Hot answers tagged

54

The problem with this scenario is that emails are typically not sent from the device itself, but from a central service. In order to do what you want, the investigators would have to make a few hops: to the email service (gets the user account details, including the IP the user used to connect with) to the ISP the device used at the time of sending (gets ...


43

If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know when it was sent) to find out - from the service provider - the precise location the email was sent from? Yes, this is very easy. However... the key word here is "precise location." Not exactly. Not unless the phone is hacked. ...


23

There's another common way that email leaks location information. If the email includes a photograph that was taken on a smartphone, the photo will usually have location information embedded. Since you're writing the story, you might contrive to have the sender email a photo for some reason. The JPEG standard (used for virtually all mobile phone photos) ...


19

In addition to what @schroeder wrote, I would like to point out a few things about geolocation. Among other things, a CDR (Call Detail Record) contains information about the cell tower used by the mobile phone at the time. Note that a cell tower can cover an area of about one square mile, or more. In some countries, mobile operators might always be able to ...


11

Earlier answers already describe the process of using triangulation to pinpoint the location of a specific phone better than I could describe it. However there is very little said about whether the investigators can figure out which exact phone the mail was sent from. In traditional mail services where the user run an email client on their device and use ...


8

Speaking as a wireless telecom professional, the answer to your question depends on how precise you expect the location to be. With minimal effort (and a legal obligation to do so), I can tell exactly which cellsite(s) you were using, which narrows your location down to a particular geographic area. And we don't even need to know the IP Address, we just ...


4

No. The attack-vector described in the article requires the PC to be compromised in some way and requires someone to intercept the radio-traffic sent from your PC. So first of all: unless your working on some really complex stuff that would be worth spying on it with great effort, you're pretty unlikely to be attacked this way anyways. 2FA via smartphone ...


2

Any delay would be a security benefit. One way to look at it is that everything can be cracked, it is just a matter of time. By adding delays, one is increasing the amount of time it takes to break the security. You want the time it takes to crack to be longer than the time the item needs to be secure. In the case of fingerprints, the fingerprint gets ...


2

Well, if he was already a suspect, you wouldn't need the email to begin with. The investigators could have been watching their mobile phone wanderabouts the whole time (or another agency have already put this guy on watch, and thus the mobile has more data about it). The other option is that you have an email, but no idea who the criminal is (for example, ...


2

From the github readme for the iOS SSL Kill Switch project: Once installed on a jailbroken device, iOS SSL Kill Switch patches low-level SSL functions within the Secure Transport API So your question basically boils down to: "How do I prevent my app from being infected with malware on a rooted / jailbroken device?". In short: you don't. This is why you ...


2

There is no point in trying to prevent this. Technically I guess you could slow down an attacker by implementing your own crypto (SSL Kill Switch modifies the OS-provided crypto functions) but even that will eventually get cracked given enough time and effort. If you don't control the hardware, your software has no chances. Just live with it and let people ...


1

As the exposure is only to a few customers, it may be that the risk is low. That said, I'd err on the side of caution and treat the private key as having been compromised. This means revoking the signing certificate and creating a new one. (Applications signed prior to revocation will continue to be valid.) If you want to take a less cautious route, you can ...



Only top voted, non community-wiki answers of a minimum length are eligible