To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://networks.silicon.com/mobile/0,39024665,39156343,00.htm

Bluetooth flaw found in Sony Ericsson phones
Four models open to DoS attack, says FrSIRT

By Greg Sandoval

Published: Friday 10 February 2006

Several mobile phones produced by Sony Ericsson are vulnerable to denial of service attacks, two security companies reported this week.

The flaw is found in four models of Sony Ericsson phones and comes from an error in their Bluetooth service, according to the French Security Incident Response Team, or FrSIRT.

The Bluetooth "fails to properly handle malformed L2CAP (Logical Link Control and Adaptation Layer Protocol)", FrSIRT, a France-based security company, said in an advisory posted on its website.

Danish security firm Secunia reported the same flaw, and both companies have rated the potential security risk as low. Thomas Kristensen, Secunia's chief technology officer, said that someone intent on knocking out one of the four Sony Ericsson phones, which includes the K600i and T68i, would need only to get within 50 feet while carrying a handheld device configured to send the malicious code via Bluetooth. The code would crash the phone.

Kristensen said: "I don't think the phone's user would even know the attack occurred until they tried to use their phone again."

The good news is that damage would be minimal. Once the phone was turned off and restarted, it would function normally again, he said.

A company spokeswoman said in an email: "Sony Ericsson believes that the possibilities to exploit the Sony Ericsson products mentioned are very limited. However, if you are concerned, you can help prevent access to the phone by switching off the 'discoverable' mode in the Bluetooth settings of the phone. This makes the phone invisible to others and thereby minimises the risk of being accessed."

The spokeswoman said she is waiting to learn more details from Sony Ericsson engineers in Sweden who would have more information.

While this specific vulnerability may be low-risk, Kristensen cautioned that these kinds of vulnerabilities in mobile phones are a growing concern in the security community. Conceivably, hackers could one day pilfer information from mobiles if the handsets aren't provided with the right security measures.

So far, cellular users have only had to worry about mobile phone viruses, which are still very rare. In October, Nokia tapped Symantec to help secure its mobile phones from viruses that target certain kinds of handsets. Experts don't expect a fast-spreading mobile phone virus to strike for two more years.

Greg Sandoval writes for CNET News.com