top | item 3660244

How a Web Link Can Take Control of Your Phone

29 points| mdariani | 14 years ago |technologyreview.com | reply

9 comments

order
[+] ge0rg|14 years ago|reply
TL;DR: some guys bought a bunch of WebKit zero-days, gained root on an Android 2.x device, installed a surveillance app and demoed it at RSA conf.

It would be nice to get hold of some more of the technical details involved.

[+] jacquesm|14 years ago|reply
It would have been nicer still if they had helped to patch the holes in WebKit after showing their demo.
[+] ajray|14 years ago|reply
Maybe I'm not sure about how tech-savvy most people are, but when I get a text message from an unknown number claiming to be my provider asking me to click a web link to update my phone, I know something's up.
[+] prof_hobart|14 years ago|reply
It doesn't have to be an unknown number. Certainly in the UK, it's pretty easy to send an SMS with any name (text or number) you want in place of the phone number. And I suspect that most people aren't that tech-smart to realise that a text claiming to be from T-Mobile isn't actually from them.
[+] Cieplak|14 years ago|reply
I'm curious if they used any Flash exploits in addition to the webkit vulnerabilities.