Indian hacker Atul Alex has had a look at the firmware for Symbian S60 smartphones and come up with a back door for it. By modifying version 5 of the original software – which runs on such devices as the Nokia 5800, Nokia X6, Nokia 5530XM, Sony Ericsson Satio and Sony Ericsson Vivaz – he has integrated a back door as a reverse shell, including support for Perl scripts. All of the smartphone’s functions can be remotely controlled, including the camera. Alex wrote the back door itself in Python. He plans to make the firmware available for free soon for downloading.

To install a modified operating system, however, an attacker would first have to get hold of a smartphone for a few minutes and connect it to a computer via a USB cable or something similar. Once installed, the back door calls the attacker via a wireless connection and transmits the device’s current IP address. The shell listens in at port 5530 and handles such functions as netcat, mkdir and wget. In addition, it reportedly supports over-the-air installation of additional applications.

The back door also includes options to read out email, telephone lists, and text messages from memory, create screenshots, take photos with the phone’s integrated digital camera, and record telephone calls. The stolen data are transmitted via GPRS/UMTS or WLAN to the attacker’s file server.

Alex told The H’s associates at heise Security that he uses a technique he developed himself to hide the back door process from the system’s TaskManager. While third-party task managers are principally capable of displaying the process, Alex says that they work at the level of the system and therefore cannot terminate the task. He says the only way to remove the back door is to overwrite the firmware with Symbian’s original software.

Source.

Whether you’re resisting the temptation to upgrade to newer, faster hardware, or a year’s worth of use has made your Android phone feel slow and laggy, here are some ways to make your older phone run a bit smoother.

This guide provides a number of tips you can use to speed up your phone, and while not every tip will apply to you or your phone, you should find at least a few tips in here that will. Whether you’ve rooted your phone, overclocked, flashed a new ROM, or none of the above, you’ll be able to take advantage of a number of the tweaks below to get your phone from sluggish and glitchy to quick and smooth.

Everyone’s phone is different, too, so note that some of the more advanced tweaks may take a bit of trial and error on your part. I’ve experienced good things with these tweaks on my Motorola Droid (which, yes, had gotten pretty darn sluggish and glitchy, even for a barely year-old phone), but I’ll note where a different approach to a specific tweak will help owners of older or more underpowered phones. Users with newer phones (like the Droid Incredible or Galaxy S) may not need these tips as much, but I’ve heard from several sources that even speedy phones like those have benefited from these tips, so they’re worth playing around with no matter what phone you have.

If You Haven’t Rooted Your Phone

There are a lot of great tweaks out there for rooted phones, but there are a ton of really simple things you can do to speed up your phone, even if you haven’t done any hacking whatsoever.

Try a New Home Screen Launcher

We’ve talked about the benefits of other home screen launchers on more than one occasion, but I can’t stress how great of an upgrade this can be. As always, I’m a huge proponent of LauncherPro, as it will not only bring you a noticeable speed increase upon installing it, but it also has lots of advanced features we can tweak to boost our speed even further (more on that later). Of course, ADWLauncher is also very popular, and the Android Market is rife with other options.

I’m going to write the rest of this tutorial from the perspective of a LauncherPro user, since from what I’ve seen, it has the most speed-boosting options, but you should be able to find many of the settings I mention below in other launchers, too—I’ll note where a few of them are along the way, but you may have to do some poking around of your own depending on what Launcher you’re using.

Lower the Number of Home Screens You Use And Ditch Those Widgets

If you have an HTC phone with the exclusive Sense UI and you’d rather not ditch it for something like LauncherPro, that’s fine—you can still put this tip into practice. While some phones, like the Motorola Droid, come with a mere three five home screens, many (including most HTC phones) come with up to seven. While this is pretty handy if you like lots of icons and widgets (which I’ll mention again in a moment), they can really take up a lot of memory on your phone, which can cause jerky animations, lag, and force closes.

In our guide to organizing your Android home screen, we mentioned the two philosophies behind home screen usage. It’s fine to have lots of home screens, icons, and widgets, but if your phone isn’t performing up to your standards, you may have to compromise and try using fewer home screens (or at least find a middle ground). I went down from seven to three home screens and haven’t looked back—the jump in performance was pretty incredible.

If you’re using LauncherPro, you can pick your number of home screens by hitting the Menu button on your phone, tapping Preferences, then tapping Homescreen Settings. If you’re sticking with your stock launcher, you may not have the option to actually decrease the number of home screens, but you can still benefit by removing some icons and widgets from two to four of your home screens. It probably won’t give you as big of a benefit as getting rid of the screens entirely, but those widgets can still suck up tons of memory, and deleting them from your home screen should make your phone run noticeably smoother.

