Tag Info

New answers tagged

0

There have been efforts to detect IMSI catcher but with limited success. The main problem is the closed source nature of the major mobile phone producers This is the problem because in all phones you have a GSM chip that connects you to the GSM Network. You don't know what happens inside and you can not easily replace it because closed source and ...


1

No, As by the time of me writing this there isn't, at least not to the extent of my research capabilities. Some of the matter's underlying problems are explained quite nicely here. From there we can also see that the disk can be accessed via ADB. And for example in recovery mode you can use ADB to the fullest I'll have to say I find this kind of ...


1

I'm more familiar with iOS, so I'll focus on that. All iOS apps are signed. When connecting to the App Store, the iPhone uses the Secure Transport API, which means you're using TLS. I'm not quite sure what you mean by strategy, but yes the apps are transmitted securely, and are signed by Apple.


0

Any SSL with a single trusted key for each party in this communication would be ok. You would have to exchange keys between devices first. I mean something like pgp-sms, but implemented for communication across wifi


1

Short PIN codes are a serious hindrance for attackers only in online dictionary attack contexts. The distinction is the following: Online dictionary attack: for each potential password/PIN code, the attacker must try it against an honest system (server, running app...). Offline dictionary attack: the attacker could obtain some data (hashed value, encrypted ...


0

Your data is encrypted locally with key derived from your master password hash with 4000 repetitions by default. The PIN is a local convenience option. If you were to install lastpass on a new device, you'd need to enter your master password again. To be clear, the PIN is used to unlock your offline vault. It isn't used for decryption or authentication. ...


1

Yes, if the user can access the data with a 4-digit PIN, then so can an attacker (at least with physical access to the device). My guess is that the passwords are stored encrypted in their original format, but the decryption key (derived from the user's password) is stored encrypted with a key based on the 4 digit PIN. Of course, with that small a space, ...


0

Connect your Android device and your penetration testing platform to a LAN. Conduct an ARP spoof/poison attack against the Android device using ettercap (or your favorite arp spoofing tool). This will cause all packets to and from the Android device to first pass through your penetration testing platform. ettercap -T -w dump -M ARP /xx.xx.xx.xx/ // output: ...


0

There are two things that you should do to solve your issue. One is look into mutual SSL. This will allow your client to authenticate your server and your server will authenticate your client avoiding repudiation. There are a few links on SE about this. Mutual SSL provides the same things as SSL, with the addition of authentication and non-repudiation ...


2

You have encountered two "hard" problems: authentication and authorization. There is plenty of information online on thes topic, but in your case I think your problem goes back to the design of the app. Let us start with two questions: How do you know whether user is allowed to post a high score? (Authorization) How do you know the connection to your ...


2

You can dump the memory info using the Android Debug Bridge (ADB) by using the following command: adb shell dumpsys meminfo > mem.txt To get info for a particular app, use this: adb shell dumpsys meminfo 'your apps package name' This answer gives a detailed overview of the dumpsys tool. Do take a look. Also, this blog post explains another method to ...


0

You have a few options. Honestly, you would most likely want to enable some sort of authentication, like HMAC to send the requests to make sure they are coming from your application. If you don't know about HMAC, google it, there is a lot of content. Take a look at this Security.StackExchange answer: A message authentication code (MAC) is produced from ...



Top 50 recent answers are included