View Full Version : DOS attack vulnerability on Palm discovered!
demannu
05-21-2003, 03:50 PM
I suppose its inevitable that such a newcomer platform to the WWW would have some problems that need to be corrected, but I just found this article @ secunia.com telling of a DOS vulnerability in the Palm OS and it's not being able to handle "a flood of ICMP echo requests". Not that a lot of people would be trying to do this, but it is kinda scary in that they say the solution is a Hard reset! Yikes watch out.
http://www.secunia.com/advisories/8804/
-d
Oh, and we need an angrier looking message icon. I am more than a little frowny about this one.
avega
05-21-2003, 04:30 PM
I'm not worried about this...
rob_squared
05-21-2003, 05:40 PM
I was once worried about being killed by bottle caps but this is ridiculous.
keesercc
05-21-2003, 05:57 PM
sarcasm on *I hear that if you stand on your head and and do a google search for (insert nonesense word here) with netfront on a wifi network in italy, you will have to do a warm reset follwed by a cold bath.... *sarcasm off
keesercc
05-21-2003, 05:59 PM
perhaps you could share with us WHY this is such a problem and worthy of anything more than a frowny? I know lots of regular programs that can cause a hard reset.
keesercc
05-21-2003, 06:03 PM
how real is this threat? do many web pages flood your palm with ICMP requests? does this kind of thing happen often? or are we looking at the same chances of getting struck by lightning. you seem to have some knowledge on this issue, so perhaps you could enlighten us as to what preventative measures we could take, or what to look out for. any info would be appreciated. (the link doesn't provide much information useful to someone who does not understand the nuances of WWW...)
demannu
05-21-2003, 09:05 PM
heheh hey man I just read articles and post them. I really don't know what would cause this in a normal situation, but a DOS attack isn't a normal situation. I would guess that this would only happen by malicious intenet, and if someone wanted to flood you with ICMP requests, they could, as long as you have the CF card turned on, and they are on your local network. Just a warning. Nothing more. I didn't realize that there was a frown and a mad frown. I got the right one. :)
Don't worry for the most part. Unless you are paranoid, then worry, worry a lot.
demannu
05-21-2003, 09:07 PM
*sarcasm on* I now see how keesercc got 116 posts. *sarcasm off...mostly*
hherbzilla
05-21-2003, 09:22 PM
Originally posted by avega
I'm not worried about this... Yeah... If you're worried about this, you have bigger issues. ;)
I'd say this deserves more of a roll your eyes smilie:
:rolleyes:
yep, BACKUP, you can never perform to much of that.
n2ifp
05-21-2003, 09:41 PM
Phew!
I am safe, it says for Palm OS 3.x and 4.x, I have OS 5.x :)
haha, Larry, I'm safe as well... OS 5.x here too! :)
lal2707
05-21-2003, 11:51 PM
Same here - using OS 5.x
Always Backup as often as possible and test recovery process
Homie_S
05-22-2003, 12:16 AM
That statement makes about as much sense as this:
http://www.crappyhosting.com/homie_s/images/Compaq002.jpg
lal2707
05-22-2003, 12:24 AM
For you may be - you would be surprised how many do not backup!
keesercc
05-22-2003, 12:25 AM
Originally posted by demannu
*sarcasm on* I now see how keesercc got 116 posts. *sarcasm off...mostly*
I apologize. Everytime I hit the POST button, I had another thought that I wanted to add. *sigh* I was just to eager to say what I had to say I guess :rolleyes: (and that may have had something to do with it.... ;)
If you are not worried about a DOS attack, why do you have firewalls and antiviruses on your pcs, palms are becoming almost as powefull as pcs on the internet, so naturaly they will be exposed to threats like pcs, i dont think its something to shrug off, while it may not look very important right now it can become.
P.S. A website can be made to flood you with icmp requests, that is probably the most basic form of an attack possible...
Oh and (sorry for posting twice) to all you people who said i have os5 :
1. Of course you have os5, check what forum you are in.
2. os5 probably has the same vulnerability (not sure)
iebnn
05-22-2003, 02:55 AM
Homie_S that is funny.
