msmobiles.com/f

msmobiles.com_robot · Joined: 23 Mar 2004 Posts: 16777215

Thought this might be interesting to you guys. Bascially the actual code required to exploit a security vulnerability in the MMS client on Windows Mobile has been released.

Shortly speaking: now malware writers c...

Read more at http://www.msmobiles.com/news.php/5903.html

gilesjuk · Joined: 22 Jan 2005 Posts: 312

Shows how much attention Windows Mobile is given at Microsoft.

AlanJC · Joined: 17 May 2006 Posts: 21

Are we sure this works on all PPC devices with MMS capability?

What about different AKU versions?

Also, bear in mind Microsoft don't make the MMS utility, it's usually Arcsoft on the ones HTC make.

So I'm not sure if really Microsoft should be responsibility for bugs in someone elses program. Note this security alert is specifically against MMS, not email, which could have the same files sent to it, I don't know if it's their problem at all.

MaxiKing · Joined: 01 Jan 2007 Posts: 3

I somehow feel delighted ...

... that this bunch of completely incompetent security newbies at msmobiles.com got their foolish statements shoved up the a...!

Any grown-up computer user who has half-a-brain left would know that with the widespread use of Windows Mobile and the numerous distribution vectors like mail, SMS, MMS, Bluetooth one day these devices would be targeted.

Now you have seen the advent of a new generation of Viruses, ones that can send Premium SMS or silently call a toll-number on the Cayman Islands in the middle of the night. Even worse - not 1% of the users has any protection.

Now for everyone's sake - revisit you articles below, say sorry and then get people to protect their phones or their phone bill might be in the thousands of dollars. Guess how popular Windows Mobile will be for those folks!

Maxi

Check that rubbish out - biased and dangerous:

AntiVirus 4.0 for Windows Mobile released by Symantec

http://msmobiles.com/news.php/5717.html

Symantec, the company that makes annoying anti-virus software that is included with several notebooks and PCs - and that works under condition that you have to pay after some time (extortion?) - is now targeting also Windows Mobile increasingly. It looks like their PC software business may shrink due to imminent release of Windows Vista that is well protected, so no wonder Symantec embraces more warmly Windows Mobile all of a sudden...

Our verdict: this anti-virus software is not worth buying.

Trend Micro Mobile Security 3.0 released although nobody needs it

http://msmobiles.com/news.php/5771.html

cucci · Joined: 13 Oct 2006 Posts: 49

Please note....

The previous posting was from ' A grown-up computer user with half-a-brain left '.

Just thought you'd all like to know.....

s3ntinel · Joined: 13 Sep 2005 Posts: 65

It had to come here too, security is not quite so black and white. Everyone buying the sky falling on your head protector, please go and read the original avisory. This is not a silent attack, and Symbian will still be attacked because Windows Mobile devices with phone connectity are still not widely spread enough to provide 'bang for buck' (Yet!).

Mobile AV is still snake oil ... period! Evil or Very Mad

s3ntinel · Joined: 13 Sep 2005 Posts: 65

Oh and BTW, this is stated to be for WM2003 and would cost approx €0.49 per MMS. Not really a mass exploit, even for cyber criminals. The WM market has really taken off since WM5, which is so far not vulnerable.

Symbian is more targetted as more phones that are not market as being 'Smartphones' are available with the Symbian O/S as opposed to the WM O/S which is on 'Smartphones' or PDAs. The only device not being marketed in this way so far is the Lobster.

MaxiKing · Joined: 01 Jan 2007 Posts: 3

s3ntinel · Joined: 13 Sep 2005 Posts: 65

Maxi, why would cybercriminals target a mobile device when they have plenty botnet PCs to target? 50,000 from MS06-040 alone!

I work in security, and fail to see the real threat here. A security researcher has been playing and found an exploit that works on some devices and not others.

Have you tried sending an MMS recently? Most of the time it ends up as being a URL instead of the actual MMS.

The relevance of Symbian, BTW, is not 'cos I hate Symbian but that you don't try to hit a niche target area when trying to earn money.

Yes these are devices that sometimes have internet connectivity, but it's often below 56k and too expensive for people to activate.

Wait until 3G/HSDPA becomes mainstream and then that's a different issue, but until then this is still snake oil. Read the PPT presentation and look at everything that was setup in the lab, this really isn't more then a POC.

Now I'm not stating that there will never be a threat, but at the present moment if I stand in the Atlantic off the West coast of Scotland with a White Shark scarer and there are no White Sharks there does that mean that it works?

The sea off Tyree is warmed by the Gulf Stream so the conditions are there, so surely the scarer works? Of course not, now with Global warming, things may change and the need to sustain the white sharks might mean that they move there and the scarer becomes useful, but until such time it is snake oil.

Mobile AV is the same, show me an AV vendor that detects against exploit code itself, and they are very few and far between, they wait for a viral threat to come along and then detect that with a signature.

So you need to constantly update your Mobile AV to protect against any known threat that is there. That is their business model, so you spend most of your data allowance in trying to become protected against a threat that isn't happening yet; this drives a reliance on the annual subscription to the AV vendor.

MaxiKing · Joined: 01 Jan 2007 Posts: 3

Sterdickup66 · Joined: 09 Jan 2007 Posts: 2

wow

http://nakedcamerondiaz.info/blog/comments/40484
regards, Sterdickup66

Addickder · Joined: 10 Jan 2007 Posts: 3

wow xxx

http://angelina-jolie-eats-cum.info/raped/40484
regards, Addickder