Uninstall Misbehaving Apps

When we discussed the myth of Android task killers, we mentioned that one of the real problems with slow phones is running poorly coded apps—apps that use up too much CPU in the background. Previously mentioned Watchdog is still a great way to keep track of those apps: if something is constantly running in the background, it may be causing some of the performance hits on your device. Unless it’s something you can’t live without (and are thus willing to live with any slowness it might cause), uninstall it and find an alternative.

Note that some of the worst offenders in this category are apps that come pre-installed on your phone. Unfortunately, you need to be rooted to uninstall these, but we’ll talk about that in a bit.

Uninstall or Move Apps to Free Up Space

It’s also worth mentioning that even if an app doesn’t misbehave (heck, even if you don’t run it at all), it can cause slowdowns on your device. Believe it or not, the more free space you have in your phone’s internal memory, the faster your phone can write to the disk. If you aren’t sure how much free space your phone has, you can check it by going to Settings > SD Card & Phone Storage to see. You can also see which ones are taking up the most space by going to Settings > Applications > Manage Applications, hitting Menu, and sorting them by size. If you find you aren’t even using an app that’s hogging space, you might as well uninstall it—no point in keeping it around just so it can slow down your phone.

Your other option is to use the ever-handy Apps2Sd to move some of those apps off your phone’s internal storage and onto your SD card. By default, the developer of a given app usually decides whether an app will install to your SD card, but with the App 2 SD app, you can do it yourself. Just pop open the app, and you’ll get a list of apps that are on your internal storage that have the ability to move to the SD card. Just move them over to free up space.

Tweak Your Launcher’s Memory Usage

If you really want to dig into your system’s settings (or you compromised on that “use fewer home screens” tip), there are a few more advanced tweaks you can make to your launcher that should help it run a bit smoother.

If you’re using LauncherPro, hit the Menu button and go to Preferences > Advanced Settings > Memory Usage Settings. While you can tweak the Advanced Settings to your liking, the easiest way to take advantage it to use one of LauncherPro’s many Memory Usage Presets. These presets tweak different settings to fit the needs for different people and different phones. You can read more about these settings on the LauncherPro blog, but here’s what you really need to know:

Starting with version 0.6.1, there is a new option in the preferences called “Memory usage”. Right now there are three modes; light, medium, and high.

• Light mode is basically what 0.6.0 uses, and it’s made for users that have 5 or more screens, a lot of widgets/icons (or many full-screen widgets), 3D drawer, etc.
• Medium is the default, it should work best for most users with a moderate-to-high amount of widgets/icons.
• High mode doesn’t try to optimize memory usage. It’s very much like the early versions of LauncherPro, so it should give the best performance. If you don’t have a lot of widgets/icons on your screens, you should try this setting.

Note that there are now more than three presets, but the general premise remains the same. If you’re still filling up your home screen with icons and widgets, you might want to try out a setting on the low end of the list. If you’ve taken my advice thus far, I can tell you High mode will give you a pretty nice performance boost.

One great thing about LauncherPro is that if you go to Preferences > Advanced Settings and check Display Memory Usages, you’ll be able to see how much RAM is being used at any given time. This is a good way to tell whether you have RAM to allocate to these different things, or whether the amount of RAM is too small to let LauncherPro keep trying to use it all up.

If you’re using ADWLauncher, you won’t have nearly as many choices, but I would still recommend going into ADW’s settings, hitting System Preferences, and playing around with a few of the features there like Scrolling cache and System persistent, which should perform similar tasks (albeit not as well as LauncherPro or CyanogenMod’s similar settings, which I’ll talk about in the section for rooted phones).

If You’ve Rooted Your Phone

If you’ve taken the plunge and rooted your Android device, you have a few more options available to you that should help you eke some extra speed out of your device. Note that these are a bit more advanced (as would be expected with root-only options), and require a bit more care, so be sure to backup your phone before you make any huge changes to it in case anything goes wrong.

Install a Custom ROM

Still one of the best reasons to root your phone is to install a custom ROM, not only for the neat features it brings but for the speed increases it can bring your phone. We’ve gone through the details of installing custom ROMs before, so I won’t go too deeply into it here, but I do recommend it if you need some speed increases, especially if the ROM is based off a later version of Android than your phone currently has. Lots of phones are still stuck with 2.1 and earlier, and while some ROMs can run a bit slower than stock Android on some phones, the speed increases Android 2.2 brings likely outweigh them.

