Tag Info

Hot answers tagged

15

There have been some other good answers here, but there are some other measures that can be useful too. In fact, not all of these are particularly technical. As others have pointed out, adding a passcode to your iPad will allow for full system encryption, which prevents anyone from stealing data from the device. Combining this with auto-lock and auto-wipe ...


14

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


12

In terms of the second part of your question about the privacy trade-off, that's very dependent on the organisation in question and their priorities. Unfortunately a lot of companies would place their security concerns much higher on an agenda than privacy concerns for their employees (unless regulatory requirements dictate otherwise). On the first part, ...


12

You can't. This is a fundamental principle of general purpose computing. You're running into Shannon's maxim: The enemy knows the system. One ought design systems under the assumption that the enemy will immediately gain full familiarity with them. Just to make my point completely clear: you're giving someone a car, and asking them to only ever drive ...


11

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


9

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


8

Are jailbroken iPhones an enterprise security risk? Potentially. I think it is hard to determine without data. On one hand, users who jailbreak their phones are typically knowledgeable about computers and mobile devices. They may be less susceptible to phishing and may be more vigilant about their device's security. On the other hand, jailbreaking ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


8

Start with the Emulator and Simulator, which are part of the standard SDKs. If you prefer certain environments over others, you will gravitate towards a reliable framework for pen-testing these platforms. For example, with an iOS app, I always start with the iOS Simulator after building the code in Xcode. I set my Mac OS X system HTTP and SSL/TLS proxy to ...


8

I'd scrap the direct syncing option and simply allow the user to export their private key to a location of their choice, e.g. iCloud, DropBox, internal storage, etc., in an encrypted format. On export I'd do something like this: Ask the user for a password to use. Don't impose any restrictions on them - it's their job to use a good password! Use a strong ...


7

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


6

Use SSL to handle the communications over the internet safely, then hash the password it on the server. Otherwise the password hash just becomes the password, as far as the service is concerned, and an attacker that gains access to your database can log in as any of your users as if their passwords were stored in plaintext. SSL is vital in order to prevent ...


6

Within an unprivileged application, there's no good way to store confidential data and hope to erase it and only it. If you write the data to a file, you don't know where this data will end up. SSD remanence is the least of your worries (and it may or may not be a worry depending on whether the flash controller implements a secure erase — I don't know how ...


6

I know there is a great example and discussion on this for Samsung devices and Android, so you might want to start there and see if it takes you to where you want to go with everything else. http://developer.samsung.com/android/technical-docs/Neat-tricks-when-implementing-a-kiosk-app Removing the title bar and status bar ... you may want to ... remove ...


6

If you're the application developer the best you can probably do is pin the certificate, meaning if you see any certificate other than a specific one you know and trust (e.g. by comparing thumbprint or public key), drop the connection and get out of there. Otherwise you're relying on a system that you have proven to be broken, as per your example. There are ...


6

Once a computer boots, the operating system is given near exclusive control over the system resources (kernel access). After this occurs, if a program wants to run, it must ask the OS to let it run. Before iOS allows an application to run, it examines the code that is going to be loaded in to memory from the binary and checks it against a signed value that ...


6

Theoretically, an iPhone can be configured to encrypt all the "user data" with a key that is ultimately derived from your passcode. However, that does not really save you: If the attacker limits itself to the unmodified iPhone and just enters some potential 4-digit passcodes on the screen, then the attacker has a probability 1/1000 of success (10 tries, ...


6

There is a project called OASAM that aims to define a methodology to test Android devices. You can find it here: http://oasam.org/en The guide has the following sections: OASAM-INFO: Information Gathering: Information gathering and attack surface definition. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment. ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

The Ubertooth one will allow you to sniff bluetooth traffic. It is fully capable of being placed into monitor mode and can be used with tools such as Kismet to perform bluetooth sniffing. There may be additional functionality that will allow you to perform packet injection as well. However if the traffic is encrypted this may not allow you to see the ...


5

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device. If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...


5

hehe, perhaps you're right. When there are no keys, there can't be any key loggers. Let's call it swipelogger™. More seriously though, I don't think there's much of a technical barrier for malware to detect user-input, be it via a keyboard, mouse, touch screen or brain alpha-waves. As long as there's input, there's a chance to intercept it.


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...



Only top voted, non community-wiki answers of a minimum length are eligible