Palm Desktop Software Insecure Permissions?????

[Kimmy]

I'm not sure if this is correct: Desktop Software Insecure Permissions????? And Here

[innersafe]

Originally Posted by Kimmy

I'm not sure if this is correct: Desktop Software Insecure Permissions????? And Here

The report is vague compared to the original vulnerability report and news release from Innersafe.

Here are a couple Flash Video clips that demonstrate the vulnerability. It allows Palm Treo private records to be exposed on a PC running common security software like disk encryption:

Flash Video #1 - Palm Password Bypassed on PC

Flash Video #2 - Free Keylogger Attacking Palm Desktop

In other words, synchronizing a Treo with a PC means the data can be exposed by either Palm Desktop or Microsoft Outlook without the password.

Links related to the original news release:

* Outlook Password Recovery - Google

* "More than 80 percent of [55 billion daily] spam now comes from a 'zombie'" - Ironport

* "Three suspects in a Dutch crime ring hacked 1.5 million computers worldwide, setting up a 'zombie network' that secretly stole credit card and other personal data, prosecutors said" - USA Today

* "Even when you encrypt files with Win2K's Encrypting File System (EFS), a file's original unencrypted file data is left on the disk after a new encrypted version of the file is created." - Microsoft Technet

* "Thus, overwriting such a file will not succeed in deleting the
file's contents from the disk." - Microsoft Technet

[skoenig]

It's the classic "chain is as strong as it's weakest link" analysis.

Something everything should bear in mind when they think they're protecting something on their Treo or PC.

Kimmy also posted about the data recovery from old pdas thats a growing issue for firms and individuals alike.

~ Steph