Many ROMs are built for speed and stability, and while you’ll get a great performance boost from them, I’ve found that even with a ROM like CyanogenMod I’ve been able to eke some good performance out of my phone (especially by tweaking some of CyanogenMod’s advanced features). So don’t think that you have to choose a ROM like Bugless Beast just because you have an old phone. Of course, trying a few different ROMs is always a good idea to see what works best for you.

Overclock Your Phone’s Processor

A surefire way to get a speed boost out of your old, underpowered phone is to overclock it. We’ve also discussed this already before, so we won’t get too deep into it here, but I will remind you that to overclock, you’ll need to install a custom kernel. These are specific to your device, so you’ll have to do some googling for compatible overclocking kernels to find one that’s right for you. Generally, kernels are organized by two things: voltage and clock speed. The higher clock speed you choose, the more likely you’ll need a higher voltage kernel (which, by the way, will drain battery faster). As long as you’re not going overboard with the overclocking, you should be able to get by with a low or standard voltage kernel without a problem.

Uninstall Crapware

If your phone came pre-installed with all sorts of applications that you don’t need, you can unisntall them with an app called Titanium Backup. Once you’ve downloaded it, just open it up and hit the “Backup/Restore” button at the top of the screen. Tap the app you want to get rid of. You’ll probably want to back it up first, in case it ends up being integral to your phone’s operation, but once you have you can uninstall it from the same screen. Alternatively, you can just freeze the app, which won’t free up space on your phone’s memory, but will keep it from running in the background and slowing your phone down. Note also that, like all these root-only options, you could seriously mess up your phone if you go too crazy, so maybe a full-phone backup is also a good choice here.

Play With Your ROM’s Advanced Settings

This is one of the most difficult tweaks to perform on your phone, because it varies so much from person to person what works best. Furthermore, some ROMs may not have these settings in their preferences—you may have to do some terminal work to enable them. I’ll go through what they are, and point out their location in the CyanogenMod ROM since it’s the most popular and widely available, but if you don’t have them in your ROMs settings you may have to do some googling to find out how to tweak them. That said, here are some of the handier features.

Compcache: Compcache is essentially virtual swap space in your RAM. In a nutshell, it gives you “more” RAM, but it’s a bit slower than regular RAM because it takes CPU to compress and decompress packages that are swapped into it. This is one of the most debated features: many find that it helps things like the home screen load faster; others prefer to keep it off. Try it both ways and see what works for you. New versions of CyanogenMod also allow you to choose how much RAM compcache sets aside as virtual swap space, so you can play around with that as you so choose.

JIT: JIT is a Java compiler available in Android 2.2. Enabling it won’t give you a big speed increase as far as small apps, loading the home screen, and other such niceties, but it will likely give you a big speed boost in intense applications, like games.

Lock Home in Memory: This is similar to the LauncherPro memory features we discussed above, as it attempts to do exactly what its name implies: keep your home screens in memory so that it doesn’t have to keep redrawing them all the time. I’d recommend enabling this if you have the memory for it.

VM Heap Size: This is one of the more interesting settings. the VM heap size is the maximum amount of memory an application is allowed to allocate. Resource-intensive apps will require a larger VM heap, while simper apps don’t need as much. You’ll want to play around with this setting, but you should be able to tell after going through the other settings what setting you’ll want here. If you allocating tons of memory to LauncherPro, or your have JIT enabled for resource-intensive applications, you might want to try 32M. If you’re trying a more minimalistic approach to everything, you might find 16M or even 12M boosts the speed of your phone considerably.

With all these settings, try changing just one at a time and see how your phone responds over the course of a day or two. Everyone’s settings will be different; there is no one size fits all here. Depending on your phone, the apps you use, how you’ve set up your home screens, and other tweaks you’ve made, your phone will respond differently to different settings. So, if you’re dedicated to messing around with them, go for it—otherwise, you’ll probably just want to leave them at their defaults (which are set on a per-model basis, for what it’s worth). Also note that if you start messing with these settings, you never know what might happen, so many developers won’t let you submit bug reports if you’ve changed the defaults. And, of course, always always always make a backup.

Source.

The new version 1.0.4 of libimobiledevice, a library for communicating with Apple’s mobile devices, now supports the recently released iOS 4.2.1 for Apple’s iPhone, iPod touch and iPad portables. Older versions of the library, including those contained in current distributions, fail to establish a functional SSL connection with the Apple devices running the latest version of iOS.ibimobiledevice provides mechanisms that allow Linux programs to communicate with iPhones, iPod Touchs and iPads via USB without the need to jailbreak the Apple device. A number of command line tools are based on the library, including programs for activating and backing up i* products. Applications such as Rhythmbox, Amarok and Gtkpod can synchronise data between PCs and Apple devices, and the Nautilus file manager is able to access the Apple file system’s user area.

