Registered: Jan 2000
Location:
Posts: 2

There is a vulnerability with network hotsyncs which was reported across the Net today. There is no patch available at this time, but there is a fix:

* left-click on the Hotsync Manager icon in the system tray
* make sure "Network" is NOT selected
* select "setup"
* select the "Network" tab
* uncheck all boxes from the list of users

This will disable network hotsyncs until a patch is available.

For more information on the vulnerability, please see:
http://www.securityfocus.com/vdb/bottom.html?vid=920

Registered: Sep 1999
Location: Texan in Calgary for a while
Posts: 1361

Wouldn't this vulnerability be in all Palm-compatibles, as they all use the same NetHotSync and Desktop?

BTW, Network HotSync wasn't enabled by default on my Visor.

------------------
James Hromadka
VisorCentral.com
Personal Website: http://www.Hromadka.com

Registered: Jan 2000
Location:
Posts: 2

it may be, but the advisory was only posted for Handspring Visors. i don't have a palm to test with, nor do i use network hotsync with my visor. it was disabled (unchecked), but in the setup, it still said that my visor was one of the ones available for that type of sync.

i'm more concerned about the fact that Handspring hasn't posted anything about it. do you think they even know about it?

Registered: Dec 1999
Location:
Posts: 19

I think the vulnerability is only present in the Visor HotSync. I imagine the Hotsync program is modified (notice the "H" at the end of the version #) to allow USB syncs.

Registered: Sep 1999
Location: Texan in Calgary for a while
Posts: 1361

The Palm Desktop is the same accross all PalmOS versions after 3.0 (with a few updates). I had a Palm III and used NetHotSync and it never prompted me for a password. Monachus is correct that someone with the proper information could NetHotSync using your id, but as I said this vulnerability is not specific to the Visor. I think that if you use DHCP you can have your IP address change periodically.
I notified Handspring about the BugTraq post and the issue.

------------------
James Hromadka
VisorCentral.com
Personal Website: http://www.Hromadka.com

Registered: Nov 1999
Location: California
Posts: 108

Just wondering, but even if you know somebody's IP and user name isn't there still the matter of the auto-selected user id number (to look it up, I think it's Shortcut.4). I've heard that this number is used be hotsync instead of the user name to keep track of which palm is which. Just wondering.