Security Group Reports on webOS Vulnerabilities

Posted By: Ryan Kairer Friday, April 16, 2010 3:16:21 PM

webos security fail IT Security company Intrepidus Group has released details of a preliminary report on webOS security vulnerabilities. In short, the groups researchers were quite alarmed by the ease, number and scope of security issues that plagued their tested build of webOS. The group has posted details about a SMS vulnerability that affected webOS v1.3.5. They demonstrate that with a single text message, the researcher was able to control the browser, send malicious commands and turn off the radio of a webOS device with a relatively common exploit.

The group has also posted a video demo of the exploit in action. (embedded after the break) It should be noted that Palm Inc. has corrected this very issue in the latest version (v1.4+) of webOS. This story was originally picked up and popularized by CNBC, which colors this story with the Palm is for sale meme complete with a corpspeak response from Palm.

As we started to pry a little it became quite apparent that Palm's new WebOS platform was riddled with some pretty dangerous bugs. These bugs can all be traced back to that fact that WebOS is essentially a web browser and the applications are written in JavaScript and HTML. This also means that WebOS applications are subject to the numerous web applications vulnerabilities that any seasoned penetration tester would be all too familiar with. We were also quite surprised at how quickly these vulnerabilities were discovered. Within a matter of hours we started to uncover a number of low-hanging-fruit vulnerabilities that would be considered quite dangerous under even the most forgiving of standards.

Article Comments

 (9 comments)

The following comments are owned by whoever posted them. PalmInfocenter is not responsible for them in any way.
Please Login or register here to add your comments.

Start a new Comment Down

Solution in the future

e_tellurian @ 4/16/2010 3:54:39 PM # Q
Prior to getting to the market:

Create companies that are assigned to break an OS or pass inspection. They would be responsible for future issues thus assigning ownership of future issues creating a quality incentive environment.

Just some thoughts to kick around.

E-T
e-tellurian

Completing the e-com circle with a people driven we-com solution
WiFi & BT? No strings attached
we_tellurian@canada.com

RE: Solution in the future
fake_t @ 4/17/2010 4:16:52 AM # Q
Let me add:
North american brand. Weathered many storms. Innovation. Classic. Jewel.
RE: Solution in the future
TooMuch @ 4/17/2010 6:24:12 AM # Q
Let me add:
The insightful company studied an older version of webOS for holes filled in a later version of webOS. Genius!
RE: Solution in the future
richf @ 4/17/2010 10:12:42 AM # Q
Hey, they didn't want to waste all the time and money invested in working with an outdated os, they wanted their 15 minutes of fame. Like my drill sergeant in the air force used to say. Airman grab your ears and pull your head out of your a.......
Have a nice day!
Pilot 1000->Pilot 5000->Pilot Pro->IIIe->IIIc->M500->M505->M515->T3->T5->Treo 650P->Treo 700P->Droid
RE: Solution in the future
LiveFaith @ 4/17/2010 8:13:01 PM # Q
Rich,
That list of devices tells a lot about Palm.
Pat Horne
RE: Solution in the future
hkklife @ 4/17/2010 10:13:26 PM # Q
Pat;

Yup, a very similar tale told by my sig device list as well, huh?
Very telling indeed, when the first thing I did after the Pre Plus came out for VZW was...to rush out and buy a like-new VZW Centroto replace my 755p!
Pilot 1000->Pilot 5000->PalmPilot Pro->IIIe->Vx->m505->T|T->T|T2->T|C->T|T3->T|T5->Zodiac 2->TX->Verizon Treo 700P->Verizon Treo 755p->Verizon Moto Droid + Verizon Palm Centro

RE: Solution in the future
LiveFaith @ 4/18/2010 10:03:37 AM # Q
Kris,

You're the diehard of diehards man. I thot I might get the dubious honor of hanging around long enough to turn out the lights around here. But, I'm sure I'll be able to see you still energatic as I give in.

Amazing amazing product that Hawkins, Dubinsky, Eddie and co created. I guess we're waiting (hopelessly) to see it again. I'll buy the Pre when it hits ATT. We'll see.

Have you see the iPhone 4G spies yet? Looks a lot like the LD form factor. Oh, what coulda been?
Pat Horne

Reply to this comment

Low-hanging fruit. Yummmmmmm...

Fake Jeff Hawkins @ 4/17/2010 1:33:49 PM # Q
Palm's coders have left the building.

Outsourcing to Bombay and Mother Russia... full speed ahead!

RE: Low-hanging fruit. Yummmmmmm...
jca666us @ 4/17/2010 10:15:59 PM # Q
All of the ex-Apple guys that jumped ship for Palm must be kicking themselves.
Reply to this comment
Start a New Comment Thread Top

Account

Register Register | Login Log in
user:
pass:

Latest Comments

  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST((SELECT/**/CASE/**/IS_SRVROLEMEM
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000
  • My comments --1' OR UNICODE(SUBSTRING((SELECT/**/ISNULL(CAST(db_name()/**/AS/**/NVARCHAR(4000