Source.

In its latest iOS version 4.2.1, Apple has introduced a new mechanism to further complicate the removal of the SIM lock, also known as a network or subsidy lock. The operating system will check which baseband version (in simple terms, “modem firmware”) is installed on the iOS device and refuse to start if an unauthorised version is found. With the earlier versions of iOS theTinyUmbrella tool can be used to persuade locked devices to co-operate; this tool won’t work in iOS 4.2.1.

Currently, users that buy an iPhone 4 in, for example, the United Kingdom, Germany, France or Italy can purchase an unlocked device, often at a much higher price, that can be used with a SIM (in the iPhone 4′s case, a micro-SIM) from any mobile GSM carrier. This is particularly useful, for instance, when roaming abroad as it allows users to purchase more economical, pre-paid SIMS, from local providers. Most iPhones bought on contract with a carrier are provided at a steep discount, known as a subsidy, and are locked to that carrier. In the UK and Germany, users can often have their phones unlocked after their contract is up, sometimes for a fee. However, there may be no official unlock option for iPhones purchased in other countries. In such cases software developed by the jailbreaking community can be used to remove the SIM lock on jailbroken devices (for instance ultrasn0w).

Now with iOS 4.2.1 it is only possible to temporarily unlock (jailbrake) a device to install arbitrary software not authorised by Apple. However, to operate the freely installed software the device needs to be unlocked after every reboot via a tethered jailbreak with such tools as redsn0w. A method of unlocking the SIM only makes sense once the jailbreak can be permanently injected into the device, usually by exploiting a second vulnerability. At the moment, with the SIM lock anchored in the baseband, there is no way to remove the SIM lock in devices running the latest iOS 4.2.1.

Various older baseband versions did allow users to unlock their devices, and tools such as PwnageTool were previously used to prevent a baseband update when installing iOS updates, effectively allowing users to unlock their iPhones by running a current iOS with an older baseband version. Apple has now made this impossible with the baseband check mechanism that not even TinyUmbrella has been able to crack. This is one of the reasons why no update for the PwnageTool suitable for updating to iOS 4.2.1 has become available. Whether the jailbreakers will find a way to bypass the hurdle remains to be seen. Those who require an unlocked iPhone can either purchase an officially unlocked version at a price, or for the time being, not update to iOS 4.2.1.

Source.

The vulnerability is present because of a combination of factors. I’ve been asked nicely to remove some details from the following section, and as my intention is to inform people about the risk, not about how to exploit users, I’ve agreed:

• The Android browser doesn’t prompt the user when downloading a file, for example"payload.html", it automatically downloads to /sdcard/download/payload.html
• It is possible, using JavaScript, to get this payload to automatically open, causing the browser to render the local file.
• When opening an HTML file within this local context, the Android browser will run JavaScript without prompting the user.
• While in this local context, the JavaScript is able to read the contents of files (and other data).

Then, once the JavaScript has the contents of a file it can post it back to the malicious website. This is a simple exploit involving JavaScript and redirects, meaning it should also work on multiple handsets and multiple Android versions without any effort.

One limiting factor of this exploit is that you have to know the name and path of the file you want to steal. However, a number of applications store data with consistent names on the SD card, and pictures taken on the camera are stored with a consistent naming convention too. It is also not a root exploit, meaning it runs within the Android sandbox and cannot grab all files on the system, only those on the SD card and a limited number of others.

A demonstration of the proof of concept exploit in action can be seen in the video embedded below. The demo uses the Android emulator with Android 2.2 (Froyo) and I have also successfully tested it on an HTC Desire with Android 2.2. In the demo I first create a file on the SD card of the Android device, then I visit the malicious page and it grabs the file and uploads it to the server automatically.

I notified the Android Security Team on 19-Nov-2010 and to their credit they responded within 20 minutes, took it seriously, and started an investigation into the issue. They have since updated me to say they are aiming for a fix to go into a Gingerbread maintenance release after Gingerbread (Android 2.3) becomes available. I have been advised that I can also mention an initial patch has already been developed, which is being evaluated.

Responsible disclosure would normally prevent me from publishing the advisory while there is a chance the users will get a fix in a reasonable time frame. However, despite the speed at which Google has worked to develop a patch I don’t believe this can happen. The reason is that Android OS updates usually rely on OEMs and carriers to provide an update for their devices. Not all OEMs are providing Android OS updates to all of their devices, and the ones that are we have seen are not always doing it in a timely fashion. There may be legitimate reasons for this but the bottom line is there will still be a great deal of devices exposed for quite some time or perhaps forever, including my own.

