Tag Info

New answers tagged

0

Your service provider has a registry with every customer and latest cell id they have visited. In this case the location accuracy depends on the density of cells, usually the radius is something in range of 300-1000 meters. Combining several records, you can triangulate the device location quite accurately. If the SIM-card is removed and the phone was taken ...


-1

Call the sendPostRequest(String username, String pass) method with parameters. You can call this method from the UI thread, the request will be sent from a different thread (AsyncTask is embedded).


3

The underlying issue isn't technical, it's incentives. What's the incentive for the phone makers to protect the device from a customer rooting his/her own phone? Not much. I'm not sure where you're getting your quote of millions of people rooting android devices, but I'd be surprised if it's in the millions. In any case, the vast majority of people ...


5

Android Isn't Android Android rooting is tough to fix due to the nature of Android. Because Android is open source, each manufacturer (Samsung, Motorola, Nokia, etc) takes the base Android OS and modifies it: Drivers to work with specific hardware Custom messaging, call, or system apps GUI changes to make their phones unique System backup mechanisms ...


3

There are many different reasons. Like Natanael says, there isn't just one exploit to patch. If you are refering to a specific exploit, you didn't say so. And keeping patches up to date for such a huge and diverse ecosystem is expensive. Google does not want to maintain back versions of Android operating system. Yet, millions of these devices running ...


1

you could try drozer by MWR Labs. it's pretty much meterpreter. it can be a little hard to get the hang of at first, but i'm pretty sure it'll do what you want. it does require an .apk install though.


0

From the UI snippet alone, we cannot tell much, but given your pseudo-code of: http:// + {Whatever host they typed} + : {Whatever port they typed} + /path/ You might be in danger of someone crafting the following input: http:// + {evil.com/evil_script.php?http://10.16.1.159} + : {8080} + /path/ In this case, the evil script now can input to your website ...


0

Try this: ssh cody@localhost This works for me, so it should work for you with an ssh-server installed, unless you have blocked the port. But for what purpose - on the same device? I doubt if it would make things more secure.


1

Heartbleed is primarily a server-side vulnerability and not in the client. You, of course, cannot detect the server-side problem from examining the client-side code. Even if the client has very old SSL code, you don't know what the server is running. You can test the server for heartbleed at https://filippo.io/Heartbleed/. Heartbleed on the client will ...


4

Everything is retrievable if it's not overwritten. On solid-state devices like our phones we need to be careful to start from an encrypted starting point to avoid some of the theoretical recovery (ForensicsWiki). Short answer, Oxygen is something I've used to pull data off phones, but all it really requires is physical access, take a physical image, and ...


1

JDK contains Java plugin for browsers, so if you didn't have any previous JDK/JRE on your computer, you expose yourself to attack using malicious Java code from website. Of course you can manuall disable Java plugin, but you have to do it separately for every browser and user. If you have some previous JDK/JRE version, then most probably you will just ...


1

geek_ji, You don't have many options to solve this really. 1. If you remove offline playback, then you can just use HLS with encryption, with the stream hosted in the server. 2. Allowing offline playback, as you said, will need to somehow encrypt/decrypt the video. You could always leave the public key (encryption key) stored locally for encryption, but ...


1

A CSRF attack can only happen when cookies (or other authentication mechanisms) are provided by the client automatically. That is, where the client has access to cookies from multiple domains (such as a web browser storing cookies for each site you visit). However, a mobile app containing a web viewer will typically only have the cookies for its own system. ...


2

Android devices are vulnerable to DDOS attacks. The Android Operating system does not contain any special protection against DDOS attacks. (However, DDOS attacks are typically aimed at web servers with the intent of preventing legit users from accessing them and Android OS is not used as a web server, so you are unlikely to find a DDOS against it) In ...


4

I haven't studied this specific vulnerability, but from the points you mention I should note: Cross-Frame-Options is not used too much on websites. Although this SOP vulnerability is dwarfed by X-Frame-Options, two months before there was another one where it didn't seem to matter. Most outdated phones where you will be able to exploit one of them, most ...


1

XSS is usually an attack against a server. Unless your phone is serving Web pages to external connections this should not be a problem. If your server that is serving the pages to the phone is vulnerable then XSS is identical to a normal website - with the exception it may be harder to trick someone into following a link. Unless your application takes in ...



Top 50 recent answers are included