New answers tagged

0

Suppose you have an iOS app that accepts a username and passcode. This login information would be entered by the user, then you could store that state by saving the credentials in the Keychain, which is the only place secure enough to store that information on device. If the above is already in place, than adding Touch ID only increases security because the ...


1

Not necessarily Operating systems in general and Android specifically, implement a privilege model to access data (When you install an app, you can decide which permissions you want to give it. You can also edit those permission later on). If an application is taken over by a malicious piece of code, it will have the same privilege level as the affected ...


2

Most android malware will steal information or spam your phone with aggressive ads. But they do not necessarily modify any installed apps on the phone. If a phone is rooted, the malware can, however, uninstall apps and replace them with malicious app copies. The following link gives an overview of many of the known android malware capabilities. http://...


5

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 every 3 years because this seems to balance the tempo of change in the AppSec market, all the work everyone does to map their tool/process/other thing to ...


2

TheHackerNews reported this to be true here. Security firm Proofpoint has discovered the malicious app, or APK, that has been infected with DroidJack – a Remote Access Tool (RAT) that can hack any Android device by opening a silent backdoor for hackers. And they also talked about Pokemon GO granting itself full access to your google account here. ...


8

As Alexander pointed out in the comments, checking permissions alone is not a reliable way to determine whether an APK is trustworthy or not. Especially not for an app like Pokémon Go, which is going to require a wide array of permissions in any case. If you are forced to download an app from an unofficial source, one of the smartest things to do is to get ...


0

I do not believe the Diffie-Hellman (DH) choice is legacy, which means obsolete and superseded, it just is not used very often. In my opinion, that's because it's not the first one in the dropdown when choosing your Cryptographic Service Provider when making a certificate request. If someone is actually doing their homework when they make their choice, ...


2

Why no update? I'm not sure but, likely there was no need, or too much discussion in the OWASP community to be able to update the web top 10 list from 2013. Also, the mobile world is evolving rapidly last years, probably that's why different vulnerabilities and needs are required and so the (mobile) security industry had to develop faster along with the ...


2

They don’t update it every year and its done by volunteers in their spare time so updates can be slow as it's very comprehensive and takes alot of work. However, they are currently working on updating it this year and are asking for people to submit data towards it. The OWASP Top 10 project is launching its effort to update the Top 10 again. The current ...


1

Can my cellphone be located when I use X/Y/Z? As long as it manages to reach any cell network, yes it can be located, and what you use on it will never change anything to this (no matter if it is GPS, VPN, or any other technology or software). Your cellphone needs to contact nearest cellphone masts in order to reach the network, and once it's done the ...


2

There are different layers and concepts to locating a phone. From a web server perspective: using the IP (and a geo IP lookup), which gives a quite broad location (country or regional level) adding the requested language (if any), in combination with the above can further narrow down the estimate You can hide these with a VPN and a languange setting. ...


5

Phones can be localized by various means: GPS sensor Wireless networks in range: Imagine you drive through a country and for every point on the map you store the wireless networks that you are receiving a signal from. Later when you try to locate yourself, you can query the map with the networks you are currently receiving and find out where on the map you ...


1

I've never heard of any malicious misuse of another users IMEI number through my three years experience as a digital forensic investigator. A quick google search shows that there are software to change the IMEI number, if it works or not i haven't tested. There might be a risk that a user could impose another by using his/hers IMEI number.


1

The are numerous opportunities for fingerprinting/privacy leakage at all levels of abstraction. A good survey can be found on this upcoming PETS paper (full disclosure: I am one of the authors). With regard to your specific question, I guess you are looking for something analogous to iHasApp? There are a number of ways of bypassing Apple's restrictions ...


0

Well, whilst iOS and others are getting hardened, everyone is ignoring the GSM baseband processors. This second operating system was written years ago, and is proprietary to Qualcomm (and others) and is riddled with bugs and security vulnerabilities. As IMSI catchers are getting cheaper (e.g. Stingray), it is getting easier to execute malicious code on your ...


3

If the device is enrolled on your company's network (using a device enrollment / Mobile Device Management process), they could have a lot of visibility. iOS allows for a "always-on VPN" (link). This allows for either certain or all applications to use a particular VPN connection; which could be your place of employment. With the implementation of enforced ...


0

Biometric systems are more secure than voice systems (I have personally experimented with fooling a voice authentication) but I feel that the bigger problem will be in making it accessible. Currently the hardware to support biometric authentication is not present in many mobile phones. Especially the mid range ones. In countries like India, Bangladesh and ...


0

To give your question a concrete answer, you can not get this info alone. As others already told you, contact the authorities because this is a crime. This relies on them. The chances of success in such cases are not high because: authorities receive such reports every day. the sender probably prepared himself to avoid detection even if they trace him, ...


3

Sadly it will be very hard to track down the sender. The only way to track down a sender without a senders id to go through your carrier. For them the procedure is also hard as they would have to do the following: Track the message -> Track all hops it went through until it got to you -> Contact the senders service provider and ask for information (Only ...


0

If you have a newer iPhone (> 4s) just turn on your passcode. It will encrypt all the data on the phone, so even if someone has access to your device, without the PIN / Password to the phone, it's useless.


2

The phone should know these passwords if it wants to use it, so it obviously keeps them somewhere in a readable format. If the phone is compromised the attacker would be able to read them. That's actually why some mail providers (GMail, etc) are moving to oAuth so that the phone stores a revokable token instead of the actual password. While that is possible,...


1

You could implement your own layer of encryption in addition to the one that TLS provides. Since you say that "we can exchange some additional data in registration phase" I think the easiest solution would be to share a symmetric encryption key (e.g. AES) during registration and then encrypt all further communication with that. (The IV will prevent brute ...


3

Well then, to try and fully answer your questions: Is it possible someone hacked to her phone and delete all her work contacts? I will say this with a resounding no. It's theoretically possible for them to hack into the device, but while not only highly unlikely it is also impractical for anybody to remove just her work contacts. The company has no ...


0

It's likely her former employer deactivated her work account. If her contacts were saved/associated with the work email, then they would have been lost in the process.


1

While not theoretically impossible, this is highly unlikely. For this to happend there would need to be a vulnerability in iOS that could be leveraged for this. While there are vulnerabilities in iOS (and in any software), unless I have missed something there is nothing that could be used for an attack just through a phone call. That does not rule out ...


1

When you're using a proxy server, it is just that a proxy. Everything will be forced to go through it, whether it is wired, wireless, 2G, 3G, 4G, LTE. The browser is configured to do the following: phone (browser) --> go to Yahoo.com --> through this proxy (1.2.3.4) proxy --> Internet --> I need this page Yahoo --> Proxy <--> phone ...


9

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states that this phone was explicitly chosen because of the KNOX technology which includes secure boot and separation of work and private activities. The reason this ...


0

One example is Apple iOS with iCloud Lock. You have to setup your iPhone with iCloud and FindMyiPhone ahead of time but if it is lost and beyond recovery you are able to lock and erase the device. Afterwards it will prompt the thief for your iCloud Credentials (it will not show the full email address making the attack harder). The iPhone will stay bricked ...



Top 50 recent answers are included