RNDIS exploit in ActiveSync provides command line access to PCs


Ruh-roh Shaggy. From the clues provided it looks like having ActiveSync installed on your Windows XP machine is a crime. Unless you like leaving your computer open to be exploited that is. Apparently, the addition of RNDIS or Remote Network Driver Interface Specification in AS 4.x was meant to be used only for good. It allows you to sync data through IP packets over USB, for example. That’s good. Turns out that RNDIS can be used for bad, bad, bad things too.White Wolf Security was able to exploit the use of RNDIS to gain control of a Windows XP computer with their own Windows Mobile device. In fact, a user could have logged out or locked their PC, but it wouldn’t matter if ActiveSync is installed. They created a proof-of-concept application appropriately named ActiveSinc and… well, you be the judge. I sure wouldn’t want anyone to have command line access to my desktop or notebook through their Windows Mobile device. I’ll stick with over-the-air synchronization, thank you.


Comments have been disabled for this post