Better that we know now and have the chance to protect ourselves, or at least understand the risk. I don’t expect to see the exploitation of this issue become widespread, but if you are really worried about it there are a few things you can do to identify it or prevent it:

• When the payload is downloaded it generates a notification in the notification area, so watch for any suspicious automatic downloads. It shouldn’t happen completely silently.
• You can disable JavaScript in the browser (uncheck “Settings > Enable JavaScript”)
• You can use a browser such as Opera Mobile for two reasons: 1) It prompts you before downloading the payload 2) If a vulnerability is found you can easily update a 3rd party browser after they release a fix.
• Google have advised that another option is to unmount the SD card (“Settings > SD & phone storage”). This could have an impact on the usability of the device but for some situations, perhaps in organisations, I can see this could work. It has not been fully tested, however.

A word of caution though, you may prevent the automatic exploit this way, but as always you will still need to be vigilant and watch for other vectors, such as an HTML file sent through email.

For those of you who assess the security of products for use in a corporate environment, you’ll know that this kind of advisory is essential in making accurate risk assessments and informed decisions before your business commits to a direction which will later leave it vulnerable. I do not mean to say Android is not a suitable platform for corporate use, like any mobile technology it entirely depends on the use case, compensating controls, risk appetite and so on. I hope this information helps you in the decisions you may be facing right now and goes some way to suggesting a suitable mitigation.

Source.

It’s now possible to, not only view filed documents on the Google Docs online application using an Android or an Apple iOS device, but users can now also edit them as well. Editing capabilities were previously restricted to desktop systems, such as Windows, Mac OS X or Linux-based PCs.

The new features follow Google’s announcement in September that it planned to make the online office suite progressively more accessible to smartphones and tablets. Users with access to a shared document can perform simultaneous and multiple edits. Google added mobile edit, sort and filter capabilities to Google Docs spreadsheets back in February and these are of course still supported.

These new mobile features, and a number of new desktop features such as improved document quality when uploading or importing, are the result of a re-write of Google Docs that started over a year ago – Google Docs was first introduced almost four years ago.

The new editing functions are available to Google Docs users who have set their language preference to English. Google says that support for additional languages is to follow. Devices with either Android version 2.2 or iOS version 3.0 or later are supported.

Source.

With this native app, you’ll continue to have access to all the major Google Voice features on your iPhone, like:

• Cheap rates for international calls
• Free text messaging to U.S. numbers
• Voicemail transcription
• Display your Google Voice number as caller ID when making calls

In addition to these benefits, the app provides some features that make using Google Voice on your iPhone a much better experience:

• With push notifications, the app will alert you instantly when you receive a new voicemail or text message
• Most of your calls will be placed via Direct Access Numbers, making them connect just as quickly as regular phone calls

Google Voice for iPhone is available to download from the Apple App Store today. You’ll need an iPhone with iOS 3.1 or later and a valid Google Voice account to use the app. At this time, Google Voice is available in the U.S. only.

Source.

The BlackBerry Bold 9780 takes RIM’s flagship QWERTY device – the Bold 9700 – gives it a fresh new operating system with BlackBerry 6 and spits out a practically identical handset. It isn’t a new move from BlackBerry, we’ve seen them release multiple devices with minor hardware differences in the past – remember the BB Curve 83xx series?

Here too the BlackBerry Bold 9780 looks every bit the same as the 9700. The colours have perhaps been changed, our current Bold 9700 has chrome trim running across the bottom of the keypad, up the sides and across the top, whereas our 9780 is all black, so it looks like a stealth Bold. Of course, we can’t claim to have seen all the colourways of the 9700, so even this might not be new.

Whilst we are picking up on minuscule details, the finish of the keyboard on our 9780 is slightly different to the 9700. The keys are slightly less glossy, but we suspect this has nothing to do with design and may just be down to a different finishing process, or simple wear on our existing device. Step on to the street, and basically, no one will know which device you have.

To recap, you get a QWERTY handset that measures 114 x 66 x 15mm. It is a little fat by smartphone standards, but at 136g is average weight. It sits beautifully in the hand thanks to a curved back with rubberised material on the edges supplying grip in all the right places. It has a softly curved top edge too, so is wonderfully comfortable for making calls with. This is aBlackBerry after all and it is all about communication, rather than out-and-out multimedia prowess.

The QWERTY keyboard, the best QWERTY keyboard you’ll find on a mobile phone, occupies the bottom half of the front, the 2.44-inch display above offers up a resolution of 480 x 320 pixels. Small numbers, but 236 pixels per inch means it is incredibly sharp. Yes, it will never compete with a 4-inch screen for watching video, but it is sharp, it is vibrant and you can read it in direct sunlight.

