The folks over at Precentral.net did a nice write up on the issue as well:
http://www.precentral.net/update-12-fixed-serious-file-security-issue
I. Description
The Palm Pre WebOS <=1.1 suffers from a JavaScript injection attack that allows a malicious attacker to access any file on the mobile device.
Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+.
Palm WebOS 1.2 patch notes can be found here:
http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12
II. Impact
A specially crafted email can access any file on the Palm Pre WebOS version <=1.1 mobile device and send it to a web site of the attacker's choice just by viewing the email.
III. Details
The Palm Pre WebOS 1.1 and lower will parse and execute JavaScript contained in an email it receives. Exploiting this vulnerability allows an attacker to read/extract any file and post it to a remote website the attacker controls.
One particular file of interest is the "PalmDatabase.db3" file. Having this database file will give an attacker emails, email addresses, contact list information including names, phone numbers, etc. Limitations with binary data have been identified, however viewing binary data such as database files is still simple.
Proof of Concept
Creating an email with the following JavaScript in it will automatically upload a file of the attacker's choice to a remote web server:
To view a Flash demo of this exploit in action:
http://tlhsecurity.com/videos/FA.html
IV. About
This vulnerability was discovered by Townsend Ladd Harris
Special Thanks to :
- Chris Rohlf - Blog: http://em386.blogspot.com/
- Destinal #webos-internals (irc.freenode.com)
- Webos-Internals group #webos-internals(irc.freenode.com) Website: Here
- Bryce Kerley
- Dan Czarnecki
- Jeremy Rasmussen
The problem is that the European versions of the Pre, launching this week, are carrying 1.1 - NOT the patched 1.2 - and there's no date given yet (beyond "this month") for the upgrade, so you're providing details of how to scupper the European Pre's...
ReplyDeleteMobile technology is continuously evolving to enable users do almost anything on the go, and much more is in store for sure. Collaboration via mobile is a capability rendered as part of this evolution. Today meetings can be conducted through mobile. You can join a Web Conference wherever you are with just an Internet-equipped mobile. Thanks to vendors such as RHUB http://www.rhubcom.com and others who have made such enabling technologies.
ReplyDeleteThis is a serious one. I hope it was solved until now.
ReplyDeletePalm Pre Cases
Wow..this is pretty viscous stuff. I had no idea that Palms were so vulnerable to attack. Makes me happy I have somehow managed to avoid smartphones altogether up to this point. Especially considering the fact that I have used remote control software on a friend's iPhone to access my computer..I would be very upset if my info was compromised due to an attack like this..
ReplyDelete