Wii, cellphone net surfers face attack risk: researcher

People who surf the internet with Nintendo's Wii video game console or on some cellphones may risk seeing their devices crashing or being hijacked, security experts say.

CBC News Posted: Apr 23, 2007 4:20 PM EDT | Last Updated: April 23, 2007

People who surf the internet with Nintendo's Wii video game console or on some cellphones may risk seeing their devices crashing or being hijacked, security experts say.

According to researchers at security software company McAfee Inc., the potential problem stems from a flaw in versions of the Opera web browser that may be in use on the Wii orcome preinstalled on some cellphones, or that are available as a free download from Opera Software ASA of Oslo, Norway.

"Don't worry your Wii is not in grave danger," David Rayhawk wrote in a cautionary note posted to the security firm's McAfee Avert Labs blog on Friday.

Net securityjargon
BOTNETS are networks of computers that have been hijacked by malicious groups or individuals to do their bidding. Their owners are usually unwitting victims who have no idea their machines have been infected and turned into so-called zombies.Botnet operators often rent time or bandwidth on their networks to spam e-mail marketers and phishing scam artists. MALWARE is a catch-all term for malicious software such as computer viruses, spyware and so on that compromise the security or function of people's computers. Phishing is a technique in which criminals try to trick people into disclosing sensitive information such as online banking names and passwords and is often conducted through e-mails. TROJANS are programs that appear to perform one function in order to hide a malicious one. Like the mythological Trojan horse such programs are named after, the deception tricks people into granting them access to a computer. ZOMBIES are computers that have been hijacked by attackers to perform commands and functions issued to them, often without the owners' knowledge. They are typically infected by Trojans that enable attackers to use them in a botnet, which are used to distribute spam phishing e-mails, or viruses and Trojans that let them hijack other computers. An infected computer is sometimes referred to as a bot short for robot.

Net securityjargon

BOTNETS are networks of computers that have been hijacked by malicious groups or individuals to do their bidding. Their owners are usually unwitting victims who have no idea their machines have been infected and turned into so-called zombies.Botnet operators often rent time or bandwidth on their networks to spam e-mail marketers and phishing scam artists.

MALWARE is a catch-all term for malicious software such as computer viruses, spyware and so on that compromise the security or function of people's computers. Phishing is a technique in which criminals try to trick people into disclosing sensitive information such as online banking names and passwords and is often conducted through e-mails.

TROJANS are programs that appear to perform one function in order to hide a malicious one. Like the mythological Trojan horse such programs are named after, the deception tricks people into granting them access to a computer.

ZOMBIES are computers that have been hijacked by attackers to perform commands and functions issued to them, often without the owners' knowledge. They are typically infected by Trojans that enable attackers to use them in a botnet, which are used to distribute spam phishing e-mails, or viruses and Trojans that let them hijack other computers. An infected computer is sometimes referred to as a bot short for robot.

The security vulnerability in versions of the Opera browser prior to version 9.10 stems from the way in which the software handles specially crafted or corrupted JPEG images. The problem can cause the program to crash, exposing machines running an unpatched version of Opera to attack.

The risk to the Wii is only found in the original or trial version of the console's Internet Channel that was available before April 12, according to Rayhawk.

Although there are no confirmed reports of people's Wii consoles being taken over in this manner, the exploit is similar to ones used on desktop and laptop computers that can allow an attacker to gain control of a machine and remotely run software used in phishing scams or botnets, for example.

"Folks that have downloaded the original Internet Channel for the Wii have this vulnerability," he wrote. "That means it's theoretically possible to run malcode and according to the hacker conversations they are trying hard to do exactly that."

Rayhawk explained that the console's browsing software can only be updated manually and that users should do so as soon as possible.

But the risk doesn't end there, he said, noting that McAfee researchers were able to use the vulnerability to successfully crash the browser on cellphones running Opera.

Opera may come pre-installed on some Nokia and Kyocera cellphones. Versions of the browser are also available for phones that run on the Symbian Series 60, Microsoft Corp.'s Windows Mobile, and the UIQoperating systems.

Nokia cellphones run on Series 60, while Windows Mobile is used on Motorola Inc.'s Q, Palm's Treo 700wx and other devices, and UIQ handsets include phones by Motorola and Sony-Ericsson.

No phones offered by Rogers Wireless or Bell Mobility come with Opera pre-installed,company spokespeople toldCBC News Online. Spokespeople for Telus did not immediately respond to CBC's inquiry.

An Opera spokeswoman told CBC News Online that the company was looking into the matter.

CBC News Online was not immediately able to reach Nintendo spokespeople.

CBC's Journalistic Standards and Practices|About CBC News

Corrections and clarifications|Submit a news tip|

External Links

McAfee blog post