In the spring of 2009, Smartphone users were surprised by the sophistication of an SMS worm, known as YXES, that affected Symbian devices. It started with an SMS message that consisted of a link to a malicious website hosting a malicious payload for the device. Once the payload was downloaded, it would attempt to send an SMS message to the phone numbers that appeared in the compromised device’s call log. This worm also stole the user’s device information and uploaded it to the server. In the summer of 2009, mobile security researchers demonstrated, in a live presentation at the BlackHat conference, that they were able to take complete control of a victim’s iPhone by sending a specially crafted SMS message to the device. And in the fall of 2009, Research In Motion (RIM), the manufacturer of BlackBerry Smartphones, issued an advisory concerning a certificate-handling flaw that could allow an attacker to trick users into visiting a malicious website via SMS messages.  Finally, according to research conducted by security researchers at Pennsylvania State University, it may be possible for attackers to cause denial of service conditions by spamming mobile networks, if successful, could cripple them.

continue reading…

SMobile’s Global Threat Center (GTC) has released a research study on proof of concept malicious applications for BlackBerry platform. This research exposes the weakened security posture of BlackBerry device that operate under the BlackBerry Internet Service environment. The proof of concept applications discussed in this research are developed to examine the response of BlackBerry inbuilt security framework. Through this research, SMobile concludes that there are certain instances of attacks that may be successful in bypassing the security framework of BlackBerry and poses a significant threat to privacy and confidentiality of the user. This research paper can be downloaded here:

BlackBerry paper

So, let’s recap.  In the early days of November, a Dutch kid realizes that nearly everyone that has jailbroken their iPhone (almost 8%, roughly 2 million, of all iPhones in the world) is likely still using the default SSH password of “alpine” on their devices.  He decides to hack into iPhones and then charges the victims 5 Euros to get their data back.  A few short days later, an Aussie writes the world’s first iPhone worm that took advantage of the same self-inflicted vulnerability.  However, this worm acted as a warning to the iPhone community and was not overtly malicious.  The iKee worm leveraged the SSH “alpine” password to change the wallpaper of the affected device to a picture of Rick Astley.  The iKee worm was said to have only really affected a couple of carriers in Australia and few sparse reports of the worm breaking out into some Asia Pacific networks. At this point, many security researchers got serious about informing the public of the vulnerability, as well as the process to change the passwords on jailbroken iPhones around the world. The same security researchers also warned that the non-malicious iKee worm code would be modified to contain malicious payloads in the future.  We are there now.

continue reading…

Just three short days ago, this blog made the not-so-difficult prediction that the Australian born iPhone worm “iKee” would undoubtedly lead to much more nefarious payloads born from malicious intents.  Yesterday, we began hearing reports of a new cross platform iPhone malware, dubbed iPhone/Privacy.A which is being used to mine iPhones for coveted personal/confidential information.

continue reading…

In the past few months, there has been a tremendous increase in the release of spyware applications for smartphone devices. Earlier this year we saw the release of the first spyware application for the iPhone that supported 2G/3G/3GS iPhones. Later we saw the releases of more advanced spyware applications for the BlackBerry and the iPhone. And recently, on Nov 06, 2009, the world’s first spyware application for Android was released.  In summary, this year alone we have seen that the threats that were dominating Windows and Symbian devices have begun to make their way to the sexier BlackBerry, iPhone and Android devices.

continue reading…