PayPal Mobile app leak

App of the online payment service PayPal has a big hole on both the iPhone and Android phones. It is not the only betalingsapp with a leak.

PayPal has already made an update to his app, and submitted to the respective app stores. Users who have new, safe version can download, sign up to the Wall Street Journal. To the extent that PayPal knows, the hole is not abused. It promises 100 percent reimbursement fraud.

Phishing
The leak is a basic error: the betalingsapp not verify the certificate from the PayPal server is valid. This enables users to be redirected to a spoof, to secure their login information for PayPal booty. "This is really a huge mistake by PayPal," said lead researcher Andrew High of viaForensics, the company that this leak has discovered.

The Wall Street Journal reports that it is possible for payments to listen and thus to intercept user names and passwords. According to PayPal can only under rare circumstances, through an unsecured WiFi network where an attacker, therefore it just must be connected. The possibility of phishing spoof sites through communication, however, undermines this lulling.

Password
Furthermore, abuse of this vulnerability, possible on the iPhone. Android Smartphones are not vulnerable. Yet PayPal has its app for mobile operating system that is also updated. It is unknown what the status of the PayPal app for Blackberry.

On the website is to find no mention of the new version and the need for updating. PayPal is praised as the security of its mobile apps with the message that "any payment is confirmed by a password.

The iPhone app PayPal according to the company about 4 million times since that app was released in April this year. The updated version (3.0.1) is already available in the iTunes App Store. The online payment service expects mobile payments this year totaling some 700 million U.S. dollars amounts.

More Apps leak
Meanwhile prove more apps for mobile payment to contain leaks. viaForensics has several apps reviewed and gaps in discovery. These mobile payment applications of the large U.S. banks: Bank of America, USAA, Chase, Wells Fargo, TD Ameritrade and Vanguard. Several of these institutes have been update for their apps.

viaForensics has informed the banks before it went public with his discoveries. "Since Monday (November 1, 2010), we communicate and work together with financial institutions to eliminate these errors," the company said in a blog post yesterday. "The discoveries that we have published, the impact of testing we on November 3 or so. " The company, the new versions of the apps are also screening.

LiMo Foundation gets ready for next-generation platform

The next version of the LiMo Linux-based mobile platform is getting closer to launch, and a number of operators are promising handsets during 2009, the LiMo Foundation said today.

All the components that make up Release 2 have been delivered on time by the contributing members, according to the foundation. The new version will provide better multimedia support, location-based services, device management and enhanced security.

But making life easier for developers is the most important difference, according to Geoff Blaber, an analyst at CCS Insight.
"With Release 2 there is a far greater level of consistency, which makes it far easier to develop applications and move them from device to device," he said.

But commercial phones won't be ready until the end of the year at the earliest. LiMo is expected to show reference designs that conform to Release 2 at the Mobile World Congress, according to Blaber. The conference opens Feb. 16 in Barcelona.

There will be demonstrations of mobile Web applications and widgets, touch-based user interfaces, mobile TV and high-resolution cameras at the show, according to the LiMo site, which doesn't provide any additional details. Members will also be showcasing toolkits for developers who want to create applications for LiMo handsets, it said.

But the LiMo Foundation isn't just making headway on the platform side. NTT DoCoMo, Orange, SK Telecom, Telefónica, Verizon Wireless and Vodafone will all launch devices this year, according to the foundation.

"It's positive news for the LiMo Foundation, and what it does is underline the fact that although operators are looking at other platforms in the near term, LiMo is still part of operators' plans," said Blaber.

The fact that LiMo isn't dominated by one vendor and has an underlying service strategy of its own -- which in some cases can compete with operator interests -- makes it an attractive alternative to Google's Android, Nokia's Symbian and Microsoft's Windows Mobile, according to Blaber.

LiMo has become a tool that operators can use to try to keep those vendors in check, according to Malik Saadi, principal analyst at Informa Telecoms & Media. The operators are sending the message that LiMo gives them an alternative to other platforms, he said.

The increased competition will be good for users, resulting in cheaper phones, and more and better services to choose from, according to Saadi.

IDG.net