Around the body of the Bold 9780 you have the same connections and controls as previously. There are two user-definable shortcut keys which offer up the camera and voice control by default and are easily switched to those apps you want, be it Twitter, Facebook or a particular email account. There is the 3.5mm headphone jack, Micro-USB connection, volume on the sides, the mute and standby buttons on the top.

Around the back you have the faux leather insert in the centre of the plastic backplate and the new 5-megapixel camera and LED flash. The build quality overall is good, there are more panels and sections than you’ll find on the slick body of something like the HTC Desire Z, but we found it to be free from creaks or warping under pressure. It might not give you a minimalist high-grade finish, but it has a sort of Master Chief busyness to its look that we like. It looks like a smart business tool, which is essentially what it is.

Aside from the 5-megapixel camera, the BlackBerry Bold 9780 has seen a boost internally to 512MB of memory (over the 256MB previously) as well as a step up to 515MB of RAM. The processor is the same 624MHz as we’ve seen previously. Whilst we don’t advocate playing the numbers game for the sake of it, there was noticeable lag dealing with some applications on the Bold 9700. The RAM upgrade and the refinement of the new operating system mean these are certainly reduced.

We liked the Bold 9700, but it was showing the hallmarks of a phone reaching the end of its operating system. In the highly competitive world of mobile phones, where every couple of months we see a new feature arriving on one of the major platforms, BlackBerry OS faces the challenge of evolving fast enough to keep pace. We saw BlackBerry 6 on the Torch, but it was immediately obvious that it wasn’t the greatest multimedia handset out there.

BlackBerry 6 on the 9780 is essentially the same and has the feel of an operating system designed for a touchscreen device to a certain extent. That may, admittedly, be a result of us using the Torch before getting hands-on with the 9780, but there are certain aspects of BB 6 that don’t seem to fit quite as well as they did on the touch-enabled Torch.

The main one is the use of those pull-up tray menus. On the Torch, you can swipe from side-to-side and pull the menus up and down as much as you like. Without touch, you are left to open the menu to its entire three lines of icons either using the menu button and selecting “Open Tray”, or by hitting the top category line (All, Favourites, Media, Downloads, Frequent). It looks as though it doesn’t quite fit, but it is easy to navigate once you get savvy with the optical navigation key in the centre of the device.

For existing Bold users, the first impression might be that an extra step is involved with getting into the menu – previously a press of the menu button would open your menu so you could scroll to the application you wanted, now it opens a menu, offering to open another menu. However, there is a chance that you’ll need to use the menus less than before because of the introduction of universal search.

Start typing and the Bold 9780 starts returning results. You can customise what you want it to search, and what you want it to offer by way of results, and it is a really powerful tool. It pretty much is only possible with a permanent keyboard too, as touchscreen-only devices will need you to open something or select something first. So, if you want to open an application, just type the name – a lot like Spotlight on Mac OS X.

Type a person’s name and it will return their contact card, emails they’ve sent you, calendar details and so on. It makes it really easy to pick up a conversation or message stream, without entering messaging and scrolling through the list, or performing a search in that application. Universal search will also offer to search YouTube, BlackBerry App World, Facebook, Google Local or Google web too, so if you don’t have it in your phone, you can seek it out elsewhere in a flash.

The homescreen of BB 6 is much more usable than the rather static BB 5 screen. It has always conveyed a great deal of information (sound profile, battery, time, date, networks, connection status, message indicators from various core apps) but now this information is better managed and more useful. It is divided into five selectable areas. The sound profile is very much as it was before, but now the message display can opened to give you a quick overview of messages and calendar entries, so you can click through to what you want.

The search area opens the search window, but you don’t need to use it, because as mentioned, as soon as you start typing, universal search swings into action delivering results. The final area lets you manage your connections (cellular, Wi-Fi, Bluetooth), set alarms, as well as providing direct access to settings for connections. Lurking at the bottom of the list is “options” which takes you into your settings menu, which is a nice shortcut to have.

Of course the tray menus aren’t just static, they adapt as you use applications and download them from BlackBerry App World. There is the potential for a lot of duplication of applications – not only can you get to an app by searching for it, but it will be in All, Downloads, Frequent and possibly in Favourites too. There is an argument that those frequent apps you use don’t ever need to be marked as a favourite, but this sort of management is down to the user. We found it took a week or so before we were totally happy with access and to begin with you’ll spend a lot of time getting to things via different routes – it can be confusing, but there is plenty of choice and we like being able to turn a shortcut into a Favourite and have direct access from that section, a little like dropping a shortcut on the home screen of an Android device.

