Posted by Jaime Raphael Licauco, CISSP, GSEC on January 29, 2009
If you have a Nokia S60 3rd Edition phone, which doesn’t seem to be accepting messages, or just accepts some but not all messages, your phone may have been attacked by what’s been called as the “Curse of Silence“. Nokia Europe has just released their SMS Cleaner which can clean Nokia S60 3rd Edition (Initial or Feature Pack 1) based devices. Nokia doesn’t say if it will erase anything from the affected phone aside from the “Curse of Silence” messages.
S60 3rd Edition, Feature Pack 1 (S60 3.1):
Nokia E90 Communicator
Nokia E71
Nokia E66
Nokia E51
Nokia N95 8GB
Nokia N95
Nokia N82
Nokia N81 8GB
Nokia N81
Nokia N76
Nokia 6290
Nokia 6124 classic
Nokia 6121 classic
Nokia 6120 classic
Nokia 6110 Navigator
Nokia 5700 XpressMusic
S60 3rd Edition, initial release (S60 3.0):
Nokia E70
Nokia E65
Nokia E62
Nokia E61i
Nokia E61
Nokia E60
Nokia E50
Nokia N93i
Nokia N93
Nokia N92
Nokia N91 8GB
Nokia N91
Nokia N80
Nokia N77
Nokia N73
Nokia N71
Nokia 5500
Nokia 3250
No word yet on software that can undo the problem for devices with S60 2nd edition with Feature Pack 2 and 3.
You can also check out this site to find out if your handset is running S60 and what Feature Pack it has.
A few days after this post, Nokia released
SMS Cleaner for Feature Pack 2 and 3.
Posted in DOS, ISMS, malware | Tagged: 27001:2005 A.11.7.1, curse of silence, Mobile Security, Nokia, sms, SMS Cleaner | Leave a Comment »
Posted by Jaime Raphael Licauco, CISSP, GSEC on January 9, 2009
F-Secure apparently has a solution for this, but you would have to pay for it after 15 days. I’ve also confirmed that this attack works on at least one of the major local networks. No word yet if they have changed their settings to what was suggested to stop the attack. Sony Ericsson UiQ devices were found by F-Secure to also be vulnerable to the attack.
Nokia isn’t very worried about it since it is a denial of service attack and doesn’t allow an attacker to leach information from your cellphone. I still think it would be very annoying if I would have to do a factory reset of my phone, losing all my contacts, settings and messages. I also wouldn’t like it if my competitor knows my company uses the vulnerable phones and starts shutting down SMS capabilities until we notice it. That could potentially hit productivity and the bottom line.
I have no details of the local test done except that it exists and it was possible. If one watches the video, the victim wouldn’t even know who sent the message. The phone just stops receiving messages… in other words, Nokia’s advice in the Heise Security article is pretty useless.
Nokia which got the demo around a month before the public release and which recently acquired Symbian, is currently working on a remedy for the vulnerability. I will post it here as soon as I get word of it.
Posted in vulnerability | Tagged: 27001:2005 A.11.7.1, Nokia, Series 60, vulnerability | Leave a Comment »
Posted by Jaime Raphael Licauco, CISSP, GSEC on November 18, 2008
BBC Click on Biometrics
A few weeks ago BBC News Click published How biometrics could change security. The week after, they then published, “The pitfalls of biometric systems“.
Since its somewhat related to physical security, A UK fingerprint developer can read a letter from its envelope.
More news about the keyboard electromagnetic sniffing that was making the news last month:
From The Register Swiss boffins sniff passwords from (wired) keyboards 65 feet away
From BBC Keyboard sniffers to steal data
Video on keyboard sniffing from the very people that did the experiment can be found at COMPROMISING ELECTROMAGNETIC EMANATIONS OF WIRED KEYBOARDS.
The Register gives a tutorial on encrypting e-mails in, “
Still sending naked email? Get your protection here“.
Pretty sad that a UK Anti-Fraud site has crashed due to
DDOS attack.
The popular and free AVG Anti-virus has once again identified a trojan that isn’t one.
A Vulnerability has also been discovered in the SSH Specification.
The New York Times reports that Privacy Laws Trip Up Google’s Expansion in Parts of Europe
The Federation of American Scientists (FAS) Secrecy blog, reports that terrorists can presumably use twitter, instant messaging, etc. The article Spy Fears: Twitter Terrorists, Cell Phone Jihadists by Noah Shachtman on Wired talks about it more.
If you’re interested on the pdf exploit (also see below in other news), Didier Steven’s Blog, talks about Shoulder Surfing a Malicious PDF Author.
Other News:
Email ruse uses Federal Reserve Bank name to drop PDF exploit
Cybercrime expected to ramp during holiday season
New attack targeting Windows Mobile phones
Apple issues 11 security updates for Safari browser
How Outsourced Call Centers Are Costing Millions In Identity Theft
Although somewhat unrelated, InfoSec Professionals might also be interested in this article on airport security, The Things He Carried
White paper on
Designing and implementing malicious hardware presented at the LEET ‘08
White Hat World Webinar on 10 Reasons your Existing SIEM Sucks! This will be held on Thursday, November 20, 2008 4:00 am Philippine time.
Posted in ISMS, News | Tagged: Whitepapers, encryption, e-mail, vulnerability, social engineering, 27001:2005 A.9, Physical Security, 27001:2005 A.10.8, ssh, pdf exploit, 27001:2005 A.11.7.1, Apple Safari, airport security, call center, bpo, keyboard attack, electromagnetic emanation, Webinars | Leave a Comment »
