Tag Info

Hot answers tagged

10

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable. We have the habit to use firewalls on desktops/servers because they are available and every layer of ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


3

Without lots of research and public scrutiny, home crypto tends to be very vulnerable to many attacks. You will do better using your phone's secure PRNG.


3

An easy way? Pehaps, but it depends on your own experiance with Android penetration testing or relatable systems; Linux. And what level of perinoa you're willing to advance to. If you're command line savy then install no-root BusyBox and run netstat -plant with auto sync off on the target device to list the ports and addresses and process IDs that it is ...


2

There certainly are zero-day exploits out there for Android and iOS. So the technology exists for this to be real. In fact there is a thriving black market where discoverers of these exploits can sell them to the highest bidder -- here is an interesting article on that topic. That said, according to the above article, Android exploits sell for $30,000 - ...


1

Doesn't that mean that my phone is practically open for access by anyone? You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing ...


1

According to these slides, during the handshake both the operator and the SIM card uses A8, RAND, and Ki to generate a session key (Kc). After the operator compares RAND_1 and RAND_2, it uses Kc to encrypt a message. The mobile then tries to decrypt the encrypted message with Kc; if this decryption is successful, then the mobile had, in effect, ...


1

If attackers had administrator/system/root level privileges on your computer, they have a lot of possibilities to permanently backdoor your computer. Not many attackers can do this kind of persistence, but it is possible. MBR bootkit - can be cleaned via formatting from live cd BIOS/UEFI malware - see Computrace rootkit HDD firmware - GrayFish malware ...


1

So this is a really tough problem, and I don't believe there are any APIs out there to achieve what you want. What you can't do: Custom Permissions While they sound like a good idea custom permissions are defined in the AndroidManifest.xml. Checkout this SO answer on how to define/use them, but they look something like this: <permission ...



Only top voted, non community-wiki answers of a minimum length are eligible