U.S. Playing Catch Up in Security for Contactless Devices

AMHERST, MASS.– The U.S. may boast the world’s largest economy, richest technology companies and a lion’s share of its top research universities. But when it comes to the subject of security of RFID Radio Frequency ID and other contactless technologies, America is still playing catch-up. The U.S....

Experts Converge at RFIDsec to Discuss NFC Security Implications

RFID security problems have been biting at the ankles of users and companies that deploy the technology for several years now, but they’ve been mostly on the fringes of mainstream security concerns. But now, as the technology becomes more widespread and pervasive, that is beginning to change...

Android NFC Bug Could Be First Of Many

Google is working on a fix for a newly discovered vulnerability affecting Nexus S Android phones that could cause applications on the phone to crash using incorrectly formated Near Field Communications NFC transactions. The issue, which will be discussed at an upcoming technical conference on...

Poken.com Cross Site Request Forgery

Poken is a technology that utilizes a proprietary Near Field Communication NFC technology to allow the exchange of online social networking data between two keychain accessories. Poken.com is the website where poken users can edit their profiles, and browse other poken friends they already met...

Android Update Adds Protections For Mobile Clickjacking

Google released the latest version of its Android mobile operating system on Monday, adding security features that it says will make it tougher for mobile device users to be subjected to “clickjacking” attacks that trick them into clicking on hidden or disguised user interface elements. The compa...

Nokia 6212 classic URI spoofing and DoS advisory (original date: Dec. 2008)

Vulnerability Report --- BEGIN ADVISORY --- Manufacturer: Nokia www.nokia.com Device: Nokia 6212 Classic Firmware: V 05.16, 29-09-08, RM-396 Device Type: mobile phone OS: Nokia Series40 Subsystem: Near Field Communication ----------------------------- Executive Summary: URL Spoofing when displayi...

CVE-2008-5825

The SmartPoster implementation on the Nokia 6131 Near Field Communication NFC phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR aka \r, and . dot characters, which allows remote attackers to trick a user into loadi...

CVE-2008-5826

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware allows remote attackers to cause a denial of service device crash via 1 a large value in the payload length field in an NDEF record, or a certain length for a 2 tel: or 3 sms: NDEF URI...

CVE-2008-5827

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag...

Design/Logic Flaw

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware allows remote attackers to cause a denial of service device crash via 1 a large value in the payload length field in an NDEF record, or a certain length for a 2 tel: or 3 sms: NDEF URI...

Design/Logic Flaw

The SmartPoster implementation on the Nokia 6131 Near Field Communication NFC phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR aka \r, and . dot characters, which allows remote attackers to trick a user into loadi...

Design/Logic Flaw

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag...

CVE-2008-5825

The SmartPoster implementation on the Nokia 6131 Near Field Communication NFC phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR aka \r, and . dot characters, which allows remote attackers to trick a user into loadi...

CVE-2008-5827

The CVE describes a vulnerability in the Nokia 6131 NFC phone (firmware 05.12) where the device automatically installs software after downloading a JAR file. This behavior can enable remote code execution via a crafted URI record in an NDEF tag, potentially allowing an attacker to run arbitrary c...

CVE-2008-5827

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execute arbitrary code via a crafted URI record in an NDEF tag...

CVE-2008-5826

The CVE-2008-5826 entry concerns the Nokia 6131 NFC phone (firmware 05.12). A remote attacker can trigger a Denial of Service (device crash) by sending crafted NDEF data: (1) an unusually large payload length in an NDEF record, or (2) a particular length for a tel: NDEF URI, or (3) an sms: NDEF U...

CVE-2008-5825

The CVE-2008-5825 entry concerns the Nokia 6131 NFC phone (firmware 05.12) SmartPoster handling. A bug in displaying the URI record occurs when the Title record contains a specific mix of spaces, carriage returns, and dots, allowing a crafted NDEF tag to trick a user into loading an arbitrary URI...

CVE-2008-5826

The Nokia 6131 Near Field Communication NFC phone with 05.12 firmware allows remote attackers to cause a denial of service device crash via 1 a large value in the payload length field in an NDEF record, or a certain length for a 2 tel: or 3 sms: NDEF URI...

Nokia 6131存在多个漏洞

BUGTRAQ ID: 30716 CNCAN ID：CNCAN-2008081804 Nokia 6131是一款支持近距离通信NFC的手机设备。 Nokia 6131设备存在URL欺骗和拒绝服务攻击，远程攻击者可以利用漏洞使设备崩溃，造成拒绝服务攻击。 当显示NDEF Smart Poster和明文URI标签的内容时存在URI/URL欺骗，当装载WEB页时浏览器不正确显示完全的主机名。 NDEF记录解析器在处理包含0xFFFFFFFF或0xFFFFFFFE的记录负载长度字段时会导致崩溃。 当电话号码超过124个字符时，SMS和TEL URI处理器会崩溃。 Nokia 6131...

nokia-spoof.txt

Vulnerability Report --- BEGIN ADVISORY --- Manufacturer: Nokia www.nokia.com Device: Nokia 6131 NFC Firmware: V 05.12, 19-09-07, RM-216 Device Type: mobile phone OS: Symbian Series40 Subsystem: Near Field Communication ----------------------------- Executive Summary: URI/URL Spoofing when...