Tag Info

Hot answers tagged

22

Just wanted to chime in and say that the list you have there isn't entirely 100% accurate, but it is close. Keep in mind that this will vary per MDM vendor and mobile OS, but MobileIron can see your location if your employer enables the functionality and you choose to accept sharing your location data. How exactly is this done? They just configure ...


13

There is a semantics issue at play here that make answering definitively very difficult. What precisely did Mr. Snowden talk about when he said "Yes they can turn your phone on." Did he mean activate a device that is in a shutdown (not standby, low-power-ready-to-function) state? Doubtful. Did he mean activate a device in a low-power, standby state? ...


11

There is a possibility that the other iPhone was... yours. Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over ...


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


10

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you ...


10

My company is currently going through the process of implementing an MDM for all work phones... So perhaps something that I can help with. The company will install profiles and policies onto the mobile device which (On top of what you have outlined above in image) can enforce the following: Constant VPN connection (Ability to intercept network traffic to ...


9

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


7

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


6

I'm sorry for the long answer, but I felt it's needed here. Plus, you're not the regular OP looking for a quickie. I've looked into this when we studied GSM in school. The are several methods to find out the SMSC from your phone; however, that's completely different from what you're looking for. Let's start with how an SMS is sent (very basic description): ...


6

How to get noticed in a professional network Your network admin is able to see that "chuck" is connecting to an internal E-mail server from the Mac address "00:05:02:11:22:33" and that this iPhone address is connected through the access point on first floor of the library. This is just a practical example. There are many other ways. Notwithstanding the ...


6

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device. If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...


5

Essentially you just need to contact the police. They are the only people who are likely to be able to help you. That said, some police respond well if you can provide a little more information about your attacker. The IP address you have will be either the address given to the GSM transceiver in the phone (if they were using 3G for example), or the address ...


5

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


5

whether or not they[the NSA] can remotely turn them[smartphones] on in order to collect data. What kind of mechanism would facilitate this? We need to cover the meaning of off first. With a lightbulb controlled by a simple switch the light will be on or off (or burned out/broken). However with a dimmable lightbulb a light may be fully on, fully ...


5

You make some wrong assumptions : "how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots". There are two computers in your average smartphone, the one that you more or less control, running e.g iOS or Android, and a second one, the Baseband Processor, handling radio communication ...


5

Airplane mode is in the control center because it's much more convenient to get to it there than to go through a bunch of settings pages. Even if it weren't there, the same effect is easy enough to achieve by sticking the phone in a Faraday cage. Yes, it's slightly easier to do it with airplane mode there, but the extra risk is minor and the convenience is ...


5

No, it will not. Information such as time, date, author, etc. is stored as EXIF metadata. This data is kept separately from the image itself, and as such will not be retained if you take a screenshot of that image. You may be thinking of steganography, which is the process of hiding information in another piece of information. The Wikipedia article offers ...


4

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...


4

It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker. As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to ...


4

Not really — depending on your phone "Juice Jacking" works by offering a malicious user an approach vector to gain access to your phone during the charging process by leveraging the USB data/power cable to illegitimately access the phone’s data and/or inject malicious code onto the device. Only a few devices don’t expose the data if you power them off ...


4

AFAIK there is no DFU mode bug publicly available for anything later than the iPhone 4 or iPad 1. In terms of typical lost device scenario, assuming that the attacker can't guess the passcode before the device wipes (so set a relatively strong passcode an enforce device wipe on 10-20 incorrect attempts), I'd say that the device should be relatively secure. ...


4

The attacker could Man-In-The-Middle attack their own iPhone by creating a custom CA. SSL/TLS prevents third parties they don't trust from listening in. The attacker has no reason to distrust themselves and their iPhone allows them to make it trust whatever they want. The format won't be safe, and shouldn't be (be, not contain) sensitive information.


4

From a security stand point, you will generally prefer to have your own device. This just keeps everything separate. Even if you backup your phone and all your data, it is probably better to keep it separate. This also assume that the company permits by policy and by technical controls the ability for you to independently backup your device. You also run the ...



Only top voted, non community-wiki answers of a minimum length are eligible