New answers tagged

8

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states that this phone was explicitly chosen because of the KNOX technology which includes secure boot and separation of work and private activities. The reason this ...


0

I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...


1

My question is are they talking about whole javax.crypto package ? No. They are referring to the Crypto provider for javax.crypto. Do I need to remove these all ? No. So long as you did not manually specify to use the Crypto provider, you are fine. Search your code for the string "Crypto" (with a capital C).


1

Android is an open source system. Its the users choice what to do. If he wants to install pirated apps google will not stop him. If google would, the users would disable google play and youre still not blocking pirated apps.


5

So both of your scenarios rely on the attacker having root access to the phone. In security, it's generally considered that once an attacker has root access, it's game over. That said, there are still interesting things to be said about your question. You asked: Is there a situation where the secure element does offer a clear security benefit to this ...


3

If someone were to find a vulnerability that would affect a specific library that could maybe pose a threat to our app The defense against that is not to use the library. Using the library and not documenting it does not change the fact that your application is vulnerable. Not documenting that you use the library makes is marginally harder for people to ...


1

There may be a potential risk if you disclose libraries with known or later to be discovered vulnerabilities. This is no different than a website using WordPress and a popular image plugin that becomes comprised to allow shell uploads or an OS that has a program that allows someone remote access through an exploit. If the attacker knows the vectors exist in ...


2

Your case is documented in the Trillian Security Practices. The mobile device version of the software will store your Google password encrypted on the company servers of the Trillian developers. This allows them to keep your GoogleTalk session alive, even if your mobile device has bad connectivity. It also allows you to use the web version of the Trillian ...


0

Download the Signal app for private and encrypted end to end conversation Those who are using Redphone and TextSecure RedPhone users will be prompted to download the new Signal app, while TextSecure users will simply need to install an update that keeps the same private chat capabilities as the previous app, also adding RedPhone's ability to make ...


-2

Yes, you can. In fact, you don't even need the meterpreter session. You can access to Google Play from a different device (while logged in) and choosing install it will install the app in your device (as soon as it connects), assuming that it uses Google Play.


3

Update in response to your edits in the question You are correct that validating a cert up to the trusted root is not 100% foolproof. What it guarantees that a trusted CA issued this cert to the domain that you are communicating with (because you can check that the URL in the cert matches the URL that you are establishing the SSL connection with). This was ...


0

Another thinbg you can do is remove it from "Trusted devices". Login to last pass. View your vault. Account Settings (near the bottom left of the screen). The third tab in the popup window is "Trusted Devices". Disable or Delete the broken phone.


0

First, a user should be reviewing permissions for an app. I would never authorize an app to do stuff like overlays or camera access without a good reason; the only permissions I grant are those I expect. Even if the app did get camera permission, there's always increasingly aggressive actions the user could take to resolve the situation. Keep popping up in ...


2

If the app can access the data locally (on the user's device), then a determined individual can as well. If you really want to keep the values secret you could consider having the app send the user's input to a server (which you would control) which both stores the secret values and computes the value for the user. The server would then send the value back ...


0

Great question, and welcome to the landmine of mobile encryption! Unfortunately the answer really depends on which iPhone model / Android manufacturer your app will be running on. Here's a little dump of what I know. Hopefully it'll get you on the right track! Both iOS and Android provide crypto (encryption) libraries in the OS. You should be able to ...


0

Depends on the cable. If it's a cheapo "one-size fits all" charger cable like this, (sold in chain store pharmacies like CVS, Walgreens, etc), it might have fewer wires, (to save on manufacturing costs). If the data wires don't exist, it can't transmit any data. Instructables has a how to for making a two wire cable. Summary, open cable sheath, see ...


0

If your application is able to request the key, an malicous application is able too. The only way i know to prevent this is blocking malicous users based on their ip.


0

Personally I use CM Security which uses application based security... it's free and does everything you're asking for. It will also take a picture using your camera and email you when someone fails authentication of your CM Security password. It's definitely been helpful for me I love that app. You can lock down any app you want on your phone or EVERY app ...


2

The core of your question seems to be: If I lose my phone, can I prevent the attackers with physical access from installing apps through the apps store? The hidden assumption here is that you don't mind if they get into your device and root around in the apps / data that are already there, but you really don't want them installing new apps. Well, they'...


1

is there a way to disable app installations until you provide a certain PIN? Possibly via a device owner app, but that has to be set up when the device is first powered on. Or, possibly via a custom ROM. Otherwise, no. even though I'm using fingerprint - but you never know. I would not bet against it that there is ANY way to break into the phone It ...


