Subject: [NEXTEL-1] Security flaw may threaten cell phones / Flaw may threaten Orange SPV

From: Marcel <[email-masked]>
Date: Thu, 16 Jan 2003 13:42:21 -0500

Flaw may threaten Orange SPV

Microsoft and U.K. carrier Orange are investigating a rumor that hackers are sending
unwanted
software to Orange's SPV, a handset that uses Microsoft's Smartphone 2002 software. The
SPV is
currently the only commercially used handset that uses Microsoft's phone OS. According to
inside
sources, most SPV users will not know if their handset has been hacked. To launch the
hidden
programs, user must first unlock their phones, a process that often involves removing key
hardware inside the device. So far, no SPV users have complained that their phones have
been
damaged or rendered unusable.

Security flaw may threaten cell phones

By Ben Charny
Staff Writer, CNET News.com
January 15, 2003, 12:21 PM PT

Microsoft and U.K. carrier Orange are investigating whether hackers are sending
rogue software to cell phones using Microsoft's Smartphone 2002 operating system.

Instructions about avoiding the security catches inside the smart phone, which Orange
sells
and calls the SPV, were made public the last few days, Orange spokesman Stuart Jackson
said Wednesday. The SPV is the only wireless device on sale that uses Microsoft's
operating
system for advanced phones.

A source familiar with the situation said most SPV owners won't know whether they have
been
affected. To launch the rogue programs, an SPV owner will have to know how to "unlock" a
cell
phone, a difficult process that sometimes involves taking the phone apart. "It's not
something
that my granny is about to do," said the source who requested anonymity.

Microsoft's Security Response
Center, the team that looks into
security vulnerabilities affecting
the company's products, began
"thoroughly investigating the
issue" on Tuesday, according to
a Microsoft representative. The
investigation is ongoing.

"At this point, we feel speculating
on the issue while the
investigation is in progress will be
irresponsible and
counterproductive," the
representative said.

Orange is joining the
investigation, Jackson said. But
so far, there have been no reports
of damaged phones.

"Orange takes these reports very seriously," he said. "Orange and Microsoft are working
together to investigate this issue. Until the outcome of that investigation is known, we
are not
in a position to comment any further."

The possibility of rogue software flooding through cell phone networks is among the worst
fears
that carriers have, said Alan Reiter, an analyst with consulting company Wireless Internet
&
Mobile Computing. Cell phone networks became vulnerable to such attacks when carriers
began selling phones that can download software and games, ring tones and business tools
became available for download, he said.

"Carriers will have to offer as many different applications from as many different vendors
and
make downloading as easy as possible," Reiter said. "But the easier it is to transmit and
receive data, the more likely it is to get a virus or some rogue code."

To his knowledge, however, no one has accomplished on cell phones anything that even
compares to the virus attacks that often cripple computer networks. "Obviously, the
carriers
can't stand this happening," Reiter said. But it's only a matter of time, he added.

http://www.cnn.com/2003/WORLD/meast/01/16/sproject.irq.wrap/index.html

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/