The web browser hack for uploads has been known for over two years and was made public at DEFCON http://www.defcon.org/images/defcon-18/dc-18-presentations/Lin

The web browser hack for uploads has been known for over two years and was made public at DEFCON http://www.defcon.org/images/defcon-18/dc-18-presentations/Lineberry/DEFCON-18-Lineberry-Not-The-Permissions-You-Are-Looking-For.pdf http://www.defcon.org/images/defcon-18/dc-18-presentations/L... See page 32 Also, I'd like to add that saying the ability to list packages on the device is a security risk is just silly. That's like saying a Linux box is vulnerable because I can list /usr.