The tag has no wiki summary.

learn more… | top users | synonyms

11
votes
5answers
1k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
11
votes
2answers
1k views

Snowden: “The NSA can remotely turn on your iPhone.”

Watching the Snowden interview last night, Brian Williams asks him what degree of control the NSA has over smartphones -- in particular, whether or not they can remotely turn them on in order to ...
10
votes
8answers
647 views

iPhone Tracking debacle - risks and countermeasures

For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
8
votes
1answer
370 views

Getting strange texts to an iPhone #PWD123456#00X

My dad is getting strange SMS texts to his iPhone 4 Some examples: #PWD123456#WHL003=2308480298 #PWD123456#WHL004=2398480389 #PWD123456#WHL002 #PWD123456#WHL002 #PWD123456#STATUS? ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
5
votes
2answers
185 views

How much should I care about the iOS/Android version when pentesting mobile app?

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application? I.e. if I test mobile application ...
5
votes
2answers
507 views

Is iPhone's fingerprint signature a one-way hash?

I've been considering the security of the iPhone 5S fingerprint feature. My main concern is, not that someone could replicate my fingerprint in the physical world and bypass the phone, however that ...
5
votes
2answers
4k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?
5
votes
2answers
4k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
5
votes
3answers
286 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
4
votes
3answers
27k views

IP address of an iPhone

Recently I logged on to my bank account via the Chase app on my iPhone. I received a message that another device was currently logged on to my account and "would I like to end the session"? Of course, ...
4
votes
3answers
279 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
4
votes
1answer
154 views

Installing profile on “Good” Mail application give someone admin permission on my iPhone

My new enterprise use the app "GOOD" for the emails. But to use it, I have to install a GOOD profile with description : "Install this profile to enroll to encrypted profile service". If I choose ...
4
votes
2answers
403 views

iPhone\Network Security

A client of mine is concerned someone is retrieving data and intercepting text-messages from his iPhone and his home network. He has told me that he has seen one of the text-messages he sent to his ...
3
votes
5answers
3k views

How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?

Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a ...
3
votes
1answer
469 views

How resistant is the iPhone encryption against brute-force attacks?

I just read the following paragraph in an article from the New York Times about Apple encrypting iPhones by default): Breaking the code, according to an Apple technical guide, could take “more ...
3
votes
1answer
535 views

iPhone iOS 7 Encryption at Lock Screen

Following this topic, I have a question about how the OS and apps access data while the phone is locked. Particularly in the case of iPhone 5S running iOS 7. When the device is locked, what allows ...
3
votes
1answer
780 views

Storing session key for iOS app

For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem ...
2
votes
2answers
130 views

Security through obscurity - “https requests” are safe?

In an iPhone app that utilizes plain text (unencrypted) XML as the contents of its http POST requests over https to the app server; how would someone be able to discover the "format" of the plain text ...
2
votes
3answers
393 views

How can the NSA remotely turn on your iPhone?

If the iPhone is actually off and not in sleep mode, how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots?
2
votes
3answers
333 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
2
votes
3answers
119 views

Known windows malware propagated via unmounted iPhone

Last week I was told by our security department that my PC (running windows 7) was infected by a trojan and that it needed to be re-imaged. So re-imaged it was! Given the fact that I had been using ...
2
votes
1answer
7k views

How to track a Spoofed SMS on Iphone

A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
2
votes
1answer
321 views

Does turning off an iPhone make it safe from “juice jacking”?

Would turning an iPhone off when charging from an untrusted charger make it safe from juice jacking?
2
votes
2answers
4k views

HTTPS verification failed - get certificate information iPad/iPhone

I went to log onto my bank's internet banking website this morning using Google Chrome browser on my iPad. I get the red error message of death. I can't figure out why. It's happening on both my ...
2
votes
2answers
923 views

Mount Iphone for Forensic Analysis or Take Forensic Image

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the ...
2
votes
1answer
329 views

Route traffic from iPhone to desktop and back

I have some iOS app to pentest, and the target server is accessible only through the jailbroken iPhone's APN. My problem is, that I want to configure the traffic in such way so I can intercept and ...
2
votes
1answer
2k views

Is there any way to list the contents of the iPhone/OSX Keychain and their security level?

