[13285] in bugtraq
Re: Handspring Visor Network HotSync Security Hole
daemon@ATHENA.MIT.EDU (Jim Frost)
Fri Jan 7 16:19:56 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <3874EABC.4671C89D@atg.com>
Date: Thu, 6 Jan 2000 14:19:24 -0500
Reply-To: jimf@ATG.COM
From: Jim Frost <jimf@ATG.COM>
X-To: Jay C Austad <JCA@BIGCHARTS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
Jay C Austad wrote:
> If you have Network HotSync (provided on the CD that comes with your Visor) enabled on your machine, and a malicious user knows your name (ex. John Smith), and the ip of your machine (ex. 192.168.22.22, or jsmith.company.com), he can change the name on his Visor to yours, do a Network hotsync with your ip, and download all of your email, send email as you, and perform any function that you can.
I'd think this would be true of the Palm too, since the software is
effectively the same. I bet you could hack the UNIX hotsync software to act
as a client fairly easily, thus giving you a cheap and easy attack platform.
jim
