Possible security hole for Dialers/troyan horses

2007-03-01 Thread Bartlomiej Zdanowski AutoGuard Ltd.
Hello. While thinking of antythieft protection we came to some ideas about sending smses with stolen phone GPS coords. There were some ideas about silent voice calls with message that the phone is stolen. (for details see thread Itch3: Anti-lost/theft protection). But at this point we came to

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Krzysztof Kajkowski
2007/3/1, Bartlomiej Zdanowski AutoGuard Ltd. [EMAIL PROTECTED]: THAT IS THE PROBLEM. Bigger than phone theft. That's why commercial phone manufacturers don't allow to access all the phone for java apps. To disallow hidden calls and smses. IMHO this is not main reason why commercial

Some ideas

2007-03-01 Thread Wolfgang Silbermayr
Hi Openmoko List! I have been following the progress of openmoko and I really love how things are going. As far as I can tell now, I will order the Neo as soon as it is available. Here are some ideas that I would really love to see in openmoko: == Real-time switching of audio sources and sinks

Neologics

2007-03-01 Thread Sean Moss-Pultz
Dear Community, For those of you who couldn't make it FOSDEM or Etel, I've posted our presentation here: http://www.openmoko.com/files/OpenMoko_Neologics.pdf Happy reading! -Sean ___ OpenMoko community mailing list community@lists.openmoko.org

Re: Neologics

2007-03-01 Thread denis
Sean Moss-Pultz schrieb: Dear Community, For those of you who couldn't make it FOSDEM or Etel, I've posted our presentation here: http://www.openmoko.com/files/OpenMoko_Neologics.pdf Happy reading! -Sean ___ OpenMoko community mailing list

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Bartłomiej Zdanowski DRP AC2
Krzysztof Kajkowski napisał(a): 2007/3/1, Bartlomiej Zdanowski AutoGuard Ltd. [EMAIL PROTECTED]: THAT IS THE PROBLEM. Bigger than phone theft. That's why commercial phone manufacturers don't allow to access all the phone for java apps. To disallow hidden calls and smses. We have similiar

Re: FOSDEM OpenMoko talk now on video.google.com

2007-03-01 Thread Steven **
I added the price breakdown from the presentation to the Wiki: http://wiki.openmoko.org/wiki/FAQ#Q:_How_much.3F -Steven On 2/27/07, Igor Foox [EMAIL PROTECTED] wrote: On 2/26/07, Rod Whitby [EMAIL PROTECTED] wrote: Ole Tange wrote: I had hoped there was video coverage of the event. When I

Re: FOSDEM OpenMoko talk now on video.google.com

2007-03-01 Thread Ian Stirling
Steven ** wrote: I added the price breakdown from the presentation to the Wiki: http://wiki.openmoko.org/wiki/FAQ#Q:_How_much.3F I uploaded to rapidshare http://rapidshare.com/files/18781887/rect.avi which is a better encoding of the video - 66M, but with most of the larger text visible.

'My Account' - a way to store information about the phones owner, so they can be reunited if it's lost.

2007-03-01 Thread Ian Stirling
http://wiki.openmoko.org/wiki/My_Account is an overview of some ideas. Briefly, a way for anyone with the phone to access a history of the phone (bought/sold status, reported as stolen, ...), a way for the user to set these as well as contact information for people to return the phone in some

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Martin Raißle
On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to enable user to protect itself. The question is how to do that? What do you think? First off all I think that there are good chances for a trojan, even

Re: 'My Account' - a way to store information about the phones owner, so they can be reunited if it's lost.

2007-03-01 Thread Gabriel Ambuehl
On Thursday 01 March 2007 13:52:16 Ian Stirling wrote: Briefly, a way for anyone with the phone to access a history of the phone (bought/sold status, reported as stolen, ...), a way for the user to set these as well as contact information for people to return the phone in some way. Thoughts?

