Feeds

PacketVideo opens doorway to Android

Google fans told to down browsers for the duration

Internet Security Threat Report 2014

G1 owners have been warned to stop browsing immediately or risk exposing themselves to the worst of the internet, after researchers found a flaw in PacketVideo's runtime for Android.

The flaw was presented by security researcher Charlie Miller at the recent Schmoocon conference, as reported by ReadWriteWeb, and details are available at oCERT. Given the exploit allows arbitrary code execution, provided within a specially-crafted MP3 file, the security implications are serious - but not as serious as they could be thanks to Android's layered security model.

Not that the complexity of the exploit, or the robust security model, have prevented Miller from recommending that G1 users stop browsing entirely, or at least limit themselves to only visiting trusted sites using the T-Mobile network (avoiding the potential for DNS-spoofing, assuming T-Mobile's DNS' are secure).

ReadWriteWeb contacted Mocana's James Blaisdell for a second opinion, and got the same advice, though it's worth noting that James is CTO of a company that supplies security software for Android.

Google seems less concerned. Indeed the company has had a fix knocking around in its source tree since Monday this week, but T-Mobile hasn't got round to pushing it out to Android users yet.

Even if the flaw was successfully exploited, no mean feat in itself, the attacker would only have access to the browse at best, and more-likely would be restricted to the media player.

That's not to say that the flaw shouldn't be fixed, or that Charlie Miller doesn't deserve our respect for identifying the bug, but calling on Android users to stop browsing is little more than showboating and we'll continue to browse the web on out G1 for the moment, while we wait for a proper mobile-phone security issue to come up.®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.