But now it appears that apps with no permissions pose a new threat, gaining access to sensitive personal information without authorization. Leviathan Security Group researcher Paul Brodeur explained in a blog post earlier this week that he created a proof-of-concept to demonstrate that “no permissions” apps still have access to the device’s SD card, handset identification data, and files stored by other apps.

On the SD card, Brodeur’s app yielded a list of all non-hidden files, including photos, backups, and external configuration files. Brodeur said he found that OpenVPN certificates were stored on his own device’s SD card.

“While it’s possible to fetch the contents of all those files, I’ll leave it to someone else to decide what files should be grabbed and which are going to be boring,” he said.

He then fetched the /data/system/packages.list file to which apps were installed on the device and scanned the directories to determine whether sensitive information could be read from those directories. He said during testing that he was able to read some files belonging to other apps. “This feature could be used to find apps with weak-permission vulnerabilities, such as those that were reported in Skype last year,” he said.

Lastly, Brodeur’s app was able to gather the handset’s identification information. Without the “PHONE_STATE” permission, applications can’t read the device’s International Mobile Equipment Identity or International Mobile Subscriber Identity. However, the Global System for Mobile Communications information and SIM vendor IDs could still be read.

“Though this app uses buttons to activate the three different actions detailed above, it’s trivial for any installed app to execute these actions without any user interaction,” he wrote.

Brodeur said he tested the app on Android 4.0.3 Ice Cream Sandwich and Android 2.3.5 Gingerbread.

Source: Steve Musil/CNET

Only a few short months after Mozilla released the final build of Firefox 4 for Android, we now have Firefox 5, just added to the Android Market for the taking. Mobile web browsers can often be a little disappointing, but Mozilla is making great efforts into bringing its Firefox browser up to the desktop edition’s standards. The Android version of the app boasts an impressive feature set that sounds more reminiscent of desktop software, minus one important feature in my book.

This latest version improves page load times on 3G and 4G connections and the overall performance of web browser is also accelerated thanks to smoothing, page panning, and CSS3 animations. Privacy concerns can be somewhat alleviated now, by enabling the new “Do Not Track” option which will prevent web sites from recording information about your online activity.

One of the key advantages of using Firefox over other mobile web browsers is that it is very familiar, if you are used to the desktop version of the software. Settings and preferences can be easily synchronized between platforms and support for add-ons means that the capabilities of the browser can be extended and customized in a variety of ways.

But there is room for improvement, as there almost always is with mobile browsers. The biggest drawback would be the lack of support for Flash. Which means that many web sites cannot be viewed in full, as we would sometimes like to do. Seems like an odd thing to leave out, on a platform that fully supports it.

For the most part, Firefox 5 is a bug-fix release. There are few significant changes, but considering a ton of effort went into changing the release cadence, and then fixing a huge backlog of bugs, that’s enough to expect so soon. It’s also worth noting that Firefox 5 Mobile, which is now part of the main Firefox codebase, will enjoy a simultaneous release with its desktop brother. Firefox 5 Mobile actually has quite a few nice, new additions, including WOFF support, faster surfing over 3G/4G, and overall better rendering of websites, as well as the new privacy feature.

What are your thoughts on how this mobile browser is shaping up?
Does anyone use it as their main browser?
Tell us why, or why you don’t use it.
What improvements would you like to see?

Market link: Firefox 5
source: mozilla

Sprint recently announced a new Total Equipment Protection application that is very useful for smartphones if you pay for the TEP insurance plan. If you lose your phone you can locate, lock, clear and restore it all with this application. To give you peace of mind you can restore your information once you recover your handset so don’t think everything is gone forever. This is something Verizon and AT&T have already been successful with so maybe Sprint will be as well.

We haven’t found it in the market yet but you can click here and download it and then place it on your phone. Sprint says it should be showing up starting today for those who pay for TEP.

The application is free and does work with Android and Blackberry devices, again only if you pay for the $7.00 a month TEP protection.

Take a look at the Press Release below:

OVERLAND PARK, Kan.–(BUSINESS WIRE)–The cost to replace a lost mobile device is usually the least of a wireless customer’s worries, especially if he or she is protected by Sprint’s Total Equipment Protection, which provides coverage against loss, theft and damage. The bigger nightmare is the thought that a customer’s personal contacts, photos and other private information could fall into the wrong hands. To help alleviate those fears, Sprint (NYSE: S) customers needing to track down a lost device and protect their personal information can do so now with the launch of a new application called Total Equipment Protection App.*

Sprint customers with Total Equipment Protection will be able to access the new application, beginning today, at www.sprint.com/protection, where they will benefit from the following features:

* Locate lost device by sounding an alarm on the smartphone even if in silent mode, doing a real time locate via GPS technology, or viewing the smartphone’s location history on a map via a Web Interface
* Remotely lock their smartphone
* Erase contacts in the address book on a lost smartphone
* Backup, manage and restore contacts

“Anyone who has lost a phone knows that their personal information is possibly just as vulnerable as if their computer was hacked,” said John Carney, senior vice president of consumer marketing for Sprint. “Now, Sprint customers have peace of mind knowing that their personal and private information is safe. TEP and this accompanying application is a safeguard for customers who want protection from not only loss, but misuse and unauthorized access.”

The Protection App is included at no additional charge as a benefit of Total Equipment Protection plan, which is $7 per month, per line of service. It is available to customers with phones using BlackBerry and Android mobile platforms. TEP customers download and install the user-friendly application at www.sprint.com/protection. Privacy protection is included with the Protection App. Each time the smartphone’s location is requested by the Web interface, an SMS text message is sent to the smartphone notifying it has been located.

Do you currently pay for TEP and own a smartphone? Go on and download the application and let us know what you think. Of course, we know you may not make a claim today but you can at least tell us how much you like the looks, features, etc. Are you with Verizon or AT&T and use their similar apps? Let us know! Leave your comments in the box below.

Source: Engadget via Sprint