Hot answers tagged iphone
10
Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices.
The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch.
I'll try to translate the commands for you
...
9
You have to define what you are trying to protect and against whom. There are several assets:
Your geographical position
Who you call and who calls you
The contents of your conversations and SMS
Your phone bill
Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...
8
First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'.
That said:
Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the ...
7
I dunno, the following seems like an easy way to get information on someone, without much work at all.
From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all
To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...
6
The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover.
It is also obviously a way for law enforcement to get loads ...
6
If you write the application, then you have various options for protecting the files stored on the device. I gave a presentation on this at Voices That Matter this year, but to summarise:
NSFileProtection API lets you use the same device key as the filesystem encryption, but ensure that the files are protected when the device is locked by additionally ...
5
I've been looking at this recently and the answer appears to be that the protection may not be great.
First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...
5
An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...
5
Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...
5
It largely depends, but there were some significant API changes between 2.1 and 4.2 which may change the way certain operations work on the device.
If you're looking at something like a music app, or a game, you're likely to find any vulnerabilities in operational code (credential handling, network stuff, buffers, etc.) rather than misuse of the API. ...
4
It depends on what you're testing. I've found that older devices are slightly easier to work with because you can mount them directly (they do not use MTP) and run your tools much quicker.
As Polynomial stated there were significant API changes in 2.1 through 4.2. In that time JavaScript support was greatly expanded, which may or may not be relevant to ...
3
There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft.
The malware was spread by using independent application stores. Almost all of the phones resided ...
3
Sounds like you may have caught the OSX.RSPlug.A Trojan Look here for instructions on how to remove it: http://www.ehow.com/how_2128387_remove-osxrspluga-trojan-horse-mac.html
This trojan can only be obtained, by you actively downloading and installing it, probably masked as a trustworthy program.
As for antivirus, there's no AV Software out there, that ...
3
iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data.
An iPhone has two partitions:
System data
User data
The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...
3
I dont have a general answer on how to stop your phone being hacked, but there is some good answers and info at Best practices for securing an android device you might be able to use for other phones aswell.
3
Dominic White goes through a very detailed blog post entitled Blocking iPhone Tracking (consolidated.db) Solved. This is the best blog post yet on the subject matter, and provides some very simple and walkthrough-esque solutions for both jailbroken and stock phones.
3
There is a use @nealmcb touched on but is quite an issue - legal investigations. Generally law enforcement requires warrants (it varies by jurisdiction) to seize and analyse a suspect's computers. They usually do not require the same for phones - which can usually be confiscated when bringing the suspect into custody, and the file is easily accessible to ...
3
The key is available from the device, so an unlocked device (or guessable/brute-forceable) will elicit the key. The key is also on any synced iTunes apps. By sending remote kill (if possible, which should never be relied upon since RF blocking handkerchiefs/bags are well known tools used by adversaries), this can delete the key, disabling recovery of the key ...
2
Typically, the iPhone coordinates are personal information, thus most of the directives for data protection regulations protect it. This is not a vulnerability, this is an information disclosure of personal information that are expected to be confidential and subject to data owner consent---> this is a privacy violation. Still the risk is not to be assessed ...
2
Some things to consider:
Use simple phones, no smartphones and no FOTA updates
Check if your phone supports and enforces GSM crypto and does not fall back into plaintext transfer. This is often used by law enforcement(IMSI catcher) and you can build your own IMSI catchers by today(see last CCC congress).
Ultimately, do not trust your provider: Use ...
2
I can't give you the full answer, but the short version that the lawyer at my previous hospital gave me was:
SSL will protect the data that is being transferred, however, anything that is cached to the SD card/Hard Drive is not encrypted...
So, when looking at this application, you will also have to encrypt what is stored on the phone by the app. If you ...
2
The only answer is be fully compliant with HIPAA law and only let individuals who should have permitted use to protected patient data to have access to it in a secure and audited manner. At the very least read,
http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html
Listing a couple technologies (SSL ; disk-encryption) in use does not make ...
2
On mac os x, you can view the keychain items by opening the Keychain Access application.
On the iphone, keychain dumper can be used to dump all the keychain items. But it only works on jailbroken phones. To know more on usage of keychain dumper visit - http://www.securitylearn.net/2012/03/27/keychain-dumper-usage-explained/
2
...falls under HIPAA's domain?
If you're dealing with PHI then the answer is probably yes. Check out this page from the US Government Department of Health & Human Services Security Rule Guidance Material for some more information.
are there guidelines I need to follow in the application design - the browser component? The back end I am ...
2
The reason for the error, is that the intermediate certificates aren't supplied in the chain by their webserver. Basically the SSL certificate was signed by "VeriSign Class 3 Extended Validation SSL SGC CA", but that's an intermediate CA (that was signed by "VeriSign Class 3 Public Primary Certification Authority - G5"). Ideally, ...
2
You are missing the point of the lockscreens of the various mobile operating systems.
They are not an effective deterrent for attackers who has stolen your phone and has an unlimited period of time to attack it. However, they are effective in deterring chance attackers who happens to walk by and only has a short period of access to your phone.
1
I maybe completely wrong because I don't have a phone to test it, but if your computer provided a WiFi access point, then the phone would route to it. If you tethered your computer back to your phone, I believe all tethered traffic goes over the cellular side. If that works, then you have a nice circular route without any need to be jailbroken.
Since you ...
1
If the phone and the mac book are independent of each other - then consider whether they are using the same source for internet connectivity - i.e. the same WiFi access point.
Try changing the access point DNS to that of OpenDNS
1
Spam Soldier (see here, here, and here) targets android devices with text messages that lead you to download malware. The malware is then used to make your device part of a spamming botnet. This is a 'in the wild' attack, not just a theoretical exercise. The 'business model' behind the attack is the standard standard spam business model.
1
The problem here is that if you base your data security on the apple monolithic architecture (which is a good start) then you will be at risk when that architecture fails.
So the question you have to ask yourself is: "What happens when the device is jailbroken?"
A defence in depth approach would be to use Apple's APIs, but also to add your own independent ...
Only top voted, non community-wiki answers of a minimum length are eligible
