Tag Info

Hot answers tagged

14

IMEI is like a GUID (Global Unique Identifier), that identifies your unique handset. Your carrier can blacklist your IMEI by instructing the GSM Alliance to do so, so that the mobile can't connect to any networks, usually in the case the handset is lost or stolen. Your handset's IMEI is sent in the handshake process when connecting to a network, and can be ...


5

Just use TLS, it's what it was meant for: securely send data between two parties across an untrusted channel. Should you want additional protection, there are two ways to solve this problem that spring to my mind: Use a password to encrypt the symmetric key Use a token such as an OTT through SMS or generated using a smartcard and external cardreader ...


5

Any site that claims to be able to do that is a scam. Such technology would have to exploit some kind of backdoor, and if such a backdoor exists, it would only be known to law enforcement. If knowledge of such a backdoor leaks, you can be sure that there would be a media frenzy over it, and the vulnerability would quickly be fixed. Phone monitoring ...


5

Your carrier would not see your VPN address directly, because that is in the encrypted part of the VPN traffic -- all that is visible to them is the public IP address of the VPN endpoint you are connected to. What is most likely happening here is that an app installed by your provider contacted them through the VPN, at which point they can see the address ...


4

You're confusing two different companies and products: WhisperText LLC which develops the Whisper App They're the geolocating datasharing company that drew the criticism you linked. Open Whisper Systems which develops TextSecure, RedPhone, Signal These are various end to end encrypted products. I have seen no reason to distrust them. But obviously even ...


3

Yes, it loses some of the protection since it fails to protect them if the device is thoroughly compromised. It still, however, protects against any number of limited attacks. For example, if they are configured to connect through a proxy that can strip the encryption, the 2FA will remain safe. If the password DB is compromised somewhere that they used ...


3

Unfortunately no, there's no way for an end user to trace that information. Your cell phone provider should at least be able to trace it back to the SMSC that it was sent from, however they are unlikely to do so without some sort of police request or court order. If you are being threatened or genuinely harassed then get the police involved, they have the ...


2

Your VPN has an end-point, where the pipe terminates. Your service provider sees this end point, and by using GEO-IP can quickly identify the country, City and even area where this end-point is located. Not sure why you should be surprised about this - A VPN will only protect your communications from YOUR ISP.... Where the traffic appears it will be subject ...


2

It is possible. Let's consider the quicker one with an active attack. Look at: The full presentation: http://www.slideshare.net/iazza/dcm-final-23052013fullycensored Another way could be the use of SS7 queries to the HLR/VLR of the Victim's MNO. (this obviously imply that the attacker has a certain level of permissions/access to the core network (e.g. ...


2

SyncStop I saw some discussion about a device like this a while back; it was being called "USB Condom". Looks like they've changed the name to SyncStop. At the moment they have an ongoing Kickstarter campaign. SyncStop Vs power-only USB cable? It's not clear to me how SyncStop is different from a "power only USB cable" (as @DavidWachtfogel mentioned), ...


1

There is a project called OASAM that aims to define a methodology to test Android devices. You can find it here: http://oasam.org/en The guide has the following sections: OASAM-INFO: Information Gathering: Information gathering and attack surface definition. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment. ...


1

Actually Phonegap apps are not really "all native". Only system functionalities (like file access, camera access, etc.) are translated to their Java counter-parts. It still uses a webview and a lot of javascript to implement the application business logic. So, answering your question, the local storage issue is still a valid concern as it is a feature of ...


1

Well, according to PhoneGap/Cordova security guide it seems that localstorage is not recommend to store sensitive data. So what you can do? Well, here are two options I think you can use. 1- Encrypt the refresh token and store it encrypted in the localstorage. You can use CryptoJS (a JS library to encrypt/decrypt the data) to encrypt your token using AES ...



Only top voted, non community-wiki answers of a minimum length are eligible