Tag Info

Hot answers tagged

15

There have been some other good answers here, but there are some other measures that can be useful too. In fact, not all of these are particularly technical. As others have pointed out, adding a passcode to your iPad will allow for full system encryption, which prevents anyone from stealing data from the device. Combining this with auto-lock and auto-wipe ...


12

In terms of the second part of your question about the privacy trade-off, that's very dependent on the organisation in question and their priorities. Unfortunately a lot of companies would place their security concerns much higher on an agenda than privacy concerns for their employees (unless regulatory requirements dictate otherwise). On the first part, ...


11

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


10

You can't. This is a fundamental principle of general purpose computing. You're running into Shannon's maxim: The enemy knows the system. One ought design systems under the assumption that the enemy will immediately gain full familiarity with them. Just to make my point completely clear: you're giving someone a car, and asking them to only ever drive ...


10

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


8

Are jailbroken iPhones an enterprise security risk? Potentially. I think it is hard to determine without data. On one hand, users who jailbreak their phones are typically knowledgeable about computers and mobile devices. They may be less susceptible to phishing and may be more vigilant about their device's security. On the other hand, jailbreaking ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


8

Start with the Emulator and Simulator, which are part of the standard SDKs. If you prefer certain environments over others, you will gravitate towards a reliable framework for pen-testing these platforms. For example, with an iOS app, I always start with the iOS Simulator after building the code in Xcode. I set my Mac OS X system HTTP and SSL/TLS proxy to ...


7

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


7

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


7

I'd scrap the direct syncing option and simply allow the user to export their private key to a location of their choice, e.g. iCloud, DropBox, internal storage, etc., in an encrypted format. On export I'd do something like this: Ask the user for a password to use. Don't impose any restrictions on them - it's their job to use a good password! Use a strong ...


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


6

Use SSL to handle the communications over the internet safely, then hash the password it on the server. Otherwise the password hash just becomes the password, as far as the service is concerned, and an attacker that gains access to your database can log in as any of your users as if their passwords were stored in plaintext. SSL is vital in order to prevent ...


6

I know there is a great example and discussion on this for Samsung devices and Android, so you might want to start there and see if it takes you to where you want to go with everything else. http://developer.samsung.com/android/technical-docs/Neat-tricks-when-implementing-a-kiosk-app Removing the title bar and status bar ... you may want to ... remove ...


6

Once a computer boots, the operating system is given near exclusive control over the system resources (kernel access). After this occurs, if a program wants to run, it must ask the OS to let it run. Before iOS allows an application to run, it examines the code that is going to be loaded in to memory from the binary and checks it against a signed value that ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device. If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...


5

hehe, perhaps you're right. When there are no keys, there can't be any key loggers. Let's call it swipelogger™. More seriously though, I don't think there's much of a technical barrier for malware to detect user-input, be it via a keyboard, mouse, touch screen or brain alpha-waves. As long as there's input, there's a chance to intercept it.


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...


5

Within an unprivileged application, there's no good way to store confidential data and hope to erase it and only it. If you write the data to a file, you don't know where this data will end up. SSD remanence is the least of your worries (and it may or may not be a worry depending on whether the flash controller implements a secure erase — I don't know how ...


5

Apart from setting a pincode that should prevent anyone getting in the iPad/iPhone, I always add an app that can remotely destroy all data on the pad. In my experience, even if you can track the perps, the police doesn't really care about that (at least not here). But you can always give it a go. I wouldn't advice you to go tracking the thieves yourself, ...


5

This depends on model you use for group chat: Peer-to-peer: You need to encrypt each message with the recipient's puiblic key and send it to each user separately, and create the "illusion" of a group chat. This will prevent new group joiners to see previous messages. Client-Server: You upload the messages "signed" to the server, and encrypt them to each ...


5

No, because they are transported unencrypted over the internet. Even when your app or site is http best practice is to do at least the post containing the username/password using encryption/ssl.


5

It's harder to reverse-engineer complex code. You can introduce extra variables, pipe data through multiple classes, create classes which don't actually do anything, and generally muddy the waters. Measures such as this make it much more complex to reverse engineer your code, however it makes it much more difficult to engineer your code in the first place ...



Only top voted, non community-wiki answers of a minimum length are eligible