Tag Info

New answers tagged

0

I would connect that lumia via usb and repartition the internal storage. I think a clean install should do the trick, except if he's in the police force.


-2

All publicly disclosed touchjacking attacks depend on inserting a malicious layer into webviews, not on an unrelated piece of malware. Assuming you are only installing from a trusted source (i.e. signed code from Good) via a trusted platform (Google Play, Apple Store, Microsoft whatever) then touchjacking attacks are unlikely.


10

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable. We have the habit to use firewalls on desktops/servers because they are available and every layer of ...


1

Doesn't that mean that my phone is practically open for access by anyone? You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing ...


1

According to these slides, during the handshake both the operator and the SIM card uses A8, RAND, and Ki to generate a session key (Kc). After the operator compares RAND_1 and RAND_2, it uses Kc to encrypt a message. The mobile then tries to decrypt the encrypted message with Kc; if this decryption is successful, then the mobile had, in effect, ...


0

There is known vulnerability called: Stagefright, but it works by sending you a MMS message. It only works in Android and new models have been patched. I agree, it smells to a scam. Perhaps they know some vulnerability, but that could only work either in iOS or Android, but I don't think in both. Also it will depend on the model (OS version and hardware). ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


2

There certainly are zero-day exploits out there for Android and iOS. So the technology exists for this to be real. In fact there is a thriving black market where discoverers of these exploits can sell them to the highest bidder -- here is an interesting article on that topic. That said, according to the above article, Android exploits sell for $30,000 - ...


0

If you didnt sanitize your file input AT ALL, the hacker might just uploaded a php shell like c99.php to your server. He could then access the shell control via yourapp.com/uploads/c99.php If you checked the content type of the request, he might uploaded the shell after changing the content type of the request to image/jpg through a HTTP POST editing tool. ...


1

If attackers had administrator/system/root level privileges on your computer, they have a lot of possibilities to permanently backdoor your computer. Not many attackers can do this kind of persistence, but it is possible. MBR bootkit - can be cleaned via formatting from live cd BIOS/UEFI malware - see Computrace rootkit HDD firmware - GrayFish malware ...


0

This is absolutely possible, but I am not sure if this vendor is legitimate. Law enforcement, as well as intelligence agencies in various localities and nations have access to devices called IMSI catchers, which can be used to impersonate cell phone towers. Check Bruce Schneier's description of IMSI catchers in use by the FBI, notably the "Stingray" ...


0

Yes, it is possible to monitor cellular activity without having prior access to the device. The fine folks at iSEC partners presented Traffic Interception & Remote Mobile Phone Cloning with a Compromised CDMA Femtocell at BlackHat were they demonstrated the use of a reverse engineered off-the-shelf femtocell to intercept cellular activity. Also, recently ...


3

An easy way? Pehaps, but it depends on your own experiance with Android penetration testing or relatable systems; Linux. And what level of perinoa you're willing to advance to. If you're command line savy then install no-root BusyBox and run netstat -plant with auto sync off on the target device to list the ports and addresses and process IDs that it is ...


0

Actually, it is probably legit. The question is if it will make it through customs if you bought it. I have heard stories of people buying cellphone jammers, SIM cloners, and all sorts from Chinese sites. It wouldn't surprise me that this works. When the Chinese scam you, its usually that you get less on the unspecified terms than you expected. For ...


0

Technically speaking it is possible. If the regulations permit it, they would have no problem to identify other phones (operated by this carrier), record calls and SMSs as well. After wrapping all that information up, it could be sold as a tracking service. All the data above is flowing in their network, so there is not technical challenge here. I don't ...


-1

Because you are using Google Chrome Developer Tools, here some information from my experience: COULD BE that the User Agent change is not being applied in the website. Mobile User Agent Emulator in Google Chrome Developer Tools is not really efficient, sometimes it works and sometimes not. Depends of the user agent detection of the website (Web Mobile ...


1

So this is a really tough problem, and I don't believe there are any APIs out there to achieve what you want. What you can't do: Custom Permissions While they sound like a good idea custom permissions are defined in the AndroidManifest.xml. Checkout this SO answer on how to define/use them, but they look something like this: <permission ...


0

You should not install anything that you (YOURSELF) did not try to install. No exceptions, unless if you look it up and find it is needed or useful and comes from a reliable source. For example you need to install winPCap to install Wireshark. When you are asked to install winPCap you go and type winPCap in a search engine to determine if Wireshark is ...


3

Honestly, the core question is whether vibration of the phone will give an application/website significantly more authority than without the vibration. Now, obviously I lack any research into this specific issue, but we can note that applications do not use vibrations as a way to convene authority. If anything it would feel wrong for an application to ...


21

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript. Many features can be misused, and is ...


3

Suppose a malicious web page pops up a fake system notification and vibrates at the same time. How confident would you be of telling the difference between a legitimate pop-up and a .png on the web page you're viewing. (Source) Personally I have not heard of any exploit related to HTML5 Vibrate API, but it could be used for evil goals as shown on ...



Top 50 recent answers are included