Airscanner Mobile Security Advisory #06070101: Abidia & OAnywhere (All versions)
Airscanner Mobile Security Advisory #06070101:
Abidia & OAnywhere (All versions)
Product:
Abidia & OAnywhere
Platform:
Tested on Windows Mobile Pocket PC 2005
Requirements:
Mobile device running Windows Mobile Pocket PC with Abidia & OAnywhere
Credits:
Seth Fogie
Airscanner Mobile Security
http://www.airscanner.com
Mobile Antivirus Researchers Association
http://www.mobileav.org
02/03/2006
Risk Level:
Medium
Summary:
Abidia Wireless enhances the eBay and international eBay sites with effortless,
anytime, anywhere, access via wireless handheld and mobile phone devices
featuring customizable real-time synchronization with an eBay auction account,
wireless searching, cached browsing, wireless bidding, and the ability to
effortlessly manage auction listings on-the-go, anywhere you are, everywhere
you need.
http://www.abidia.com/
Lack of user/pass protection for updates.
Details:
Update requests include authentication via a simple HTTP POST. The user/pass
information for eBay is sent as plaintext. Use of this service exposes the
account information and also provides a proxy for brute force password cracking.
POST
/srvc/api.php?user=sethfogie&pass=mypass&serial=&imei=xxxx&site=US&name=sell
HTTP/1.1
Host: api.abidia.com
User-Agent: Abidia-Wireless/3.0.2 (PocketPC; 480x640; WindowsMobile/5.1.70)
Accept: text/html
Content-Language: en-US
Connection: Close
Content-Length: 84
Content-type: application/x-www-form-urlencoded
user=sethfogie&pass=mypass&serial=&imei=xxxx&site=US
Workaround:
None
Vendor Response:
Awaiting Response
Copyright (c) 2006 Airscanner Corp.
Online advisory
http://www.airscanner.com/security/06070101_abidia_oanywhere.htm
Permission is granted for the redistribution of this alert electronically. It
may not be edited in any way without the express written consent of Airscanner
Corp. If you wish to reprint the whole or any part of this alert in any other
medium other than electronically, please contact Airscanner Corp. for
permission.
Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use on an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect, or consequential loss
or damage arising from use of, or reliance on, this information.