Palm OS Treo Vulnerability: Find Feature Information Disclosure - Page 2

dkirker · 02/15/2007, 09:01 PM

No. Blazer flushes its webpage cache, not the system dbcache. The webpage cache is stored in a database.

vMAC · 02/15/2007, 09:19 PM

This says the vulnerability allows searching of SMS messages? How? I can't do that from the find tool.....

dkirker · 02/15/2007, 09:23 PM

That I am not sure. I have not checked to see what apps are affected.

gtwo · 02/15/2007, 09:24 PM

Quote:

Originally Posted by dkirker

No. Blazer flushes its webpage cache, not the system dbcache. The webpage cache is stored in a database.

Hey D,

Did you see the issues I posted in post #20?

Cheers, Perry

dkirker · 02/15/2007, 09:28 PM

Just saw it. Thanks. I will keep looking into this. I had some similar issues...

dkirker · 02/15/2007, 09:35 PM

I'll have a fix in a couple of hours (going to be on the road soon, heading home from college for the weekend). I know how to replace this.

bclinger · 02/15/2007, 11:02 PM

As a note, I downloaded/installed Warden and was able to get around its security lockout three times, so frankly it is not at all secure. The way I worked around it: TakePhone is installed and it is set to take control of the device after a phone call and that is exactly what it did and upon it taking control, the device was ready to use. TealLock prevents that.

Ben

dkirker · 02/15/2007, 11:03 PM

Ok, here is the new build! This should six the issue that Perry pointed out. Please delete the previous version!

dkirker · 02/15/2007, 11:08 PM

Some other security/find button replacement apps (like Genius) do the same thing as my fix. It is probably a good idea to place my fix on the device anyway. That way you don't need to worry about whether or not your favorite app is susceptible to this flaw.

Basically all this fix does is sit and listen for the find key being pressed, then when it is pressed it checks to see if the device is locked, if it is, it stops the key from making it to the system.

Rob_T · 02/15/2007, 11:34 PM

Just tried it on the Sprint 700P. It seems to be working great, thanks!

gtwo · 02/15/2007, 11:47 PM

Deleted first version . . . .
Installed second version . . .
Prior issues detailed have not re-occurred
So far, so good.

Cheers, Perry

dkirker · 02/15/2007, 11:48 PM

I like how I misspell things..

This version removes a couple lines of code (makes file a few bytes smaller, and a minutely bit faster, unnoticeable to the human), and fixes the name (should have been SecurityLockFindFix and not SecuritLockFindFix).

Please delete the older version.

This should be the last update, unless there are any bugs.

dkirker · 02/15/2007, 11:49 PM

Quote:

Originally Posted by Perry Holden

Deleted first version . . . .
Installed second version . . .
Prior issues detailed have not re-occurred
So far, so good.

Cheers, Perry

Glad to hear that it appears to work.

bclinger · 02/16/2007, 12:19 AM

This fixes the search problem with TealLock 6. DKirker, thank you for a quick fix.

Ben

gtwo · 02/16/2007, 12:29 AM

Quote:

Originally Posted by dkirker

Glad to hear that it appears to work.

Installed "Version 3"

I will keep you posted . . . . .

Thanks Again !!

Rob_T · 02/16/2007, 12:49 AM

I found after installing that it (version 3, and perhaps the others) conflict with DialbyPhoto and Treo Launcher. Basically without SecurityLockFindFix installed the home hard key and phone hard key on the 700P go to the above apps and toggle according to the settings in the apps. With SecurityLockFindFix installed the hard keys toggle between the apps and the system default launcher and the default phone app. respectively.

ChasT · 02/16/2007, 11:19 AM

Quote:

Originally Posted by bclinger

I checked also while the device was actually calling my other cell phone and was able to obtain information; however, I could not activate any applications or defeat the security any further than this. This with TealLock 6.

Ben

I've tried to reproduce the above, but my TealLock 6 refuses to let Find search ?

Have you got any apps in the TL6 "Protected Apps" list, as this racks up the security level by TL quite a lot. This precaution gets round the Warm Reset not locking fault that some users mistakenly report.

dkirker · 02/17/2007, 04:27 AM

Quote:

Originally Posted by Rob_T

I found after installing that it (version 3, and perhaps the others) conflict with DialbyPhoto and Treo Launcher. Basically without SecurityLockFindFix installed the home hard key and phone hard key on the 700P go to the above apps and toggle according to the settings in the apps. With SecurityLockFindFix installed the hard keys toggle between the apps and the system default launcher and the default phone app. respectively.

I will be able to look into this when Gx5 fixes their registration system so that you can trial an updated version after the old version has "expired."

abe frohman · 02/17/2007, 01:39 PM

Quote:

Originally Posted by dkirker

I like how I misspell things..

This version removes a couple lines of code (makes file a few bytes smaller, and a minutely bit faster, unnoticeable to the human), and fixes the name (should have been SecurityLockFindFix and not SecuritLockFindFix).

Please delete the older version.

This should be the last update, unless there are any bugs.

I'm not getting this to work. I use findhack on my Treo650. The usual find button still opens findhack for me. If I disable findhack, then it works fine.

dkirker · 02/17/2007, 06:21 PM

I will see what I can do and release what I get later today.

I think that FindHack is getting to the key faster than me.