Hot answers tagged

43

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


6

I think your group is in fact a so-called Super Group. Super Groups work a little differently than normal groups and the one-check/two-check system doesn't apply here. All messages get double checks instantly when received by the server. (That's a feature.) The creator of your original group has clicked the 'upgrade to supergroup' button at some point, ...


5

Your HTTP requests are proxied, hence the ipof.in service sees different IP addresses. I believe this answer explains it well, but another possibility (regardless of cellular/WiFi connection) is that your browser uses a Data Saver (Chrome*) or Turbo Mode (Opera) option. Both intended to compress the data for mobile devices. * Chrome feature seems not ...


3

They may or may not be using token based authorization, and they may or may not be timing out sessions. The reason they never ask you to log in again is entirely separate, and for convenience. Users don't want to log in over and over again, and apps that make them cause them to be unhappy, and being unhappy causes them to give the apps bad ratings, and bad ...


2

This seems to me like it very much could be a cramming operation or a premium SMS scam. The US has cracked down on both practices in recent years, but they haven't disappeared completely, and of course, the situation is different in other countries. It would be wise to monitor future bills to make sure that there's no extra charges resulting from this. (...


2

During the installation process, Android isolates apps from one another and from the system by assigning them a distinct Linux User ID (UID) for security reasons. This UID doesn't change for duration of app's lifetime on the device. The system maintains a list of UIDs in use, and assigns the next available one to the newly installed app. Device rebooting ...


2

Unknown: there is actually no caller id data given. Probably totally stripped by the sender, but can happen in other ways like between networks that have no conversion between the Caller ID standard they are using. Hidden: the flag was set to say this is barred, the data is still sent all the way to the local telephone exchange of the receiver in most of ...


2

Very good question! Let me explain: Hidden: In every packet being sent to call centers there is a attribute of "hidden" this is a simple flag of true or false and so if the packet has this attribute set to "True" then the caller id will be hidden. Unknown: There is an attribute in the packet that holds the origin number that started the call. Since theses ...


1

I think the premise of the question is incorrect. We do use SMS in Europe. And even if it is not as commonly used as in the US (not sure that is actually true, but lets assume so), people still have cellphones with the capability to receive SMS. So 2FA with SMS can be used and is commoly used. Based on my experience (as opposed to actual statistics), I ...


1

I would assume the 9 digit number is a normal subscriber's number in your country? In that case, the sender probably can't gain anything financially from the messages alone, so this is probably preparation for further scams. The crooks probably batch sent these messages to find out 1) which numbers are valid and 2) which users are naive enough to believe ...


1

If you are developing an Android application one simple way to check for common vulnerabilities is running QARK on it. QARK will scan your app and checks for common security issues. Similarly, you can use the ZED attack proxy against the server. If these tools don't find anything or you fixed all the issues they reported, this does not mean your ...


1

If the data on your phone was not encrypted and protected by a strong passcode/passphrase, whoever has it now will be able to access your information as long as the phone does not connect to the Internet. It is good that you have requested a factory reset in case the phone does connect, but that cannot be guaranteed. Putting your phone's IMEI (...


1

No. If they have the device, and there is no encryption enabled (e.g. lock screen PIN), they can read whatever they like from it. They won't be able to use it as a phone (they could use it as a fancy iPod if they wanted) in countries which support phone blacklists, or to access Apple services, but any data stored on the device itself could be accessed. This ...


1

The attack vectors remain the same. The only difference is that mobile phones might provide an additional attack surface with other services reachable like Bluetooth and GSM/UMTS/GPRS/... Check public vulnerability databases for entries regarding WLAN or other network issues to determine the known attack surface of mobile devices. Once in a while there is ...



Only top voted, non community-wiki answers of a minimum length are eligible