Hot answers tagged

9

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states that this phone was explicitly chosen because of the KNOX technology which includes secure boot and separation of work and private activities. The reason this ...


8

As Alexander pointed out in the comments, checking permissions alone is not a reliable way to determine whether an APK is trustworthy or not. Especially not for an app like Pokémon Go, which is going to require a wide array of permissions in any case. If you are forced to download an app from an unofficial source, one of the smartest things to do is to get ...


6

Phones can be localized by various means: GPS sensor Wireless networks in range: Imagine you drive through a country and for every point on the map you store the wireless networks that you are receiving a signal from. Later when you try to locate yourself, you can query the map with the networks you are currently receiving and find out where on the map you ...


5

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 every 3 years because this seems to balance the tempo of change in the AppSec market, all the work everyone does to map their tool/process/other thing to ...


3

Well then, to try and fully answer your questions: Is it possible someone hacked to her phone and delete all her work contacts? I will say this with a resounding no. It's theoretically possible for them to hack into the device, but while not only highly unlikely it is also impractical for anybody to remove just her work contacts. The company has no ...


3

If the device is enrolled on your company's network (using a device enrollment / Mobile Device Management process), they could have a lot of visibility. iOS allows for a "always-on VPN" (link). This allows for either certain or all applications to use a particular VPN connection; which could be your place of employment. With the implementation of enforced ...


3

Sadly it will be very hard to track down the sender. The only way to track down a sender without a senders id to go through your carrier. For them the procedure is also hard as they would have to do the following: Track the message -> Track all hops it went through until it got to you -> Contact the senders service provider and ask for information (Only ...


2

The phone should know these passwords if it wants to use it, so it obviously keeps them somewhere in a readable format. If the phone is compromised the attacker would be able to read them. That's actually why some mail providers (GMail, etc) are moving to oAuth so that the phone stores a revokable token instead of the actual password. While that is possible,...


2

Why no update? I'm not sure but, likely there was no need, or too much discussion in the OWASP community to be able to update the web top 10 list from 2013. Also, the mobile world is evolving rapidly last years, probably that's why different vulnerabilities and needs are required and so the (mobile) security industry had to develop faster along with the ...


2

They don’t update it every year and its done by volunteers in their spare time so updates can be slow as it's very comprehensive and takes alot of work. However, they are currently working on updating it this year and are asking for people to submit data towards it. The OWASP Top 10 project is launching its effort to update the Top 10 again. The current ...


2

Most android malware will steal information or spam your phone with aggressive ads. But they do not necessarily modify any installed apps on the phone. If a phone is rooted, the malware can, however, uninstall apps and replace them with malicious app copies. The following link gives an overview of many of the known android malware capabilities. http://...


2

TheHackerNews reported this to be true here. Security firm Proofpoint has discovered the malicious app, or APK, that has been infected with DroidJack – a Remote Access Tool (RAT) that can hack any Android device by opening a silent backdoor for hackers. And they also talked about Pokemon GO granting itself full access to your google account here. ...


2

There are different layers and concepts to locating a phone. From a web server perspective: using the IP (and a geo IP lookup), which gives a quite broad location (country or regional level) adding the requested language (if any), in combination with the above can further narrow down the estimate You can hide these with a VPN and a languange setting. ...


1

Not necessarily Operating systems in general and Android specifically, implement a privilege model to access data (When you install an app, you can decide which permissions you want to give it. You can also edit those permission later on). If an application is taken over by a malicious piece of code, it will have the same privilege level as the affected ...


1

I've never heard of any malicious misuse of another users IMEI number through my three years experience as a digital forensic investigator. A quick google search shows that there are software to change the IMEI number, if it works or not i haven't tested. There might be a risk that a user could impose another by using his/hers IMEI number.


1

Can my cellphone be located when I use X/Y/Z? As long as it manages to reach any cell network, yes it can be located, and what you use on it will never change anything to this (no matter if it is GPS, VPN, or any other technology or software). Your cellphone needs to contact nearest cellphone masts in order to reach the network, and once it's done the ...


1

You could implement your own layer of encryption in addition to the one that TLS provides. Since you say that "we can exchange some additional data in registration phase" I think the easiest solution would be to share a symmetric encryption key (e.g. AES) during registration and then encrypt all further communication with that. (The IV will prevent brute ...


1

While not theoretically impossible, this is highly unlikely. For this to happend there would need to be a vulnerability in iOS that could be leveraged for this. While there are vulnerabilities in iOS (and in any software), unless I have missed something there is nothing that could be used for an attack just through a phone call. That does not rule out ...


1

When you're using a proxy server, it is just that a proxy. Everything will be forced to go through it, whether it is wired, wireless, 2G, 3G, 4G, LTE. The browser is configured to do the following: phone (browser) --> go to Yahoo.com --> through this proxy (1.2.3.4) proxy --> Internet --> I need this page Yahoo --> Proxy <--> phone ...


1

The are numerous opportunities for fingerprinting/privacy leakage at all levels of abstraction. A good survey can be found on this upcoming PETS paper (full disclosure: I am one of the authors). With regard to your specific question, I guess you are looking for something analogous to iHasApp? There are a number of ways of bypassing Apple's restrictions ...


2

There is a better method today if you are using android. The developer tools offer a way to sniff Bluetooth packets into a log that can be opened in Wireshark. Go to Developer Options on your phone and enable hcidump. See this blog post for more details



Only top voted, non community-wiki answers of a minimum length are eligible