Tag Info

New answers tagged

1

You have the right idea, namely a shared secret that is never transmitted from one device to the other. If you do that, you should not need to worry about MAC addresses or MITM attacks. You are vulnerable only if attacker can get that shared secret. Since the shared secret is the {ahem} key, you need to be confident that it cannot be generated ...


1

About two years ago there was a website "jailbreakme" that allowed jailbreaking a device just by visiting it; it exploited a vulnerability in Safari's built in PDF viewer and then probably other vulnerabilities to gain root privileges and modify the kernel to allow non-signed code to run. Although this has been patched, this proves that a mobile device is ...


1

A simple visit to the most innocent website you know, may trigger an attack that can lead even to a total control of your machine. Drive-by download attacks that can exploit the vulnerabilities of your browsers and or their plugins and install without your consent or knowledge more or less dangerous malware.


3

What day of the week is it? In theory, no. Merely visiting a site will not infect you. But as they say, the difference between Theory and Practice is that in Theory there is no difference. I practice, defects in the implementations of some components of the browser are found (sometimes in Javascript, sometimes in Java, sometimes in PDF renderers, ...


2

Yes. When you visit a webpage on your iOS/Android device JavaScript may be loaded. This is the most common vector of attack. Case: Android Case: iOS (These two examples are just the top hits on Google, there are many examples of similar exploits/malicious cases)


4

I would suggest storing the model on server, and then having the app Query the server with input to the model, and getting response back. If you dont want competitors to be able to use your server as the model itself, I would suggest requiring users to register, and then imposing a limit on how many model queries that can be done per second or per minute, so ...


1

Basicly, no... in more details... you will have to give the "app" some way of using the model. which means that ALL methods of encryption require you giving the "app" the keys to the encrypted content. even sending it to the app over the Internet does the same. so basicly all you can do is making it not so easy to get the model. but flat out prevention is ...


0

Given the close living quarters of the subjects in question, it would stand to reason that Bluetooth or NFC would be the preferred method of data transfer. And if we're dealing with an android OS, i can tell you from person experience it's a nothing deal to turn NFC or Bluetooth functionality on- even if you have them disabled in your settings. Both of mine ...


1

The different encryption architectures between Android (block level encryption) and iOS (file level encryption) creates different behaviors when a file is deleted: With block level encryption, when a file is deleted, the filesystem unlinks the blocks from the filesystem but does not actually destroy the data. As most Android devices use NAND flash which ...


1

If you're calling a foreign API (e.g. Twitter) for which your entire app has a single API key, you can either: Share your API key in your app -- a "not-secret secret". It's a crappy situation, and you can obfuscate the key somewhat. But if it's client-side then there's no protecting it. End of story. Keep your API key on your server and proxy API calls. ...


2

It's simple. Never trust the client. Never rely your business on storing any secrets in the client that the user are not supposed to know. It doesn't matter whether this is Android, desktop, or whatever. Unless you're prepared to secure your device like an ATM (bolted onto a wall in a weighted safe, and cameras all around), the client is not to trusted. ...


0

No. You should not click install the app. The process I go by is quite simple: So back to the simple process again: 1) What is the app doing? 2) What are the permissions? 3) Is that permission really needed? Now let's look at a simple example. What is the app doing? Eg: Simple text editor.(Read/Write stuff from/to files) What are the permissions? ...


0

No you should never click "install the app" if you don't know/trust the developer neither on mobile nor PC. If you used to install everything on PC that's your problem, but you shouldn't do that because anything you install has full access to your data (worse, many installers require administrative privileges which means they get full access to your system, ...


0

WLCTL (Web Listener Control) Utility is a UNIX utility, so I would recommend getting some sort of terminal emulator app and run the command "top" or "htop" to display the running processes, once you sort through the necessary normal processes and isolate the one that is sending out these packets, you can run the command "pidof [process name] " without the ...


0

Indeed, without full disk encryption they will dump everything from the flash/sdcard regardless of your password, which should not be confused with the numeric PIN used to decrypt the SIM card. When DMCrypt is employed, including the sdcard, it should be reasonably safe with a good password exceeding 12 random characters (pv9?PLJthL`A). With pbkdf2, this ...


1

The primary vulnerabilties involved in the WebView component are Insecure Direct Object References, SQL Injection, and Cross-Site Scripting (XSS). While all three are potentially huge risks, the XSS vulnerability potential can be used to gain access to shared preference files using the file:/// command or can utilize smsJSInterface.launchSMSActivity to send ...


1

Shipping application with debug means that anyone with physical access to the device can execute arbitrary code under that application's permission. If the application holds sensitive data, it will be fairly straightforward to extract that sensitive data from the application. Doing the same on nondebuggable application would require the attacker to first ...


0

This could be an attempt in protection of application against the device owner. It may allow you to extract sensitive data (ie. some banking app token), or to elevate execution privileges, if that app has system UID for example. How? By using connecting the debugger to application over adb, you can trace the code and execute other code. You can also use ...


1

However, the webservice for creating the account has no restrictions, meaning an attacker could spam GET requests to it from any device to create any number of users they want and flood the database/server. My question is, how can this be avoided? You can use a mix of CAPTCHA and IP restrictions to avoid such type of attack. IP restrictions: ...


-1

However, it's not login-based in the traditional sense that users don't sign up with an email or anything. We just automatically create an account for them with some randomly generated UUID as their "login" to the service. If you are just allowing ANY user to create an account with your application, without providing any personal information, it ...


1

You can try pasting it into notepad, print it out, then enter it manually into android. If its like 100 characters long, this is one good reason for why you may want to make it shorter. I asked a question about how long is too long, and after 22 characters a password stop making sense. I have the same issue. My windows account and iTunes passwords I ...


5

Since applications can continue to execute in the background, the disk encryption key has to exist somewhere in memory. There are differences among various Android versions in how the encryption key is derived from a passphrase or PIN, but all versions use the dm-crypt block-level disk encryption service of the Linux kernel. (Unlike iOS, Android doesn't use ...


1

I don't think apps like that can exist on the current smartphone app markets, first because there are no APIs to directly control the modem to make calls and send an audio stream, and second because setting up a data link over an audio connection is possible but extremely slow and unreliable, too slow to pass any kind of encrypted VoIP traffic on it. ...



Top 50 recent answers are included