Tag Info

New answers tagged

0

its getting tough to use the online numbers for verification. Last time I try with one application, but they are using missed call mobile verification ( some thing like Cognalys) and the virtual numbers are not showing any call logs. The last five digits from the missed call number was the OTP... :)


0

I would suggest you Create a Hotspot on your Laptop Install WireShark on your Laptop Run Wireshark on the your network interface that the HotSpot is on Disable GSM Services on your phone Enable WIFI on your phone and connect to your Hotspot (from step 1) Watch the Traffic flow from your Phone What I think you will find is .... Most data is being sent ...


2

Your VPN has an end-point, where the pipe terminates. Your service provider sees this end point, and by using GEO-IP can quickly identify the country, City and even area where this end-point is located. Not sure why you should be surprised about this - A VPN will only protect your communications from YOUR ISP.... Where the traffic appears it will be subject ...


4

Your carrier would not see your VPN address directly, because that is in the encrypted part of the VPN traffic -- all that is visible to them is the public IP address of the VPN endpoint you are connected to. What is most likely happening here is that an app installed by your provider contacted them through the VPN, at which point they can see the address ...


17

Your carrier certainly sees the target IP address of the packets that you are asking them to transmit. The carrier's job is to, indeed, carry your packets from your phone to the base station, and, from that base station, to route it to the nearest infrastructure link so that it may reach its ultimate destination. In your case, all the packets that you send ...


0

Nowadays the SIM cards hold less personal info than they used to hold; smartphones don't store contacts in the SIM anymore, SMS messages are immediately copied to the smartphone's memory and erased from the SIM, so in the end the only personal thing that's left is the phone number itself, it can still be used for social engineering, calling premium rate ...


1

Thieves are stealing phones now, not for the value of the phone, but because before it's reported lost or stolen they're dialling premium rate numbers which they control. They get a share of the revenue from dialling the numbers so they steal the phone, transfer the SIM to another phone and then call the premium rate number. The original owner of the phone ...


-1

You don't turn it off on your phone, you should turn off SSLv3 support on your phones browser Since I can't write a comment asking for more information I will assume you are using Internet Explorer (because windows phone) or chrome (because you might have common sense) On the Internet Explorer Tools menu, click Internet Options. In the Internet Options ...


0

Generally speaking, no, you will not have to do anything more that change the protocol (http to https) in order to encrypt your application's traffic. Most web-client libraries support both protocols transparently. Some additional things to consider as a mobile application developer: Do not disable certificate validation routines, or catch and discard ...


0

You would need to preform a attack such as arp poisoning(mitm). A program know as ettercap does this quiet well. It can preform both mitm and manipulation.


0

Yes, set up mitm proxy and configure your proxy settings to use that. You can also use sandro proxy if you want something that actually runs on the device.


2

So the linked question How is Chase Mobile Deposit Secure? does answer this, just not explicitly. The important thing to remember for this specific scenario is that there is nothing magical about the piece of paper you're thinking of when you picture a check. Just because you get a nice little pre-printed pad of checks from your bank doesn't mean that ...


2

Suppose I write you a check and you deposit it, but also produce a forgery that you deposit a few days later. Soon or late, when I reconcile my account, the forgery will be detected, I'll complain to my bank, and my bank will claw back the money from your account at Chase. Doesn't matter whether it's paper or a picture. If the forgery happens to overdraw ...


1

I think that question have the answer: they don't have to verify more than they already do. Check routing numbers are all that they need, and they do it for a long time. You forgot that they know your name, address, SSN and a lot about you. Yes, you can pass a counterfeit check once, but they WILL know it sooner or later, and they will Chase you. They will ...


1

The mobile application cannot currently be validated or considered a compliant payment application. Guidance on security and compliance in mobile applications has been issued by the SSC here: https://www.pcisecuritystandards.org/documents/Mobile_Payment_Security_Guidelines_Merchants_v1.pdf As your environment is receiving and transmitting cardholder data, ...


1

I agree with Mike Scott that SAQ-C should be ample in your case. SAQ-C does require you to be scanned by an ASV. Do mind that you don't store any cardholder data at any point. It's important to verify that you: clear logs prevent crashdumps containing cardholder data For mobile applications you should ensure to use non-serializable datatypes. This ...


2

If you're sure you never store the payment details, not even in things like swap files or core dumps, then I think SAQ-C will be sufficient. I think it's almost certain that you'll need to change some of your processes to complete the SAQ successfully; you won't just be able to fill it in and say that you're done.



Top 50 recent answers are included