It's very easy to perform this DOS attack, but the person needs to know your IP and that you're on a Palm. The chances of this are pretty slim unless someone you know does it to you at work or something. And they'd have to know about this vulnerability.
iebnn
05-22-2003, 02:59 AM
Originally posted by keesercc
I apologize. Everytime I hit the POST button, I had another thought that I wanted to add. *sigh* I was just to eager to say what I had to say I guess :rolleyes: (and that may have had something to do with it.... ;)
That;s what "edit" is for
I don't think this is much of a threat, but for people like me that like to nitpick, the article says affected software is OS 3.x and 4.x but it also says "There is no report about whether this is limited to specific versions or all versions of the Palm OS." so this means that OS 5 may be vulnerable. Should we all crap our pants now or later?
avega
05-22-2003, 11:07 AM
maybe later... :P
hherbzilla
05-22-2003, 11:15 AM
Originally posted by hafu
Should we all crap our pants now or later? Uhh, neither.
How often is your PDA wirelessly connected?
Of those times, how often is it connected to an UNTRUSTED network?
Of THOSE times, how likely is it that a MALICIOUS person is also connected and trying to cause a DoS?
Like I said before, if you're seriously worried about this, you have bigger issues to deal with. ;)
Besides, you should be backing up your data for a lot of other reasons anyway.
Unregistered
05-22-2003, 05:07 PM
You have learned a valuable lesson grashopper demannu .
Do not waste your time posting any news even if you think it is noteworthy b/c at least 10 of the regulars will post to tell you that they already knew it, that you are knucklehead for being so foolish as to post such old news and or nonsense.
You are better off emailing or PMing any news to one of the Mods and let them deal with it. Even if people think Mod news is stale they are usually more polite in telling them so.
Watch out for those killer bottlecaps.
rob_squared
05-22-2003, 05:28 PM
Keyboard not detected, press F1 to continue...
Originally posted by keesercc
I apologize. Everytime I hit the POST button, I had another thought that I wanted to add. *sigh* I was just to eager to say what I had to say I guess :rolleyes: (and that may have had something to do with it.... ;)
That's why there is the "Edit" button. :)
Rick 098
05-22-2003, 06:44 PM
Originally posted by Trp
Oh and (sorry for posting twice) to all you people who said i have os5 :
1. Of course you have os5, check what forum you are in.
2. os5 probably has the same vulnerability (not sure)
General=os5?
Originally posted by Rick 098
General=os5?
this thread was originally in the NX forum then moved to general
demannu
05-23-2003, 04:54 PM
It's all good. I can handle some a critic or 10, I've dealt with worse. :)
you TRY to be informitive, and see where it gets you.
-d
SB_Pete
05-24-2003, 09:57 AM
SO THERE!
Unregistered
05-24-2003, 10:05 AM
Guess you will just need to work your way into the elite group of posters first :).
OcellNuri
05-24-2003, 10:24 AM
I thought the link was interesting. It's good to know the technical limitations of the OS we use every day... and usually depend on every day. Does a DOS attack like this affect PCs as well? I have never heard of it before so I don't know. If so, then the danger may not be an attack directed at your Palm, but an attack directed at a PC and your Palm happens to get in the line of fire.
In my opinion, no one in this thread is saying the story should not have been posted. Everyone just wants to get clear what the story is saying, and what the implications are for us PalmOS users. So far, the general consensus has been that there is nothing to worry about. Not that it never should have been brought to our attention. Personally... I appritiate it! I would have never found this on the net myself. Thanks demannu!
P.S.: I'm going to repeat it again to make sure EVERYONE heres it. Backup often! :D
hherbzilla
05-24-2003, 10:46 AM
Originally posted by OcellNuri
...In my opinion, no one in this thread is saying the story should not have been posted. Everyone just wants to get clear what the story is saying, and what the implications are for us PalmOS users. So far, the general consensus has been that there is nothing to worry about. Not that it never should have been brought to our attention. Personally... I appritiate it! I would have never found this on the net myself. Thanks demannu!
P.S.: I'm going to repeat it again to make sure EVERYONE heres it. Backup often! :D Thanks, Ocell, for helping put things in perspective.
backup backup! Backup! BACKUP!
vBulletin v3.0.3, Copyright ©2000-2012, Jelsoft Enterprises Ltd.