Tag Info

Hot answers tagged

11

There is a semantics issue at play here that make answering definitively very difficult. What precisely did Mr. Snowden talk about when he said "Yes they can turn your phone on." Did he mean activate a device that is in a shutdown (not standby, low-power-ready-to-function) state? Doubtful. Did he mean activate a device in a low-power, standby state? ...


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


10

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


7

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


7

There is a possibility that the other iPhone was... yours. Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over ...


7

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device. If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...


5

Essentially you just need to contact the police. They are the only people who are likely to be able to help you. That said, some police respond well if you can provide a little more information about your attacker. The IP address you have will be either the address given to the GSM transceiver in the phone (if they were using 3G for example), or the address ...


5

How to get noticed in a professional network Your network admin is able to see that "chuck" is connecting to an internal E-mail server from the Mac address "00:05:02:11:22:33" and that this iPhone address is connected through the access point on first floor of the library. This is just a practical example. There are many other ways. Notwithstanding the ...


4

It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker. As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to ...


4

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


4

AFAIK there is no DFU mode bug publicly available for anything later than the iPhone 4 or iPad 1. In terms of typical lost device scenario, assuming that the attacker can't guess the passcode before the device wipes (so set a relatively strong passcode an enforce device wipe on 10-20 incorrect attempts), I'd say that the device should be relatively secure. ...


4

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


3

The key is available from the device, so an unlocked device (or guessable/brute-forceable) will elicit the key. The key is also on any synced iTunes apps. By sending remote kill (if possible, which should never be relied upon since RF blocking handkerchiefs/bags are well known tools used by adversaries), this can delete the key, disabling recovery of the key ...


3

Dominic White goes through a very detailed blog post entitled Blocking iPhone Tracking (consolidated.db) Solved. This is the best blog post yet on the subject matter, and provides some very simple and walkthrough-esque solutions for both jailbroken and stock phones.


3

There is a use @nealmcb touched on but is quite an issue - legal investigations. Generally law enforcement requires warrants (it varies by jurisdiction) to seize and analyse a suspect's computers. They usually do not require the same for phones - which can usually be confiscated when bringing the suspect into custody, and the file is easily accessible to ...


3

Sounds like you may have caught the OSX.RSPlug.A Trojan Look here for instructions on how to remove it: http://www.ehow.com/how_2128387_remove-osxrspluga-trojan-horse-mac.html This trojan can only be obtained, by you actively downloading and installing it, probably masked as a trustworthy program. As for antivirus, there's no AV Software out there, that ...


3

I don't have a general answer on how to stop your phone being hacked, but there are some good answers and info at Best practices for securing an android device that you might be able to use for other phones as well.


3

There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft. The malware was spread by using independent application stores. Almost all of the phones resided ...


3

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...


3

Some mobile devices provide on device encryption to protect them, tied to the passcode/password that the user enters. When tied to a device wipe after a certain (small) number of incorrect attempts, they can provide an effective mechanism to protect the data held on the device in a "lost/stolen device" scenario. To take iOS devices as an example, you can't ...


3

Not really — depending on your phone "Juice Jacking" works by offering a malicious user an approach vector to gain access to your phone during the charging process by leveraging the USB data/power cable to illegitimately access the phone’s data and/or inject malicious code onto the device. Only a few devices don’t expose the data if you power them off ...


3

I'm the Head of Mobile at busuu. One of our web devs found this thread while investigating a problem with our site. The entire set of content for our Japanese app runs to about 110MB in total, across five downloadable bundles. That download process is kicked off manually by the user and entirely in the foreground while the app is running. We also use ...


3

I'm sorry for the long answer, but I felt it's needed here. Plus, you're not the regular OP looking for a quickie. I've looked into this when we studied GSM in school. The are several methods to find out the SMSC from your phone; however, that's completely different from what you're looking for. Let's start with how an SMS is sent (very basic description): ...



Only top voted, non community-wiki answers of a minimum length are eligible