Tag Info

Hot answers tagged

10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


10

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...


7

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


6

There is a possibility that the other iPhone was... yours. Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...


5

It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device. If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...


5

Essentially you just need to contact the police. They are the only people who are likely to be able to help you. That said, some police respond well if you can provide a little more information about your attacker. The IP address you have will be either the address given to the GSM transceiver in the phone (if they were using 3G for example), or the address ...


4

It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker. As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to ...


4

AFAIK there is no DFU mode bug publicly available for anything later than the iPhone 4 or iPad 1. In terms of typical lost device scenario, assuming that the attacker can't guess the passcode before the device wipes (so set a relatively strong passcode an enforce device wipe on 10-20 incorrect attempts), I'd say that the device should be relatively secure. ...


4

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


3

There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft. The malware was spread by using independent application stores. Almost all of the phones resided ...


3

Sounds like you may have caught the OSX.RSPlug.A Trojan Look here for instructions on how to remove it: http://www.ehow.com/how_2128387_remove-osxrspluga-trojan-horse-mac.html This trojan can only be obtained, by you actively downloading and installing it, probably masked as a trustworthy program. As for antivirus, there's no AV Software out there, that ...


3

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...


3

I don't have a general answer on how to stop your phone being hacked, but there are some good answers and info at Best practices for securing an android device that you might be able to use for other phones as well.


3

Dominic White goes through a very detailed blog post entitled Blocking iPhone Tracking (consolidated.db) Solved. This is the best blog post yet on the subject matter, and provides some very simple and walkthrough-esque solutions for both jailbroken and stock phones.


3

There is a use @nealmcb touched on but is quite an issue - legal investigations. Generally law enforcement requires warrants (it varies by jurisdiction) to seize and analyse a suspect's computers. They usually do not require the same for phones - which can usually be confiscated when bringing the suspect into custody, and the file is easily accessible to ...


3

The key is available from the device, so an unlocked device (or guessable/brute-forceable) will elicit the key. The key is also on any synced iTunes apps. By sending remote kill (if possible, which should never be relied upon since RF blocking handkerchiefs/bags are well known tools used by adversaries), this can delete the key, disabling recovery of the key ...


3

Not really — depending on your phone "Juice Jacking" works by offering a malicious user an approach vector to gain access to your phone during the charging process by leveraging the USB data/power cable to illegitimately access the phone’s data and/or inject malicious code onto the device. Only a few devices don’t expose the data if you power them off ...


3

I'm the Head of Mobile at busuu. One of our web devs found this thread while investigating a problem with our site. The entire set of content for our Japanese app runs to about 110MB in total, across five downloadable bundles. That download process is kicked off manually by the user and entirely in the foreground while the app is running. We also use ...


3

I'm sorry for the long answer, but I felt it's needed here. Plus, you're not the regular OP looking for a quickie. I've looked into this when we studied GSM in school. The are several methods to find out the SMSC from your phone; however, that's completely different from what you're looking for. Let's start with how an SMS is sent (very basic description): ...


3

Reformatting is not sufficient, you need to securely wipe the disk. Reformatting is like ripping the cover off a book; it's not pretty but all the info is still there. DBAN is a popular free tool for wiping hard drives. If the drive is SSD, you need other tools. Companies that care will usually not release systems with disks; they'll destroy the disk and ...


3

This is a pretty standard message associated with MDM's and commonly seen with Bring Your Own Device (BYOD) plans. The reason you're seeing this message and your company requires you to hook your phone up to the Mobile Device Management software is because they don't want unprotected company assets. This means if you leave the organization or go rogue, ...


2

Typically, the iPhone coordinates are personal information, thus most of the directives for data protection regulations protect it. This is not a vulnerability, this is an information disclosure of personal information that are expected to be confidential and subject to data owner consent---> this is a privacy violation. Still the risk is not to be assessed ...


2

Some things to consider: Use simple phones, no smartphones and no FOTA updates Check if your phone supports and enforces GSM crypto and does not fall back into plaintext transfer. This is often used by law enforcement(IMSI catcher) and you can build your own IMSI catchers by today(see last CCC congress). Ultimately, do not trust your provider: Use ...


2

I can't give you the full answer, but the short version that the lawyer at my previous hospital gave me was: SSL will protect the data that is being transferred, however, anything that is cached to the SD card/Hard Drive is not encrypted... So, when looking at this application, you will also have to encrypt what is stored on the phone by the app. If you ...



Only top voted, non community-wiki answers of a minimum length are eligible