I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone. Since it's possible for keychain items to be bound to a device (and ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
1answer
31 views

Meterpreter on non-jailbroken Iphone [on hold]

I found this at github: https://github.com/AnwarMohamed/meterpreter-darwin Does anybody know if this works on a non-jailbroken Iphone? I downloaded it on my and double-clicked on the Makefile-icon, ...
2
votes
2answers
1k views

Retreive header from SMS iphone

I received a lot of SMS from a guy where the phone number change every time. I can answer to these SMS, so I think it's only a spoofing of the sender ID of the SMS header which will be displayed in ...
1
vote
3answers
3k views

How did my network admin identify my iPhone and how can I hide my ID?

I recently got a call from our network admin asking that I stop the app updates on my iPhone to open up bandwidth. It is my personal phone. My question is 2 part: Out of all of the personal devices ...
1
vote
3answers
626 views

How secure is iOS Touch ID?

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". ...
1
vote
2answers
1k views

How to prevent user from recovering my iPhone data?

If I'm about to sell my iPhone 5, is there a way to make sure that the buyer won't be able to recover anything from my data? Both data that has been recently deleted and data that has been deleted ...
1
vote
2answers
232 views

Dealing with a (possible) virus on both MacOSX and iOS

The symptom: On MacBookAir, in Safari, FF and Chrrome, when accessing www.google.com, I get redirected to a http://developer.yahoo.com/yql/ web page. On iPhone, when navigating to google.com I get ...
1
vote
1answer
87 views

how to trace or get evidence you've been hacked [closed]

my devices and my network have been compromised. I foolishly left my router unprotected and they were able to gain access to all my apple devices and then install some sort of software that will take ...
1
vote
1answer
4k views

What details does my iPhone reveal about the user (if any) when I connect to a wifi network?

I accidentally used my work's wifi to look at porn using my iPhone. I refreshed a tab I had open from a session when I wasn't at work. Now I'm worried my firm will find out. The network is ...
1
vote
3answers
93 views

iPhone 5c iOS 7.1 deleted video recovery?

Can a video that was deleted from an iPhone 5c running iOS 7.1 be recovered? 1) the video was not in the camera roll 2) the video was deleted 3 weeks before seizure of device 3) app used to ...
1
vote
1answer
277 views

Multiple people have the same iPhone IP address

I am an admin of an immigration forum. Security is my job One and protecting our members's info is my highest priority. Recently, I discover that there are 3 members who have posted from the same IP ...
1
vote
1answer
211 views

What encryption does Apple use?

With their iOS devices, Apple allows people to block certain applications through "Restrictions". I recently had an issue with my iPhone where I'm positive that I entered the correct passcode on my ...
1
vote
1answer
72 views

Can I reliably identify Apple devices that have not patched against the gotofail vulnerability based on user agent string?

The title pretty much says it. Do the security patches to address the gotofail security issue in multiple Apple products employing SSL change the User Agent string for the respective systems? And, of ...
1
vote
2answers
151 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
1
vote
1answer
195 views

Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?

Suppose I work for a bank and am asked to write an NFC payment app for the iPhone 6 or Android but not use Apple Pay. To simply send the credit card details to the reader via NFC. Now assume I'm not ...
1
vote
0answers
550 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
3answers
123 views

Restrict request to Android and Iphone App only?

I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
0
votes
2answers
74 views

Company Laptop and iTunes/iPhone

With their permission, I am selling a company laptop that I used, but I had been using iTunes and syncing my iPhone on that PC. Is it possible for a forensic tech to retrieve any of the browsing ...
0
votes
1answer
142 views

how secure is an iPhone 4S+ with iOS 6+ in 2013?

I was searching for the current status of iPhone security: there are many discussions on the subject but a lot of them are mostly hand-waving or related to old bugs/iOS weaknesses. How secure an ...
0
votes
1answer
38 views

Is there a way to securely lockdown a website to an Iphone?

So with a typical website, perhaps the fastest and most effective (arguably) way to secure the site is to add a simple .htaccess and restrict by ip addresses: .htaccess DENY from ALL ALLOW from ...
0
votes
1answer
227 views

What process on my jail broken iPhone is listening on port 80 [closed]

I can access it via telnet from the internet once I get the IP of my phone Probably an HTTP server telnet XXXX 80 Trying XXXX... Connected to XXXX. Escape character is '^]'. HELP ...
0
votes
1answer
74 views

Is it possible someone uses my cell number to make calls for my cell phone company to create a record?

My old cell phone number had made lots of calls I am not familiar with. I was confronted with a list of calls I know I did not call. I was also told that I was using Skype. I have never used skype, ...