IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

‘Serious’ Palm Pre and Android security flaws found

Some significant vulnerabilities have been found in Palm Pre and Android devices, a security firm has claimed.

Palm Pre

Some serious security vulnerabilities have been found in Palm Pre devices and Google's Android OS, potentially affecting millions of users, a security company has warned.

A fault in the Palm Pre could allow hackers to gain complete control over the phone's operating system from anywhere in the world, MWR InfoSecurity has claimed.

The hole is opened through the receipt of a specially designed message, allowing attackers to upload a back door and then force the phone to send and record both audio and stored data, MWR said.

The Android vulnerability, a fix for which has been included in the Android 2.2 update, could let hackers gain access to username and password data.

However, MWR confirmed to IT PRO it is not just Android affected by this flaw, as the vulnerability resides in a version of WebKit, which is used to power various mobile web browsers.

Alex Fidgen, director at MWR, said both Google and Palm had been contacted about the holes prior to the security firm going public.

He told IT PRO Google had now fixed the flaw, but claimed Palm had not.

MWR felt it had given enough time to let the companies issue fixes before reporting on the vulnerabilities, Fidgen added.

"In our opinion, smartphones can broadly be considered to be insecure," he said. "There is just too much evidence that security isn't being incorporated by the mobile phone companies into their software."

"We don't think mobile phone companies are really ready to deal with security issues."

Palm did not say whether it was contacted by MWR, as Fidgen had suggested.

The manufacturer had this to say in response to the findings: "Palm takes security very seriously. While we do not comment on specific security enquiries, we do thoroughly investigate any potential security risks brought to our attention."

"We have procedures in place for security researchers to responsibly report risks and we partner with them to make sure any vulnerabilities are addressed and pushed to webOS users via our over the air update system," a Palm statement read.

A Google spokesperson, meanwhile, said the bug is not exclusive to Android as MWR confirmed, and can only be triggered if users go on a malicious website or access a malicious Wi-Fi network on their phone.

"We are not aware of any users having been affected by this bug to date," the spokesperson added.

Fidgen claimed MWR has found other security holes in mobile devices and is currently in contact with vendors about the vulnerabilities.

The firm will disclose more details in the coming months, he added.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Apple executive rejoins Google over remote work policy
flexible working

Apple executive rejoins Google over remote work policy

18 May 2022
Here’s the first look at Google’s new Bay View campus
Business operations

Here’s the first look at Google’s new Bay View campus

17 May 2022
Google offers UK SMBs £87,000 scholarships to boost tech skills
Careers & training

Google offers UK SMBs £87,000 scholarships to boost tech skills

10 May 2022
Google Cloud confirms it is building a dedicated team to support Web3 developers
Cloud

Google Cloud confirms it is building a dedicated team to support Web3 developers

9 May 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022