Hot answers tagged

65

Various commentators suggest that this would be possible, on the specific hardware involved in this case. For example, Dan Guido from Trail of Bits mentions that with the correct firmware signatures, it would be possible to overwrite the firmware, even without the passcode. From there, it would be possible to attempt brute force attacks against the passcode ...


46

After doing some research, I now believe this is possible, but that it isn't very easy. Without getting too technical, if you look closely, Apple repeatedly implies that they can do it: The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. But now the U.S. government has asked ...


29

The whole story is weird. Since the iPhone in question does not have a tamper-resistant device, the FBI should be able to open the case, read the whole Flash chip, and then run the exhaustive search themselves without even running the phone's firmware. Updates from Apple should have no effect at all. (Edit: in fact it is a bit more complex; see below.) ...


27

Could they actually accomplish this for an existing encrypted phone? Yes. They could provide a compiled image of os with anti-bruteforce features disabled. The fact they're making an open letter IMHO means they've already exhausted all excuses to not do so, implying they are fully capable of doing it. They would have to be able to auto update a ...


25

Unfortunately, unless you sniff and inspect your own traffic, you can not... My advice is not to use built-in browsers that do not indicate the protocol being used to handle sensitive information


17

Only Apple knows, but I'm going to guess they won't do it. I suspect the FBI has a pretty good idea what is and what isn't possible, especially since Apple has otherwise been cooperating with them. Also the people who work for the FBI aren't idiots, and I bet this isn't the first crime they've investigated with an iPhone. Furthermore, Apple's argument ...


16

I am trying to mitigate SSL bypassing on a jailbroken iOS. ... My application handles confidential data so securing from SSL kill switch and mobile substrate is necessary. There is nothing to mitigate here. SSL is only used for transport level security, that is to protect everything between the client and the server. It is not used to protect the data ...


15

You can't. This is a fundamental principle of general purpose computing. You're running into Shannon's maxim: The enemy knows the system. One ought design systems under the assumption that the enemy will immediately gain full familiarity with them. Just to make my point completely clear: you're giving someone a car, and asking them to only ever drive ...


15

There have been some other good answers here, but there are some other measures that can be useful too. In fact, not all of these are particularly technical. As others have pointed out, adding a passcode to your iPad will allow for full system encryption, which prevents anyone from stealing data from the device. Combining this with auto-lock and auto-wipe ...


14

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


13

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?


13

Please refer to Thomas Pornin's answer. Apparently, they don't even need Apple's help for this. In my opinion, they're trying to create a legal precedent. My question is, if the cracking takes seven minutes, why not just release the update, wait ten or so minutes (coordinate with the FBI on this) and then release another update rolling back the change. ...


12

In terms of the second part of your question about the privacy trade-off, that's very dependent on the organisation in question and their priorities. Unfortunately a lot of companies would place their security concerns much higher on an agenda than privacy concerns for their employees (unless regulatory requirements dictate otherwise). On the first part, ...


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


9

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


9

Start with the Emulator and Simulator, which are part of the standard SDKs. If you prefer certain environments over others, you will gravitate towards a reliable framework for pen-testing these platforms. For example, with an iOS app, I always start with the iOS Simulator after building the code in Xcode. I set my Mac OS X system HTTP and SSL/TLS proxy to ...


9

As @StefHeylen says, you can't, generally. And as @d1str0 says, Burp is one way to see if the traffic is encrypted, if you can proxy the app through it. It's actually worse than that though - mobile apps don't always only make a single connection to a server. It's not uncommon for them to use HTTP for some parts, and HTTPS for others. They can also do some ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


8

Are jailbroken iPhones an enterprise security risk? Potentially. I think it is hard to determine without data. On one hand, users who jailbreak their phones are typically knowledgeable about computers and mobile devices. They may be less susceptible to phishing and may be more vigilant about their device's security. On the other hand, jailbreaking ...


8

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


8

I'd scrap the direct syncing option and simply allow the user to export their private key to a location of their choice, e.g. iCloud, DropBox, internal storage, etc., in an encrypted format. On export I'd do something like this: Ask the user for a password to use. Don't impose any restrictions on them - it's their job to use a good password! Use a strong ...


8

Question Restatement: Could [Apple] actually accomplish this for an existing encrypted phone? If yes, then isn't simply knowing this is possible also undermining the security? It seems to me it would be just one step removed from the backdoor they are trying to keep closed. Quick Answer: Yes, Apple can easily modify their minimal version of ...


7

I know there is a great example and discussion on this for Samsung devices and Android, so you might want to start there and see if it takes you to where you want to go with everything else. http://developer.samsung.com/android/technical-docs/Neat-tricks-when-implementing-a-kiosk-app Removing the title bar and status bar ... you may want to ... remove ...


7

The bug isn't with the file format, it's with the software of Hangouts the Android software library. iOS, Android, and Windows phones run system software from three different groups of developers. As such, this vulnerability probably doesn't exist on other platforms. Even if it did, one payload couldn't affect all three systems, because their software isn't ...


6

The Ubertooth one will allow you to sniff bluetooth traffic. It is fully capable of being placed into monitor mode and can be used with tools such as Kismet to perform bluetooth sniffing. There may be additional functionality that will allow you to perform packet injection as well. However if the traffic is encrypted this may not allow you to see the ...


6

It's probably justified, because with the speed of which computing power increases, older encryption quickly become weak, what once was considered "too hard to break" becomes feasible. Apple do have the habit of educating their users / developers, which also tend to be lazy and neglect such issues, so this is probably a good thing, especially when solutions ...



Only top voted, non community-wiki answers of a minimum length are eligible