PresseBox
Press release BoxID: 313749 (Fortify Software, Inc)
  • Fortify Software, Inc
  • 2215 Bridgepointe Pkwy, Suite 400
  • 94404 San Mateo, CA
  • http://www.fortify.com
  • Contact person
  • Yvonne Eskenzi
  • +49 (20) 71832-832

Fortify Software warns on modification risks from portable devices

(PresseBox) (San Mateo, CA, ) Fortify Software, the application vulnerability specialist, has warned that software crackers are likely to continue modifying relatively lowcost specificapplication devices, such as ereaders, but that the potential security risks to companies are significant.

The reason, says Richard Kirk, Fortify's European director, is that whilst best practice principles are usually applied to a firmwaredriven device, such as an ereader, in terms of operating system and allied software, all of these principles disappear out of the window when the device is cracked and repurposed.

Kirk's comments come as the Nook ebook reader, a lowcost device developed by Barnes & Noble last year, has been hacked (http://bit.ly/4sW9Oq) to fully utilise the Android operating system.

"Although the Nook (http://bit.ly/6xFTGa) uses a customised version of the Android operating system, it also supports WiFi and 3G cellular, which means it has connectivity with all manner of systems via the Internet," he said.

"This is why the ereader, which has already been cracked to load the Pandora Webbased music service, the Twitter application and a number of Facebook applications, has now been fully cracked to run most Android applications," he added.

According to Kirk, whilst this is potentially great news for home users of the Nook, it poses a significant security risk for companies interested in using the device for corporate purposes, since there is no way of knowing whether the newly installed software - as well as the operating system cracks - comply with security best practices.

These practices, he explained, include the need for regular security testing to ensure software that is being developed is inherently secure.

The software industry, he says, has been extolling the benefits of secure coding practices - so that developers do not keep introducing vulnerabilities - for many years now, as witnessed by the Fortify 360 initiative (http://bit.ly/5bNfsm)

Most 'home brew' software is excellent from a functional perspective he went on to say, but rarely complies with software development best practices when it comes to security, which is where the risk of using such cracked devices in a company environment enters the frame.

"You wouldn't expect an IT manager to allow unchecked thirdparty applications to be loaded onto company desktops, so why allow a modified ereader into the office environment?" he said.

"The problem facing IT managers is that they have no way of knowing whether a portable device like the Nook, has been modified or not, which is why we believe that cracked devices like this pose a potentially serious security risk for companies of all sizes," he added.

For more on Fortify Software: http://www.fortify.com