The inclusion of a Media tray means you can swipe across to get to video, music, your pictures, podcasts, ringtones and video camera. We’ve already said that the Bold 9780 isn’t a great media device compared to rivals like the HTC Desire HD or the iPhone 4, but it still offers those features you’d expect. The resolution of the screen means there is detail in the video you do opt for and the external speaker is very good, having more body than many other rivals. This makes it a great device to use on speakerphone, as well as watching a little video in your hotel room.

We’ve mentioned apps, and of course the apps experience is very much the buzzword around smartphones at the moment. BlackBerry App World is a little lacklustre without the strength or depth of the major rivals. There is a lot of obscure paid-for content, and the addition of new and exciting applications is a little slow. The core is just about represented, but not all content has been updated for BB6 compatibility, including some of RIM’s own apps, like the eBay app. So, for the immediate term you have the basics covered, but the full experience is yet to arrive. (UPDATE: eBay has arrived on BB 6 as of 17 Nov, so updates are coming.)

Drilling deeper into BB6, you’ll find that much is the same as previously, but with some reorganising and a visual lick of paint. Settings are better organised and laid-out and the fiddly Wi-Fi/3G options have been simplified so you don’t find yourself having to select between Wi-Fi preferred and 3G preferred when you want both to be handled by the device without your involvement.

The browser is one of the biggest changes however, and one of the most dramatic improvements. Previously the browser was slow to load pages and often stopped mid load. The new WebKit browser is much better placed to deliver pages, offering up tabs and a much faster experience. You don’t get the niceties of pinch zooming like you do on a touch device, but do get to zoom with text reflowing to fit the screen. It will never compete with larger screened devices, but it’s certainly a marked improvement over previous versions. One downside, however, is that UK residents will find BBC iPlayer, supported on the old browser, isn’t supported here at present.

The BlackBerry family is really about communication and central to this is the email experience. BlackBerry has always been a smart choice if you are a big emailer because of the ease of setting up your emails, the instantaneous delivery and general no nonsense experience. In recent years the BlackBerry has become equally adept at dealing with your personal email as it has at handling the corporate email that brought it into favour.

You also get the option to sync contacts and calendars natively from Google (as well as the Google Sync app option that supports BB 6). We’ve found the contacts works reliably with Google, but the calendar is sometimes a bit hit and miss – some appointments populating the calendar and some not. But as we said, the Google Sync app can always be downloaded to fill in instead if that is a concern.

BlackBerry still offer a universal inbox, bringing together not only all your message streams (email accounts, MMS, SMS) but also those core app services that have messaging, so your Twitter direct messages will appear here, as will your updates to Facebook. You also compose not only emails, but Twitter and Facebook postings here too, and when other core apps appear, we’d expect to see direct interaction supported here too.

We’re still big fans of the BlackBerry approach to email and give it top marks. There are a few quirks, like the universal inbox not offering threaded conversations (that’s a feature of the individual mailboxes), but on the whole, it is an excellent device for staying connected, especially as it isn’t overly dependent on 3G networks as the service over older GPRS networks is still speedy. We like the new ability to flick through your messages by swiping across the optical key – it takes some practice, but once you’ve mastered it, you’ll be well placed to sit and browse through all your messages with ever having to exit back to the mail folder.

Of course BlackBerry Messenger has found favour with teenagers, as has competitive pricing on BlackBerry devices. You also get apps to handle other messenger protocols – Windows Live Messenger, Yahoo Messenger, Google Talk, AIM – all preinstalled on the device. The only glaring omission for us is Skype support, with the Nimbuzz app not yet available on BB6.

With a nod to the rising influence of social networks, BlackBerry have introduced a new Social Feeds app. This neatly runs together a collection of feeds from the networks you are signed in to (Facebook, Twitter, Google Talk, Windows Live Messenger) as well as offering up RSS feeds. You can opt to post updates to those service from one location too. It’s convenient, but with the simplicity of the Facebook (recently getting an update to include Places) and Twitter apps, we can’t say we ever found ourselves using Social Feeds to any great extent.

Moving with the times, the BlackBerry Bold 9780 has updated the camera offering to 5-megapixels, as well as redesigning the interface to give you easy access to a selection of scene modes, the camera and geotagging. The performance overall is better than before, with better overall definition and better low light performance. It isn’t exceptional, but it copes will enough for passing snaps to share online. There is a single LED flash supporting the camera.

Video hasn’t seen the same love however, with a maximum resolution offering of 640 x 480. This puts the Bold 9780 behind the times, with most rival handsets offering 1280 x 720 HD video capture. We suspect that the processor wouldn’t handle a higher definition of video capture which would then be an argument for a upgrade in that department.