Re: Itch3: Anti-lost/theft protection

2007-03-01 Thread Christian T.
Attila Csipa wrote: Only if the thief actually sets up SMS (if his SIM is of a different provider, the service center likely needs to be changed). I have one unlocked phone and I'm changing between two SIMs (different providers) and somehow it seems to configure that automagically. I guess,

Re: Itch3: Anti-lost/theft protection

2007-03-01 Thread Gabriel Ambuehl
On Thursday 01 March 2007 14:20:32 Christian T. wrote: I have one unlocked phone and I'm changing between two SIMs (different providers) and somehow it seems to configure that automagically. I guess, the configuration is on the SIM. It's like that for all Austrian providers i tried. So at

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
Martin Raißle wrote: On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to enable user to protect itself. The question is how to do that? What do you think? First off all I think that there are good

Re: Bluetooth Headset - Voice Commands

2007-03-01 Thread Jonathon Suggs
Mike Hodson wrote: On 2/28/07, Jonathon Suggs [EMAIL PROTECTED] wrote: The reason that I ask is that on my PocketPC phone (iMate PDA2K), there is supposedly a hardware limitation that will not allow for this to occur. It can have the bluetooth headset button initiate the program, but it

Re: A new approach to Re: Itch3: Anti-lost/theft protection -THE REAL PROBLEM APPEARED!

2007-03-01 Thread Attila Csipa
On Thursday 01 March 2007 08:41, you wrote: later someone will write a Troyan Horse, some king of dialer (like for application made calls and sent smses. Openmoko kernel should log any What do you think? There are two sides to this problem - one, the origin of software. This has actually

Re: Itch3: Anti-lost/theft protection

2007-03-01 Thread Attila Csipa
On Thursday 01 March 2007 14:20, Christian T. wrote: Attila Csipa wrote: Only if the thief actually sets up SMS (if his SIM is of a different provider, the service center likely needs to be changed). I have one unlocked phone and I'm changing between two SIMs (different providers) and

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Steven **
Sounds like Windows Vista. ABC_Trojan has requested to send an SMS message. Allow or Deny? -Steven On 3/1/07, Martin Raißle [EMAIL PROTECTED] wrote: On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to

Re: FOSDEM OpenMoko talk now on video.google.com

2007-03-01 Thread kkr
Le jeudi 01 mars 2007 à 12:45 +, Ian Stirling a écrit : snip I uploaded to rapidshare http://rapidshare.com/files/18781887/rect.avi which is a better encoding of the video - 66M, but with most of the larger text visible. With the screen and a little bit to the right of it only. snip Why

Re: Itch3: Anti-lost/theft protection

2007-03-01 Thread Paul Wouters
On Wed, 28 Feb 2007, Wolfgang S. Rupprecht wrote: Personally I like the idea of periodic SMS messages with the lat/lon/altitude. When in stolen mode, having the phone receive SMS msgs containing commands for the phone would seem to be very useful. The first thing that happens to a stolen

Re: A new approach to Re: Itch3: Anti-lost/theft protection

2007-03-01 Thread adrian cockcroft
I would like to include an accelerometer in a phone design (my own homebrew design or a future Neo perhaps?), then all the Nintendo Wii style interactions become possible. If my phone is locked it asserts that it should be at rest, if someone picks it up it needs a code or a secret gesture on

Re: 'My Account' - a way to store information about the phones owner, so they can be reunited if it's lost.

2007-03-01 Thread Paul Wouters
On Thu, 1 Mar 2007, Ian Stirling wrote: http://wiki.openmoko.org/wiki/My_Account is an overview of some ideas. Briefly, a way for anyone with the phone to access a history of the phone (bought/sold status, reported as stolen, ...), a way for the user to set these as well as contact

Re: FOSDEM OpenMoko talk now on video.google.com

2007-03-01 Thread Jonathon Suggs
kkr wrote: Why not use an open format (.ogg) rather than proprietary one (.avi)? Regards, Really not trying to start a fight here. But more players support avi than ogg. Therefore I agree with the choice. Open formats and standards are great when they stand on their own merits. Not

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Todd W
From: Bartlomiej Zdanowski AutoGuard Ltd. While thinking of antythieft protection we came to some ideas about sending smses with stolen phone GPS coords. There were some ideas about silent voice calls with message that the phone is stolen. (for details see thread Itch3: Anti-lost/theft

