From: Bob Beringer (Bob.Beringer@usa.net)
Date: Mon Jul 03 2006 - 14:06:23 EDT
Peter,
Many of WM5's vulnerabilities depend on the loaded applications and the AKU
/ build version of the running OS. Prior to standardizing on a specific
assessment methodology, you should ensure that your plan of action is
specific to the device(s) that you are evaluating.
You should also become familiar with the WM5 registry, many of the default
settings are not as secure as they could be, products like the
"Tweaks2k2.Net" help to address some security configurations and adjust
levels of functionality for the device.
The folks at "AirScanner" make some very interesting products. The firewall
application, shows that enhanced network connectivity and secure rulesets
are possible.
Here is a helpful link to some of their products:
http://www.airscanner.com/products.html
In addition to the tools mentioned above, CA and other companies have
started to build AV solutions for WM5, which underscores the fact that it is
now becoming commercially viable companies to add additional layers of
security for WM5 and other modern PDA based OS's.
As you look into the .Net Framework for WM5, you will see that it allows for
custom applications to be easily written, for trojans to run without much
effort, and conversely WM5 allows for a myriad of security assessment tools
to be run as well.
Hope this helps...
v/r
Bob
-----Original Message-----
From: sf@securax.dk [mailto:sf@securax.dk]
Sent: Friday, June 30, 2006 5:41 AM
To: pen-test@securityfocus.com
Subject: Windows Mobile 5.0
Importance: High
Hey all,
I'm working on a security assessment of Windows Mobile 5.0 on a Qtek 9100
smartphone and would like to know if there is any week points and issues
that I should know about.
Anybody tested/worked with Windows Mobile 5.0? Done any pen-tests? Any
whitepapers? All is welcome. 8)
Thanks.
/Peter
----------------------------------------------------------------------------
-- This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request@cenzic.com for details. ---------------------------------------------------------------------------- -- ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request@cenzic.com for details. ------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:12 EDT