Verdict

The BlackBerry Bold 9780 is an improvement over the 9700, which was an excellent device in itself. The inclusion of more RAM and a new operating system brings a device that runs faster and smoother than previously, but feels as though it is already slightly out of date, especially when you start examining the multimedia offering.

But if you are interested in the core communication, especially email, then the Bold 9780 comes highly recommended. Aspects of the operating system do feel more at home on the BlackBerry Torch, like the tray menus, but the Bold 9780 still offers the best keyboard and the best email experience around. To judge it solely on its weakness as a multimedia device would be naïve: there are plenty who want a connected device for  communication, and BlackBerry Bold 9780 excels in this area.

We’re a little impatient when it comes to waiting for app updates and we’d say that BlackBerry should have all the apps in place that they have on other devices, as well as closing those loops like the lack of compatibility with BBC iPlayer – it isn’t a great reflection of your new device when it lacks a service handled easy by the old one. If anything, a more powerful device would have been appreciated as we suspect it limits how far the Bold can go in the future, bearing in mind that some will have the 9780 for the next 2 years and this ultimately governs the overall score.

We’re happy to accept the same design because it works beautifully and as for the quirks that BB OS6 throws up – we’re sure that there will be tweaks and improvements made as the OS matures. Universal search is an absolute gem and the battery life is the icing on the cake for those who want to stay connected, and is certainly our highlight.

With the expected arrival of BB 6 on the existing 9700, upgrading from an existing device might be a tough call, although we’ll have to see how BB 6 runs on the 9700 first. Yes, if you need a new handset, by all means take the superior 9780 – for many it will be the best QWERTY device available at the moment.

Source.

Specially crafted web sites can launch iPhone and iPod Touch apps without the Safari browser asking the user for permission when certain URL protocol handlers (URL schemes) are called. For instance, according to security researcher Nitesh Dhanjani, a web site can use the iFrame to launch a Skype app and automatically call a number – provided that the user has saved Skype access data. Criminals would also be able to play around with a number of other applications. For a list of the protocols currently used in the iPhone, see the URL scheme index.

Dhanjani says that iOS devices apparently do not check in with protocol handlers registered by third-party apps added to the iPhone after purchase. If a web site calls one of the URI schemes registered by default in the iPhone, such as tel:1-408-555-5555, for the internal telephone app, Safari and / or the iOS displays a dialogue asking whether the user would like to make the call.

Dhanjani says that when he contacted Apple, Apple said that authorisation for certain activities is the responsibility of the app itself. In other words, the app’s developers have to implement authorisation to call a specific URI. But Dhanjani says that will be hard to do because the apps can also be launched outside of Safari after the decisive point when permission would need to be granted. Dhanjani therefore says that there should be a way of indicating whether Safari opens a prompt window when a URL protocol handler is registered. Furthermore, he says Apple needs to pay more attention to potential abuse when reviewing app security.

Source.

Security researchers have demonstrated two vulnerabilities that allow attackers to install apps on Android and its vendor-specific implementations without a user’s permission. During normal installation, users are at least asked to confirm whether an application is to have certain access rights. Bypassing this confirmation request reportedly allows spyware or even diallers to be installed on a smartphone.

What’s special about the two vulnerabilities is that they can be exploited without an attack on Android’s underlying Linux kernel and function in the userspace alone. When analysing HTC devices, the security specialist known as Nils found that the integrated web browser has the right to install further packages (INSTALL_PACKAGES). Nils says that HTC integrated this functionality so that the browser can automatically update its Flash Lite plug-in. However, attackers can exploit this if they have found another browser hole.

Such browser holes in Android 2.1 were already disclosed by security firm MWR InfoSecurity (Nils happens to be its head of research) in mid-August. A browser exploit for Motorola’s Droid was also released recently. To demonstrate the attack, Nils used a HTC Legend running Android 2.1. The browser hole has been closed in Android 2.2, but only about a third of users are already running this version on their devices.

Android specialist Jon Oberheide demonstrated another hole which involved misusing the Account Manager to generate an authentication token for the Android Market and obtaining permission to install further apps from there. However, this initially requires a specially crafted app to be installed on the smartphone. Nothing could be easier: Oberheide released the allegedly harmless “Angry Birds Bonus Levels” app intothe Android Market and, upon installation, this app downloaded and installed three further apps (“Fake Toll Fraud”, “Fake Contact Stealer” and “Fake Location Tracker”) without requesting the user’s permission.

The privileges of “Fake Tool Fraud” included the right to send premium SMS messages. Google has since removed all of Oberheide’s apps from the Market. Back in June, Oberheide had already used an app to demonstrate an Android vulnerability. At the time, Google used the remote deletion feature, available on Android devices, for the first time.

Source.