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread kkr
Le jeudi 01 mars 2007 à 09:48 -0600, Jonathon Suggs a écrit : snip Isn't this something along the lines of SELinux? If that is the case, is that something we should look at implementing? snip As I understood SELinux, it would be a good tool for security. Many (or most) other (close) Linux

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
kkr wrote: Le jeudi 01 mars 2007 à 09:48 -0600, Jonathon Suggs a écrit : snip Isn't this something along the lines of SELinux? If that is the case, is that something we should look at implementing? snip As I understood SELinux, it would be a good tool for security. Many (or most)

MokoMakefile network problem?

2007-03-01 Thread Wil Chung
Hi all, I spent the afternoon reading through the new wiki and trying to install openembedded on my machine, mostly to try and compile a demo. I didn't realize I didn't need to build openmoko from scratch to compile the demos, so I dabbled in using MokoMakefile I followed the instructions

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread mathew davis
Here are a few options that I have thought of. What if there was a peice of software that was like an emulator that would run the binary on your computer before you uploaded it to your phone. That would to catch certain security flags, or potentially undesired behavior, letting the user know

Matchbox panel 2 not installed

2007-03-01 Thread Wil Chung
So in attempts to get the demos up and running, I found out that I can just svn the openmoko tree. I installed the prerequisites from openembedded website (http://www.openembedded.org/wiki/OEandYourDistro) I then checked out version 1003 from http://svn.openmoko.org/trunk And then I followed

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Tomasz Zielinski
2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize difference between rating 2 and 3 or 6 and 7. I think set

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Tim Newsom
On Thu, 1 Mar 2007 14:42, Tomasz Zielinski wrote: 2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
Tomasz Zielinski wrote: 2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize difference between rating 2 and

Re: FOSDEM OpenMoko talk now on video.google.com

2007-03-01 Thread Ian Stirling
kkr wrote: Le jeudi 01 mars 2007 à 12:44 -0600, Jonathon Suggs a écrit : kkr wrote: Why not use an open format (.ogg) rather than proprietary one (.avi)? It was not a criticism, only a question! If you felt it as such a criticism, I'm sorry... If I've asked it, it's only: - FOSDEM use too

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Martin Raißle
On 3/2/07, Jonathon Suggs [EMAIL PROTECTED] wrote: I really like that idea. That could be a standard part of EVERY installed app (outside of trusted OpenMoko apps). Just one more step in helping users not shoot themselves in the foot. In combination of what was said before - the virus

Re: 'My Account' - a way to store information about the phones owner, so they can be reunited if it's lost.

2007-03-01 Thread Ian Stirling
Paul Wouters wrote: On Thu, 1 Mar 2007, Ian Stirling wrote: http://wiki.openmoko.org/wiki/My_Account is an overview of some ideas. Briefly, a way for anyone with the phone to access a history of the phone (bought/sold status, reported as stolen, ...), a way for the user to set these as well

Re: MokoMakefile network problem?

2007-03-01 Thread Rod Whitby
Wil Chung wrote: Hi all, I spent the afternoon reading through the new wiki and trying to install openembedded on my machine, mostly to try and compile a demo. I didn't realize I didn't need to build openmoko from scratch to compile the demos, so I dabbled in using MokoMakefile I

Re: 'My Account' - a way to store information about the phones owner, so they can be reunited if it's lost.

2007-03-01 Thread Paul Wouters
On Thu, 1 Mar 2007, Ian Stirling wrote: Reflashing never gets you back a different account number, it keys off the IMEI, which is not flashable. (well, perhaps it is, but it's not flashable from the linux side, and AIUI, nobody else knows how at the moment.) I really hope the IMEI number is

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Aloril
On Thu, 2007-03-01 at 13:38 -0500, Todd W wrote: That's the problem with malware in general. You can't engineer stupidity out of your users. Fortunately in Linux usually to be able to run executable arriving in email you need to do following: 1) Save file to disk 2) chmod +x that_file (or