ErikMosier
Member
Registered: Dec 1999
Location: USA
Posts: 3 |
Watch out for the network hotsync...
Post from rootshell follows:
[ http://www.rootshell.com/ ]
Date: Wed, 5 Jan 2000 19:55:45 -0600
From: Jay C Austad <[email protected]>
Subject: Handspring Visor Network HotSync Security Hole
If you have Network HotSync (provided on the CD that comes with your Visor)
enabled on your machine, and a malicious user knows your name (ex. John
Smith), and the ip of your machine (ex. 192.168.22.22, or
jsmith.company.com), he can change the name on his Visor to yours, do a
Network hotsync with your ip, and download all of your email, send email as
you, and perform any function that you can.
There is no password or authentication of any kind. If I wanted to read my
co-workers email, or send a nasty message from him to his boss, all I would
need to do is put his name into my visor (Jim Beam), and do a network sync
to jbeam.company.com.
---
I tried it out on my co-worker, and this does work. I found it rather useful.
|