WebOS: Six Attacks, One Sausage

This video will showcase vulnerabilities within the SMS application of the WebOS mobile platform released by Palm for their next generation devices (Palm Pre and Pixi). In WebOS, Palm wanted to design a platform what was very easy to develop on, and feature a revolutionary UI design that would hopefully make users abandon the competition. Apparently, Palm designers were also smitten by a very popular web application design technology, AJAX. Leveraging these two ideals, Palm designed their WebOS operating system to act as a web browser. Mobile WebOS applications are built very similar to how a website would be created for a standard web browser. Thus, the new design allows web developers to quickly build and deploy applications for WebOS. However, this also now introduced common web application vulnerabilities to the mobile application space.

http://intrepidusgroup.com/insight/2010/04/webos-examples-of-sms-delivered-in...

Category:

Science & Technology

Tags:

• webos
• palm
• html
• injections
• computer
• security

[intrepidusgroup]

Thanks for the comments. Some of them have been quite entertaining. We weren't expecting everybody to "get it" but glad some did. It's funny to get grief about releasing something that is "known" -- how do you people think it became known in the first place? So next time, (just to be clear) you think we should release the video and let the vendor find it on their own? That's a dick move, and it's not how our general liability policy works. Thank you come again!

[nanosman1994]

i have a palm pre and luky its fine . thanks for showing this ans WTF IS UP WITH YOU USING A SAUSAGE INSTEAD OF A FINGER TO TOUCH YOUR PHONE

[intrepidusgroup]

@nanosman1994 - You would have to share a few beers with us to understand.. we have a horrible sense of humor. You put some geeks in a room, with some beer, and a capacitive screen that responds to the body's electrostatic field.. and naturally you say "I wonder how conductive this sausage is. (ok.. i guess you would have had to have been there)

[junkTzu]

You guys are idiots, try finding vulnerabilities on the CURRENT version of the phone's OS. This demonstration is about as useful as a hack on an unpatched version of Windows XP.

[Robindahoodz]

And how the fuck do you guys send sms through damn fkin terminal...thats only supposed to be available for gsm devices. Unless you guys connect it through a network but then again thats a different story

[andrewhime]

@diablokev87 *blink blink* Such amazing logic on display around here.

[andrewhime]

@nullr1 People who disable updates open themselves up to this vulnerability by choice. It takes a lot of work to do and serves little purpose, as 1.4 was the Holy Grail of webOS. So I'd say there's maybe 10 people out there tops still on 1.3.5.

[nullr1]

You guys should do some testing on the command line. I noticed every terminal app automatically logs in as root rather than having you sudo from a privileged user. This means the GUI is running on root which is a stupid thing to do. The only user before installing optware is root which means root handles every phone task which means if they get into the terminal the whole phone is automatically compromised specially since the CLI has so much power in this phone.

[nullr1]

@andrewhime

That was my point. People disable updates. Right now there really is no reason to be on 1.3.5 as mobile hotspot and video recording are are 1.4.1.1 but just because the majority does not have it does not mean everyone. Would you rather have them make a video and inform Palm and get this fixed or sell the exploits to someone who can possibly use it on you? Im not saying the exploits are of much use anymore im just saying they are a necessary part of testing security.

[andrewhime]

@nullr1 Who is still using 1.3.5? webOS forces updates after 7 days. 1.4 came out on February 26th. Find me a person who has 1.3.5 that didn't specifically hack their phone to keep it.

[nullr1]

So much hate people still use 1.3.5. A video like this lets PALM know that people are actively hacking a device meant for secure business. A vulnerability so simple is just unacceptable and this needs to be fixed asap. They did not claim that they would hack every pre just opening PALM's eyes. This video might have helped your phone have 6 less vulnerabilities and for that I thank you. If security is never tested no need to correct mistakes and when someone does test it makes it so much worse.

[nullr1]

@junkTzu

This what your phone was vulnerable too not that long ago. There are many more that they did not show. I like webos because it has great cli you can literally launch any app from the command line. You can even call or send a text message. Look at how much control you have.

webos-internals(dot)org/wiki/L­una_Send

The problem is that security should come up specially from executing code from sms or email. Video shows that security needs to be ramped up and its working.

[andrewhime]

@intrepidusgroup My opinion is that there may be fifteen and a half angels in the room with you right now. I'd like to see someone try to argue with that!

[deihmos]

You calls these hacks? Pathetic. No one is using 1.3.5 either.