WM6 + Voice Command Conundrum
Well a few weeks ago the tinkering within me to play with WM6 took over and commanded that I revert back to Windows Mobile 6 (a.k.a. Crossbow) and in doing so I have had the opportunity to do some pretty interesting things. Recently, however, the most interesting/alarming thing I did was use my phone despite the password lock.
Now those of you who are familiar with the Windows Mobile platform you know that you can go to Start—Settings—Lock and input either a simple password or a complex password to lock your device after X minutes.
So as my phone sat next to me and the password lock screen came on, I just wanted to know what my battery status was but was feeling a little lazy to actually input my password just to read my battery status. So I said, let me just try using the voice command function to check my battery status. So I push the button it beeps (letting me know it is ready for my command) and I say, “What is my battery status?” and it replies, “The battery level is 85% and charging.” I was impressed, so I thought….”hmm… let me try calling someone.” So I pushed the button again and said, “Call Voicemail,” immediately I heard the dialing noise and was connected to my voice mail asking me to key in my code. So I thought…this can get interesting. Next I thought could I run an application? So I pushed the button again and this time said, “Start PowerPoint” and what do you know the password lock screen was sent to the background and PowerPoint came to the foreground. At which point I was now able to tap on the Start Menu and go to Programs or even Settings and fiddle around until my hearts content.
So now I’m thinking, well this is Windows Mobile 6 and since it’s technically not final it just might a bug that Microsoft will work out once it is released, but then I started thinking, what if it isn’t a bug in Windows Mobile 6… What if it is a bug in the Voice Command software?
Now the most secure thing Microsoft could do is when the password lock screen comes on disable all buttons except the Accept Call, End Call, and Power Buttons, or disable voice command from being called when the screen lock is on. But in both cases I thought Microsoft might not want to shoot themselves in the foot too quick. I thought how can this possible vulnerability be turned into something that would help Microsoft…simple only allow specific functions of voice command to work in the even the password lock screen is activated. Specific commands that should be allowed would be to call, or request the status of your battery level, or signal strength.
Well that’s enough for now, I hope this will be corrected or I don’t think too many corporate/business users would like to have voice command on their units since it allows them to by pass the password functionality giving a potential malicious user access to all the devices data.
Just imagine this video but instead of the device wiping itself or the finder/theif being deterd by the password lock screen imagine them saying “Call Voicemail” (and for those who don’t have password security enforced on their voicemail) being able to listen to one’s voicemails, or even saying “Show Contacts” or “Start Notes” or…. well you get the idea.
If video goes off line for some reason, you can download it from here:
Download: Final-MobilityV7-300K.zip – you might need VLC Player to view this.
*UPDATE*
Well as it turns out it was just a fluke that this happened. I continued to tinker with my device (trying to get the T-Mobile Mail Trigger Settings to work without the annoying prompt) and a few soft-resets later the device no longer responds to the Voice Command application launches. It will now function like it should, meaning that you can check battery status, signal strength, and call your contacts. You can still launch applications; however, they will NOT come to the foreground replacing the password lock screen.
And just in case you were wondering about the T-Mobile Mail Triggers, yes I did get it to work.