Xanda's Blog !~!

More and More Exploits are Now Targeting Clientside & Mobile

Jul
12


[img source]

(The facts that I’m gonna talk about are based on my observations)

Back in mid 2007, Mass SQL injection that contain malicious JavaScript started to bring havoc the our cyberspace. But it brought not enough impact to alert and educate the internet user.. Until mid 2008 where another flood of Mass SQL injection happened attacking MS SQL and not so long after that people cant stop talking about 0day in IE, follow by Adobe Flash Player, Adobe Acrobat Reader, Mozilla Firefox and etc..

This clearly shows that the attacking vector is now somehow changed into the client side. This is due to the number of victim on the client side is way more compare to on the server side. Normally the mission of this kind of attack is to force the vulnerable application to crash and execute arbitrary code usually used to download another malicious file and execute it (drive by download). The victim (client) is now part of the attacker’s botnet. Awuuuooo0… (That is how the botnet sound alike.. Hahahaha)

Now in 2009, more and more client side attacks appear abusing IE, Firefox, Thunderbird, Adobe Acrobat Reader, Adobe Flash Player, Microsoft Office Power Point, Microsoft Office Excel, Google Chrome, Apple QuickTime, Foxit PDF Reader, Sun Java Runtime Environment, Adobe Shockwave Player, ActiveX and etc.. The attackers are also aware of the current world issues and trends. That is why we can see some events like H1n1, death of Michael Jackson, independent day, April Fool and many more events have been abuse by the attacker to phish for their victim.

Lately, within thin 2 months, a few mobile phone vulnerabilities have been found. iPhone, Symbian and Windows Mobile were hooked in these exploits. The attackers not only manage to get sensitive data/info from the mobile device, they also able to take control of the mobile device, and from the recent cases, victim’s mobile phones have been used to send spam SMS, MMS and also Email and at the same time, the SMS, MMS and email sent, work as an agent to ‘invite’ more device to be part of the ‘mobile botnet’ society. Awuuuooo0…

Till next time..

P/S: I am writing this entry while I’m working on my presentation slide for next week presentation in one of the organization of standardization and quality. So, I think these issues need to be highlighted as well in my slides. Beside of trends, the impact also need to be highlighted and ‘how bad is the impact could be’ should also be in part of the slide. The after discussing about the trend and impact, please make this as a habit which is to discuss on the prevention and the mitigation part as well. This is important because leaving the presentation stage without prevention or mitigation steps will create FUD to the audience and this is totally not a good practice!

Review on YMTiny – Free J2ME Yahoo Messenger

Dec
17

Hard to find FREE instant messenger that can support Yahoo Messenger for your mobile devices? Don’t want to pay for commercial product? Now yo have a perfect solution, YMTiny.

YMTiny is a free J2ME Yahoo Messenger. Directly connects to the Yahoo’s server.

Just connect with your Yahoo! ID, no other registration needed.

It should works on all CLDC 1.0 and MIDP 2.0 devices.

Features

  • Settable message alerts: sound (midi), vibrate, flash backlight, open IM window
  • Bitmap fonts for consistent interface
  • “Smart Ping” maintains connection and minimizes bandwidth usage
  • Receives offline messages, new mail and typing notifications
  • Set status and custom status
  • View a friend’s status, show and hide offline friends
  • Send and receive BUZZ!!!
  • Run in background and auto-restore
  • Window and scroll animations
  • Stylus support
  • 54+2 Emoticons!
  • Data counter

Limitations

  • Does not support HTTP/WAP connection yet
  • Minimize function only works on some devices
  • Stylus support is not tested yet
  • Bitmap fonts could be invisible on some devices. Requires devices that support transparancy drawing.
  • Emoticons only works on bitmap fonts
  • Data counter may be inaccurated

Next features

  • Sends typing notifications (settable)
  • More sounds
  • Message archive
  • Conference
  • Skins

YMTiny can be downloaded from YMTiny project’s website and from Getjar.

I have tested YMTiny on 4 devices (Sony Ericsson k750i, HTC P3600i, Nokia 6600 and Nokia 7390) and surprisingly YMTiny work perfectly on those device. But at the same time, YMTiny won’t work on Nokia 6230.

From my opinion, YMTiny v1.1 is even better than IM+ All-in-One Mobile Messenger v4.22 (comparisons has been made on Yahoo! Messenger features only) based on their user friendly features and graphical user interface.


4 stars from xanda.org for YMTiny!

Hopefully one day, the source code for this application will be revealed to public as open source