JVN#43105011: Android vulnerability where an incorrect SSL certificate is displayed

Android OS contains a vulnerability where a SSL certificate from an outside site is displayed when a user attempts to display a SSL certificate from a site that reads in contents from an outside site. Impact An attacker may trick the user into believing the site being visited is safe, which may...

Zeus Banking Trojan Comes to Android Phones

The Zeus banking Trojan has jumped the bridge to the large and growing ecosystem of mobile devices powered by Google’s Android operating system, according to security researchers at Fortinet. Researchers say they have obtained a Zeus variant, dubbed “Zitmo,” that can run on Android phones and tha...

New iPhone Jailbreak Makes Short Work of World's 'Most Secure' OS

It wasn’t long ago – just a month in fact – that Apple’s iOS mobile operating system was being called the ‘Most secure’ OS. Period.’ A few weeks later, and the security of that OS has fallen again to the talents of Comex, an as-yet-unnamed mobile device hacker whose work is attracting kudos from...

Android NFC Bug Could Be First Of Many

Google is working on a fix for a newly discovered vulnerability affecting Nexus S Android phones that could cause applications on the phone to crash using incorrectly formated Near Field Communications NFC transactions. The issue, which will be discussed at an upcoming technical conference on...

Mobile Devices Key To Facebook's New Log-In Approval Feature

Facebook is implementing a new opt-in, two-factor verification security feature they are calling log-in approval. The new feature will require users to enter a unique, one time code, which Facebook will send via SMS whenever a user tries to access his or her account from a new and/or unrecognized...

Leaked Blackberry Doc Blows Cover On 4.0 Release

Another ground breaking mobile device release, another embarrassing leak. Mobile device maker Research in Motion found itself responding to the publication of documentation for its much anticipated Blackberry Internet Service BIS 4.0 on Thursday. In a story reminiscent of the now famous faux pas ...

FtpDisc v1.0 for iPhone / iPod touch, Directory Traversal

Exploit for hardware platform in category remote exploits Exploit Title: FtpDisc v1.0 for iPhone / iPod touch, Directory Traversal Date: 02/22/2011 Author: email protected, email protected, Sunlight Software Link: http://itunes.apple.com/kr/app/ftpdisc-lite-pdf-reader/id329157971?mt=8 Version: 1....

Cyber criminals to be more aggressive in 2011 !

New Delhi: With the growing diversity of operating systems among companies, and the increasing use of mobile devices, cyber criminals will put a new spin on social engineering by 'malware campaign' under which they will bombard recipients with email that drop virus downloaders. According to an...

Top 10 IT Security Trends for 2011

The crystal ball gazing has started early this year. Typically, tech prediction pieces emerge after Christmas, but the first 'security trends for 2011' missive has already dropped into my inbox. So, what does the somewhat premature Imperva Application Defense Center think will worry us the most o...

This Week in Security: Phantom Firefox Menace, Mass Domain Ownage and The Curious Case of IE6

There’s old, and there’s old. Internet Explorer 6 clearly falls into the latter category, but despite its advancing age, IE6 still holds a lot of sway in the enterprise, as new data that came to light this week. That’s not the only weirdness that reared its head this week, though. There was the...

RSA Survey Finds Mobile Device Breaches Rare

Most respondents in a recently released RSA study 93.2% answered “Yes” when asked if allowing employees to connect their personal mobile devices to the corporate network poses a security threat to their organization, but only 1.8% reported a “serious incident” as a result of an employee’s mobile...

CVE-2010-2913

The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file, which allows local users to obtain sensitive information via vectors involving 1 the mobile device or 2 a synchronized computer...

Android Also Gives Google Remote App Installation Power

The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn’t the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on user...

Spoofing

The "IP address range limitation" function in OpenPNE 1.6 through 1.8, 2.0 through 2.8, 2.10 through 2.14, and 3.0 through 3.4, when mobile device support is enabled, allows remote attackers to bypass the "simple login" functionality via unknown vectors related to spoofing...

CVE-2010-1040

The "IP address range limitation" function in OpenPNE 1.6 through 1.8, 2.0 through 2.8, 2.10 through 2.14, and 3.0 through 3.4, when mobile device support is enabled, allows remote attackers to bypass the "simple login" functionality via unknown vectors related to spoofing...

CVE-2010-1040

OpenPNE contains an authentication bypass vulnerability related to the IP address range limitation function when mobile device support is enabled. The flaw in the IP address range limitation may allow remote attackers to bypass the simple login feature, potentially enabling access to or modificat...

Pwn2Own Predictions: Apple iPhone Will Fall

Hackers at this year’s CanSecWest Pwn2Own contest will definitely break into an Apple iPhone by exploiting a remote code execution vulnerability. That’s the prediction from Charlie Miller and Aaron Portnoy, two security researchers who are monitoring events leading to next week’s hacker challenge...

Palm Pre WebOS <=1.1 Remote File Access Vulnerability

I. Description The Palm Pre WebOS =1.1 suffers from a JavaScript injection attack that allows a malicious attacker to access any file on the mobile device. Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+. Palm WebOS 1.2 patch information can be...

Palm Pre WebOS <=1.1 Remote File Access Vulnerability

I. Description The Palm Pre WebOS =1.1 suffers from a JavaScript injection attack that allows a malicious attacker to access any file on the mobile device. Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+. Palm WebOS 1.2 patch information can be...

Palm Pre WebOS <=1.1 Remote File Access Vulnerability

Exploit for unknown platform in category remote exploits ===================================================== Palm Pre WebOS =1.1 Remote File Access Vulnerability ===================================================== Title: Palm Pre WebOS =1.1 Remote File Access Vulnerability CVE-ID: OSVDB-ID:...