Hot answers tagged

214

Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable. It also does not achieve the political goals of forcing Apple to assist in decrypting the device, paving the way with precedent for the flurry of future requests of this sort to come, some of which are certain to have less ...


87

What makes you think that they haven't already? This case is about setting a precedent to obtain access whenever the government desires. They chose this case because America's fear of terrorism will give more popular support for setting this precedent than, say, busting a pot grower or catching a tax cheat. What would be even better? Privacy advocates ...


78

It doesn't scale While the general consensus is that such technology exists and would be available to FBI, it's not an appropriate general solution because it might be applicable to this case but (unlike a legal battle with Apple) it doesn't scale to all the other cases where they would want to do the same thing. It is expensive - this case might be ...


43

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


26

[Update #2] According to the Washington Post, sources familiar with the matter, have stated that the initially suspected collaboration with Cellebrite is not how the data from the encrypted iPhone was recovered. Instead an unknown security vulnerability was used (purchased) from "professional hackers" to prevent the phone from erasing its data and slowing ...


24

Just wanted to chime in and say that the list you have there isn't entirely 100% accurate, but it is close. Keep in mind that this will vary per MDM vendor and mobile OS, but MobileIron can see your location if your employer enables the functionality and you choose to accept sharing your location data. How exactly is this done? They just configure ...


19

You are assuming the problem is technical. It might be political / legal. Let's assume the government already has the technical capability of extracting this information from phones, without Apple providing them a back door. The government, for both legal and technical reasons, can't admit that. Legally, because it might tip its hand to other investigations ...


15

There is a semantics issue at play here that make answering definitively very difficult. What precisely did Mr. Snowden talk about when he said "Yes they can turn your phone on." Did he mean activate a device that is in a shutdown (not standby, low-power-ready-to-function) state? Doubtful. Did he mean activate a device in a low-power, standby state? ...


13

There is a possibility that the other iPhone was... yours. Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over ...


10

You have to define what you are trying to protect and against whom. There are several assets: Your geographical position Who you call and who calls you The contents of your conversations and SMS Your phone bill Then things are quite different, depending on whether the phone operator is a cooperative friend, a not-too-competent neutral third party, or an ...


10

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you #...


10

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


10

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


10

My company is currently going through the process of implementing an MDM for all work phones... So perhaps something that I can help with. The company will install profiles and policies onto the mobile device which (On top of what you have outlined above in image) can enforce the following: Constant VPN connection (Ability to intercept network traffic to ...


10

A mobile phone, generally speaking (*), is broadcasting the message "the SIM card I have with the ID XXXX is now available on the network". This ID is called IMEI IMSI (**) and is unique to a SIM card. The IMSI is then mapped to a phone number by your provider. If you break this chain (by going to the network provider and requesting a new SIM card) the ...


8

First off, realize that if you're putting your calendar, email, address book, notes and many other important data on a very easy-to-loose device, then you're taking a big step away from 'data is secure' and over to 'data is conveniently accessible'. That said: Turn on iOS's automatic Passcode Lock (screen lock with PIN/passcode after a set time). In the "...


8

I dunno, the following seems like an easy way to get information on someone, without much work at all. From http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all To test whether I was being paranoid, I ran a little experiment. On a sunny Saturday, I spotted a woman in Golden Gate Park taking a photo with a 3G iPhone. Because ...


8

I'm sorry for the long answer, but I felt it's needed here. Plus, you're not the regular OP looking for a quickie. I've looked into this when we studied GSM in school. The are several methods to find out the SMSC from your phone; however, that's completely different from what you're looking for. Let's start with how an SMS is sent (very basic description): ...


8

Yes, it is possible. Secure enclave chip is tamper-resistant, but with Advanced (expensive) semi-invasive attack, this chip is vulnerable. A good link that covers all aspects of attacks on tamper-resistant hardware (note: Dr Sergei Skorobogatov attacks military chips and we know that secure enclave chip of iPhone is weaker than military chip) http://www.cl....


7

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


7

Basically NAND mirroring means that they're opening the phone up, de-soldering the memory chip, copying it off (the "mirroring" bit) and then they either solder it back into the phone, or more likely into a socket in phone that's been deconstructed into a test harness. This way they can try to brute force the PIN to their hearts delight, and if they run ...


6

The most obvious and widespread security issue is that anyone with access to a machine that backs up the iPhone can look at where the phone has been. This can be a plus from the perspective of an iPhone owner who wants to track their children, or a minus from the perspective of a cheating lover. It is also obviously a way for law enforcement to get loads ...


6

You make some wrong assumptions : "how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots". There are two computers in your average smartphone, the one that you more or less control, running e.g iOS or Android, and a second one, the Baseband Processor, handling radio communication ...


6

How to get noticed in a professional network Your network admin is able to see that "chuck" is connecting to an internal E-mail server from the Mac address "00:05:02:11:22:33" and that this iPhone address is connected through the access point on first floor of the library. This is just a practical example. There are many other ways. Notwithstanding the ...


6

No, it will not. Information such as time, date, author, etc. is stored as EXIF metadata. This data is kept separately from the image itself, and as such will not be retained if you take a screenshot of that image. You may be thinking of steganography, which is the process of hiding information in another piece of information. The Wikipedia article offers ...


5

I've been looking at this recently and the answer appears to be that the protection may not be great. First thing is that iOS 4.x devices may not have Apples "data protection" feature enabled on them by default. Data protection is intended to give extra protection to e-mail data and attachments. if the device has been upgraded from iOS 3.x then data ...


5

An example which was given to me is parallel control of political activists. If you get the localization data from an iPhone, you can automatically know whether the owner was part of a protest or meeting. With localization data from many iPhones, you could even deduce the existence, time and position of meetings that you were not aware of. Whether this is a ...


5

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...



Only top voted, non community-wiki answers of a minimum length are eligible