser Exploits
Thomas Ristenpart - Privacy-preserving Location Tracking of Lost or Stolen Devices: Cryptographic Techniques and Replacing Trusted Third Parties with DHTs
Dean Pierce - Seeds of Contempt
Zax - How did that Nigerian do that?! Artificial Intelligence and You
#2009-006 Android improper package verification when using shared uids
Description:
Android, an open source mobile phone platform, improperly checks developer
certificates when installing packages that request the shared user identifier
(uid) permission.
Normally, Android applications will be allowed to share a uid if the
packages are all signed by the same developer certificate and request
Introduction:
=============
Skype is a software application that allows users to make voice and video calls and chats over the Internet. Calls to other users within the
Skype service are free, while calls to both traditional landline telephones and mobile phones can be made for a fee using a debit-based
user account system. Skype has also become popular for its additional features which include instant messaging, file transfer, and
videoconferencing. Skype has 663 million registered users as of 2010. The network is operated by Skype Limited, which has its headquarters
in Luxembourg. Most of the development team and 44% of the overall employees of Skype are situated in the offices of Tallinn and Tartu, Estonia.
(Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Skype)
Opera is a web browser having a market share of about 2,74%
following http://en.wikipedia.org/wiki/Usage_share_of_web_browsers .
Following the vendor, it runs on "Mac, PC and Linux computers, mobile
phones and PDAs, game consoles, and other devices like the
Nintendo Wii, DS, Sony Mylo, and more."
--[ Synopsis:
======================================================================
3) Vendor's Description of Software
"Adobe Flash Player is the high-performance, lightweight, highly
expressive client runtime that delivers powerful and consistent user
experiences across major operating systems, browsers, mobile phones,
and devices."
Product Link:
http://www.adobe.com/products/flashplayer/
Next Page>>
|
|
|
