Several cell phones produced by Sony Ericsson Mobile
Communications are vulnerable to denial-of-service attacks, two
security companies reported this week.
The flaw is found in four models of Sony Ericsson phones and comes
from an error in their Bluetooth service, according to the French
Security Incident Response Team, or FrSIRT.
The Bluetooth "fails to properly handle malformed L2CAP (Logical
Link Control and Adaptation Layer Protocol)," FrSIRT, a
France-based security company, said in an advisory posted on its
Web site.
Danish security firm Secunia reported the same flaw, and both
companies have rated the potential security risk as low. Thomas
Kristensen, Secunia's chief technology officer, said that someone
intent on knocking out one of the four Sony Ericsson phones, which
includes the K600i and T68i, would need only to get within 50 feet
while carrying a handheld device configured to send the malicious
code via Bluetooth. The code would crash the phone.
"I don't think the phone's user would even know the attack occurred
until they tried to use their phone again," Kristensen said.
The good news is that damage would be minimal. Once the phone was
turned off and restarted, it would function normally again,
Kristensen said.
None of the Sony Ericsson phones in question is sold in North
America, according to Sony representatives in the United
States.
"Sony Ericsson believes that the possibilities to exploit the Sony
Ericsson products mentioned are very limited," company spokeswoman
Cherie Gary said in an e-mail. "However, if you are concerned, you
can help prevent access to the phone by switching off the
'discoverable' mode in the Bluetooth settings of the phone. This
makes the phone invisible to others and thereby minimizes the risk
of being accessed."
Gary said she is waiting to learn more details from Sony Ericsson
engineers in Sweden who would have more information.
While this specific vulnerability may be low-risk, Kristensen
cautioned that these kinds of vulnerabilities in cell phones are a
growing concern in the security community. Conceivably, hackers
could pilfer information from cell phones one day if the handsets
aren't provided with the right security measures.
So far, cellular users have only had to worry about mobile phone
viruses, which are still very rare. In October, Nokia tapped
Symantec to help secure its mobile phones from viruses that target
certain kinds of handsets. Experts don't expect a fast-spreading
cell phone virus to strike for two more years.
http://asia.cnet.com/reviews/mobilephones/0,39050603,39310725,00.htm
