Re: Possible security hole for Dialers/troyan horses

2007-03-05 Thread Bartłomiej Zdanowski DRP AC2
Tim Newsom napisał(a): On Fri, 2 Mar 2007 6:09, Evgeny wrote: It still Linux based phone — there is absolutely no real-life viruses for Linux at this time, trojans are possible treat, but user have to install them by himself. That's a pretty strong statement.. Are you absolutely sure there

Fw: Re: Possible security hole for Dialers/troyan horses

2007-03-05 Thread Tim Newsom
Sorry, got caught in the reply to issue. -Original Message- From: Tim Newsom [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: Possible security hole for Dialers/troyan horses Date: Mon, 5 Mar 2007 7:02:58 -0800 On Mon, 5 Mar 2007 0:05, Evgeny wrote: On Fri, 2007-03-02 at 07:35

Re: Possible security hole for Dialers/troyan horses

2007-03-04 Thread Evgeny
On Fri, 2007-03-02 at 07:35 -0800, Tim Newsom wrote: On Fri, 2 Mar 2007 6:09, Evgeny wrote: It still Linux based phone — there is absolutely no real-life viruses for Linux at this time, trojans are possible treat, but user have to install them by himself. That's a pretty strong

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Bartłomiej Zdanowski DRP AC2
Martin Raißle napisał(a): On 3/2/07, Jonathon Suggs [EMAIL PROTECTED] wrote: In combination of what was said before - the virus scanner - we could maybe use a database of application hashes, so not every app has to be configurated but only those that are not found in the database, maybe this

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Martin Raißle
On 3/2/07, Bartłomiej Zdanowski DRP AC2 [EMAIL PROTECTED] wrote: It has to be as simple as possible. That's why I think this is a good solution .. users don't have to think about everything but only the problems, openmoko cannot solve. Of course a scanner will slow down the thing a bit and

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Evgeny
On Fri, 2007-03-02 at 10:19 +0100, Bartłomiej Zdanowski DRP AC2 wrote: I'm afraid that you're going a bit too far. I thought about making costs with illegal calls and smses. Virus protection should appear only when viruses appear. It still Linux based phone — there is absolutely no real-life

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Joe Pfeiffer
Aloril writes: Fortunately in Linux usually to be able to run executable arriving in email you need to do following: 1) Save file to disk 2) chmod +x that_file (or equivalent in GUI) 3) run_that_file That's only because Linux MUA's typically don't implement the 'run directly from the message'

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Tim Newsom
On Fri, 2 Mar 2007 6:09, Evgeny wrote: It still Linux based phone — there is absolutely no real-life viruses for Linux at this time, trojans are possible treat, but user have to install them by himself. That's a pretty strong statement.. Are you absolutely sure there are no viruses for

Re: Possible security hole for Dialers/troyan horses

2007-03-02 Thread Todd W
From: Bartlomiej Zdanowski AutoGuard Ltd. Todd W napisał(a): I don't understand why people think this. I haven't ran in to a phone yet that I couldn't run my own apps on. A particular account may not have the proper level of network access, but that has nothing to do with the capabilities of

Possible security hole for Dialers/troyan horses

2007-03-01 Thread Bartlomiej Zdanowski AutoGuard Ltd.
Hello. While thinking of antythieft protection we came to some ideas about sending smses with stolen phone GPS coords. There were some ideas about silent voice calls with message that the phone is stolen. (for details see thread Itch3: Anti-lost/theft protection). But at this point we came to

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Krzysztof Kajkowski
2007/3/1, Bartlomiej Zdanowski AutoGuard Ltd. [EMAIL PROTECTED]: THAT IS THE PROBLEM. Bigger than phone theft. That's why commercial phone manufacturers don't allow to access all the phone for java apps. To disallow hidden calls and smses. IMHO this is not main reason why commercial

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Bartłomiej Zdanowski DRP AC2
Krzysztof Kajkowski napisał(a): 2007/3/1, Bartlomiej Zdanowski AutoGuard Ltd. [EMAIL PROTECTED]: THAT IS THE PROBLEM. Bigger than phone theft. That's why commercial phone manufacturers don't allow to access all the phone for java apps. To disallow hidden calls and smses. We have similiar

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Martin Raißle
On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to enable user to protect itself. The question is how to do that? What do you think? First off all I think that there are good chances for a trojan, even

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
Martin Raißle wrote: On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to enable user to protect itself. The question is how to do that? What do you think? First off all I think that there are good

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Steven **
Sounds like Windows Vista. ABC_Trojan has requested to send an SMS message. Allow or Deny? -Steven On 3/1/07, Martin Raißle [EMAIL PROTECTED] wrote: On 3/1/07, Krzysztof Kajkowski [EMAIL PROTECTED] wrote: However there might be such attempts to create GSM trojans and we should be aware to

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Todd W
From: Bartlomiej Zdanowski AutoGuard Ltd. While thinking of antythieft protection we came to some ideas about sending smses with stolen phone GPS coords. There were some ideas about silent voice calls with message that the phone is stolen. (for details see thread Itch3: Anti-lost/theft

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread kkr
Le jeudi 01 mars 2007 à 09:48 -0600, Jonathon Suggs a écrit : snip Isn't this something along the lines of SELinux? If that is the case, is that something we should look at implementing? snip As I understood SELinux, it would be a good tool for security. Many (or most) other (close) Linux

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
kkr wrote: Le jeudi 01 mars 2007 à 09:48 -0600, Jonathon Suggs a écrit : snip Isn't this something along the lines of SELinux? If that is the case, is that something we should look at implementing? snip As I understood SELinux, it would be a good tool for security. Many (or most)

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread mathew davis
Here are a few options that I have thought of. What if there was a peice of software that was like an emulator that would run the binary on your computer before you uploaded it to your phone. That would to catch certain security flags, or potentially undesired behavior, letting the user know

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Tomasz Zielinski
2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize difference between rating 2 and 3 or 6 and 7. I think set

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Tim Newsom
On Thu, 1 Mar 2007 14:42, Tomasz Zielinski wrote: 2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Jonathon Suggs
Tomasz Zielinski wrote: 2007/3/1, mathew davis [EMAIL PROTECTED]: then give it a rating of some sort 1 - being safe/trusted program and 10 - being known bad binary/ don't use at any cost unless you really want bad things to happen. Well, nobody will recognize difference between rating 2 and

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Martin Raißle
On 3/2/07, Jonathon Suggs [EMAIL PROTECTED] wrote: I really like that idea. That could be a standard part of EVERY installed app (outside of trusted OpenMoko apps). Just one more step in helping users not shoot themselves in the foot. In combination of what was said before - the virus

Re: Possible security hole for Dialers/troyan horses

2007-03-01 Thread Aloril
On Thu, 2007-03-01 at 13:38 -0500, Todd W wrote: That's the problem with malware in general. You can't engineer stupidity out of your users. Fortunately in Linux usually to be able to run executable arriving in email you need to do following: 1) Save file to disk 2) chmod +x that_file (or