Jimmy Shah is a Mobile Security Researcher specializing in analysis
of mobile/embedded threats on existing platforms (J2ME, Symbian, Windows
Phone, iOS, Android) and potential mobile malware and spyware. If it's
lighter than a car, has a microprocessor, and is likely to be a target,
it's probably his problem. He has presented on mobile threat research at
a number of computer security conferences.
One of my friends recently locked himself out of his apartment. I found this out when I called him, because while he didn’t have his keys he did have his smartphone. This was one of those times he wished he lived in one of those hotels with the Assa Abloy NFC enabled locks.
It turns out he doesn’t need to go to a hotel to open his door with a phone. Kwikset will soon be selling Kevo, a new deadbolt that can be unlocked with a bluetooth enabled phone. You can switch out your old door locks with one of these newer models
Tags: Bluetooth, iphone security, keyless, locks, mobile devices and security threats, mobile security
In the past few days, developers on the XDA-Developers forum have discovered a new root exploit for recent Samsung phones. Normally a root exploit is a good thing for advanced users; they can modify their OS to improve performance, install new and rare apps, or even patch bugs. On the other hand, novice and uninformed Read more…
Tags: alephzain, Chainfire, Exynos, mobile exploit, mobile security, root exploit, Samsung, XDA-Developers
Writing Android malware can be a lucrative business for a criminal. One can create an SMS-sending Trojan horse or a botnet client and sit back to collect the money. It can also be a very brief business, leading one directly to jail. The crooks behind Android/OneClickFraud (malware that extorts users) and Android/DougaLeaker (malware that steals Read more…
Tags: adult entertainment, Android, arrests, dating site, law enforcement, mobile malware, Ransomware, trojan
Recently security researcher Ravi Borgaonkar discussed a vulnerability that caused a Samsung Galaxy SIII to return to a factory reset just by visiting a special website. Mobile phones have a number of useful codes (USSD/MMI) that can be typed on the dialer screen to bring up system information (IMEI, firmware version, etc.). Usually they are Read more…
Tags: Android Malware, DoCoMo 110 Dialer, factory reset, malicious website, Samsung Galaxy SIII
This week many security researchers will converge on Las Vegas for the annual Black Hat USA, Security B-Sides Las Vegas, and DefCon security conferences. As in previous years, we’ll present and discuss many new security techniques and methods used by computer criminals, attackers, and defenders. A good portion of the new research will be related Read more…
Tags: Android, DEX, iOS, Linux, mobile security
Visa is testing out its PayWave contactless payment service at the Summer Olympics in London. Every athlete will get a Samsung Galaxy SIII phone enabled with near-field communication (NFC) along with Visa’s payment app. Contactless payments aren’t new, and similar payments by mobile phone have been tested by Google with its Wallet app and other Read more…
Tags: fuzz, fuzzing, Galaxy SIII, NFC, Samsung, Summer Olympics, visa
As mobile phones allow us to carry our money in an electronic “wallet,” they will also become a greater target for crooks. Picking a pocket is a risky endeavor for a thieves, but it will be much less so if all they need to do is bump into their victims or brush by them with Read more…
Tags: Android, credit card fraud and protection, credit card skimming, mobile security
We suggested earlier that instead of going after the Secure Element chip and the information it keeps safe, attackers would go after the weaker point of the Google Wallet app. Security researcher Joshua Rubin has now created a proof-of-concept app, Google Wallet Cracker, that can recover the Google Wallet PIN on a rooted phone. Once Read more…
Tags: Android, credit card fraud and protection, mobile security
Today Google announced its Bouncer security service for the Android Market. This is a good initial step in protecting Android users. Respect the Bouncer To keep out known troublesome apps, the service performs a malware and spyware scan on all submitted material. It also uses behavioral analysis to determine if a given app is trying Read more…
Tags: Android, Android Market, mobile malware, Rootkits
The ShmooCon security conference takes place in Washington D.C. this weekend. There will be a good number of mobile and embedded talks, covering attacks on and defense of Bluetooth, Android, NFC, RFID, and more. Disposable computers A number of years ago at DefCon a team of penetration testers showed how to infiltrate a corporate network Read more…
Tags: Android, Bluetooth, iphone, mobile security, NFC, RFID, SchmooCon
Posts by Jimmy Shah