6

There's also the possibility that it's not actually an Android phone, but a "USB Killer" of some sort: This is a device which, when connected to the USB port, will send -220 volts down the data / power lines, thereby frying the USB controller and possibly other components of your laptop. This one looks like a flash drive, but it could easily be made to ...


5

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP ...


59

Firewire and also Thunderbolt provide direct access to the OS memory, thus bypassing the operating system. See Wikipedia: DMA attack for more details on the possible attacks. USB does not provide this kind of direct access. But it has other problems like the ability to unexpectedly emulate devices like a keyboard, see BadUSB.


15

Yes, but you can mitigate the risk by using a USB condom that does not connect the cables that convey data and communication, but leaves the charging pins live. You would still be exposed to attacks that can take place over the power cables, such as the device supplying a very high voltage or current back to your laptop. Presumably MacBook USB ports have ...


3

There would never be a valid reason to use SSH for communication between processes running on the same device, unless that device was used to simulate a network, in which case it would act as multiple virtual devices anyway so technically not be the same device. Use unix domain sockets instead. Note that domain sockets are not the same as the Secure Sockets ...


62

Yes. Android devices have the capabality to act as basically any USB device. This opens up gates for all kind of Bad USB attacks like Rubber ducky attack that types in scripts very fast (Almost un-noticable by the user) by acting as a keyboard (HID | Human interface device). Then it could act as a network device and setup MITM These two are ...


5

There is always the possibility that someone could have found a vulnerability that could abuse the system at any level. Vulnerabilities have been found continuously on all systems throughout the history of computers, so it is not impossible. That said, the risk seems fairly low.


16

This could get dangerous if you have autorun enabled. Malware can get executed automatically this way. "Fortunately" autorun isn't possible in vanilla Mac OS X, so you shouldn't be too worried. (Of course there are many more possibilities to run malicious software too.) The smartphone pretty much acts like an usb stick. So every security risk you get with ...


4

All android apps must be signed by developers using self-signed certificates or by third-parties, such as an OEM, mobile operator, or alternate market. When apps are updated, the updated versions must be signed by the same developer. Additionally, applications can share permissions if they are signed by the same developer. Apps on Google Play are also ...


1

@Wish_Wu recently did a demonstration of these exact security vulnerabilities to full exploitation at the HITBSecConf in Amsterdam. Here is the slide deck -- http://conference.hitb.org/hitbsecconf2016ams/materials/D2T2%20-%20Wish%20Wu%20-%20Perf%20-%20From%20Profiling%20to%20Kernel%20Exploiting.pdf The bugs involve the perf_event_open capabilities shipped ...


0

This kind of issue documented as “allows attackers to gain privileges via a crafted application“ is published a few times per month. Similar circumstances are usually also part of the monthly patch releases of Apple iOS too. Exact details are often missing. But in most cases it is necessary that an attacker is able to run his own code on the device. This ...


0

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. 2FA relies on the idea that the the device is actually fully owned by the user. If applications are installed which controlled by the attacker are able to intercept SMS etc the device is no longer fully owned by the user, since the ...


1

Relying on mobile as a second factor is somewhat haphazard anyway - there are increasing numbers of people relying on mobiles as primary internet access devices (especially in countries with limited wired infrastructure), so an app on a phone, an SMS, or an email can end up on the same device the attacker is using. This already causes problems - try making a ...


0

It notes on the same page you referenced that a temporary filesystem is loaded into /data, while the rest of the phone storage is encrypted. The purpose of this temporary file system is to perform the functions necessary to enable you to decrypt the phone, see a simple progress bar when decryption or to wipe the phone entirely. If you go to the section ...


1

To verify whether an APK is safe, you can upload it to e.g. Virustotal. It will use a bunch of virus scanners to detect whether anything is wrong with the APK. Note that APKs are (at this moment of writing) the #1 file type being scanned by Virustotal.


2

During the installation process, Android isolates apps from one another and from the system by assigning them a distinct Linux User ID (UID) for security reasons. This UID doesn't change for duration of app's lifetime on the device. The system maintains a list of UIDs in use, and assigns the next available one to the newly installed app. Device rebooting ...


1

I've had good success with the following Android proxifiers: ProxyDroid Postern ProxyDroid has one draw-back; your phone must be rooted. To the best of my knowledge Postern will work on an un-rooted phone.


2

The best practice is to not store the access credentials within the program. Apps do not always contain (unless they are badly designed) any specific credentials within themselves to access the API. While adding credentials into the code may deter general attackers it will not stop attackers who can open up the package and extract the details. As something ...



Top 50 recent answers are included