Feeds

Homebrew Pre apps find easy install

We've got ourselves a security hole, Rubber Duck

Internet Security Threat Report 2014

Developers unwilling to wait for the Mojo SDK for Palm's Pre, or to be bound by its restrictions, have discovered that unsigned applications can be installed using a specially-formatted e-mail rather than any mucking about with unlocking the handset.

The process, as explained at Pre Central, simply requires an e-mail containing a link to an ".ilk" file containing the application.

Installing the file any other way falls foul of the Pre's requirement for native applications to be signed, but downloading from a link in an e-mail message bypasses that security check and allows the installation of anything the user desires.

Palm is being pretty good about homebrew applications at the moment. Though officially only supporting the WebOS-extended AJAX platform - the company has politely asked homebrew sites to remove content about tethering, for fear of offending Sprint - Palm obviously sees a small-scale homebrew market as no threat to its business model.

Native applications are allowed, but only by working with Palm, and only when digitally signed by the company. Until recently, the only way to bypass that security check was to unlock the device, but it now seems receiving the link via e-mail works equally well.

The more observant reader will have noticed that this is a security issue you could easily drive a convoy through. Malware could be distributed this way, even though a server would be needed from which the malware could be downloaded, so Palm would be remiss if it didn't patch this pretty quickly.

But, for the moment, Pre owners can happily install the demonstration application and enjoy the unauthorised apps without unlocking their handset. Until the next patch from Palm, at least. ®

Internet Security Threat Report 2014

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.