An SMS can force a URL or app on smartphones CNET News
LAS VEGAS--In one of a handful of SMS-related presentations here at the Black Hat security show, researchers demonstrated on Thursday how they can force certain types of smartphones to visit a malicious URL or install an app without user approval.
The vulnerability only affects phones that have been misconfigured by the original equipment manufacturer so that they accept any message sent through WAP Push (Wireless Application Protocol), a service that runs on top of SMS, said researcher John Hering.
WAP Push messages should only be accepted when sent by a trusted party such as the mobile operator, said Hering, chief executive of Flexilis, which provides software for protecting mobile phones from attack.
The vulnerability spans all Windows Mobile devices including HTC, Motorola, and Samsung, he said. The phones that are vulnerable have been misconfigured and it's random which ones have the weakness.
Phone owners can test their phone to determine if they are affected by the issue. Hering and Kevin Mahaffey, Chief Technology Officer at Flexilis, are releasing a free tool that can be used to test whether a mobile phone is vulnerable, and if so fix the issue.
![Samsung DUOS TOUCH SCH W299 & W 256 with Tata Indicom Free Offer CellBharat (blog)]("http://nt2.ggpht.com/news/tbn/7qnAW7oDvWspGM/6.jpg")
CellBharat (blog)Samsung DUOS TOUCH SCH W299 & W 256 with Tata Indicom Free OfferCellBharat (blog)Samsung Duos 256 is also a Dual SIM “Over Market Handset” (OMH) which supports all CDMA and GSM mobile networks. Samsung Duos 256 SCH W256 mobile phone and more »
![Samsung SGH-T139 gray (T-Mobile) CNET]("http://nt1.ggpht.com/news/tbn/GZO2Ttm46n2cmM/6.jpg")
CNETSamsung SGH-T139 - gray (T-Mobile)CNETThe bottom line: The Samsung SGH-T139 doesn't promise much, but it serves its purpose as a low-end phone for making calls. Samsung's new SGH-T139 for