Pocket PC Phone Edition Security Research

This material describes some aspects of the Pocket PC Phone Edition and is also background information to a presentation given at the Amsterdam Black Hat Briefings 2003 in this Powerpoint presentation and later at Hack in the Box in Malaysia in slightly different presentation. More XDA and Pocket PC research can be found at XDA Developers.

General security observations

Although there is a tendency to consider PDA's as insecure defacto (which is good), it still pays off to delve a little deeper into technical reasons why this is justified.

Insecure bootloader

Because most Pocket PC devices have insecure bootloaders, simple protections can easily be circumvented. This is demonstrated by wiping the PIN or password protection on an XDA.

Radio Interface Layer (RIL) research

The RIL is used to communicate between the Pocket PC and the radio module (in our case GSM). For some reason Microsoft did not want to disclose this API, but luckily they provided it in a patent application.

XDA Manipulator

A page on the XDA Manipulator, which is part of the XDA Developer project.

Resources and links on Pocket PC security
Some links that were encountered during the research.