Orange Smartphone App Signing Cracked

[Dan East]

Some very simple techniques have been discovered to allow the Orange SPV Smartphone to run unsigned applications. Basically it involves making a couple minor changes to an xml file, hard resetting the phone, and tricking ActiveSync into allowing you to copy the modified files to the phone before the PIN is entered.

Obviously this requires modification to the client's phone, as opposed to the 3rd party applications themselves. At the very least it provides a method of using the hardware for software development.

The specifics are in this large thread:
http://www.modaco.com/smartphone/viewtopic.php?t=1899

Dan East

[sponge]

Dan: Changing the XML file, and letting it go for 15 minutes are 2 different techniques. The former allows the Orange settings to stay on the phone, while the latter does not, it simply takes advantage of a bug (more like a logic flaw?) that keeps the user as manager, until the XML file is parsed. But otherwise, your right.

By the way, the PIN timeout seems to only work on certain devices from certain regions, worthy of nothing.

[angedelamort]

Now that I'm thinking about that, The only persons who may want to hack it, are developpers lol. How ironical.

By the way, anyone heard about a new SM distributor in America? The last one (Sendo) sue M$ right now. Sendo will now use Symbian OS on their hardware like the Nokia.

[Dan East]

Sponge, I was referring only to the first technique. The second appears to only work for French phones, and requires reconfiguring much of the phone manually.

angedelamort, I think there will be a very large number of regular consumers performing this modification. Several games have already been demonstrated to play fine on that hardware after the signing restriction has been removed.

Dan East

[Arisme]

[Mike Wagstaff]

[Arisme]

[Mike Wagstaff]

[randall]

[sponge]

I agree with Mike (and I guess randall) here.. threat to cell phones! And this is a threat because..? Last I checked, a webpage, or other Smartphone-specific piece of data can't unlock the phone and start a virus. So where does rogue come into this?

I can understand flooders (though why a PC flooder ISN'T an evil horrible terrorist threat can't just be used is beyond me) but this article was bad- even for news.com