Tag Info

This is a really broad question that does not have a single answer. Some categories of challenges and risks include: Reduced control. The corporation has to take whatever devices the employees select, and loses control over them. The corporation may also have reduced leverage to control the software on those devices. Dependence. The corporation becomes ...

I will have to vehemently disagree with the comment that "your mobile phone is more secure against malware". This is a dangerous and very wrong statement of the state of mobile phone "security" - and if it is based on anything, it is based on inappropriately interpreting currently skewed statistics. As a security enthusiast and a developer on mobile phone ...

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...

Since Ice Cream Sandwhich, Android devices support full disk encryption. This is based on dm-crypt and requires password or pin to unlock your phone. While users may find this irritating (the swipe method is not supported), it is a tradeoff you will need to consider to keep your info safe. Apps that can whipe data or more: Kaspersky Mobile Security ...

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...

There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft. The malware was spread by using independent application stores. Almost all of the phones resided ...

One risk of BYOD is the idea that it reduces sysadmin and helpdesk costs. It is a myth but it can damage productivity a lot. With BYOD, the users themselves take charge of inventory and replacement of failed parts. But they still need to connect to the internal network and be helped with the corporate applications (i.e. intranet Web site), and since the ...

Where I am, the perceived problems are: support costs - that the company will bear the burden of issues which aren't realy it's problem (Hello helpdesk, how do I configure my Whizzbang 3728-T for accessing the VPN?) that unmanaged user devices become a conduit for malware into a controlled environment that data on this devices is not adequately secured and ...

Depends on the phone. If you've disabled USB debugging/file sharing1, then Android phones are inaccessible via USB until you turn it on. On the other hand, one can access most files of an iPhone without any special access (this bypasses the pincode lock as well). Desktop applications like IExplore do this. While ssh access won't be available, they still can ...

There are hardware devices available that will detect a 3G signal. Pulling the MAC address or such involves intercepting the traffic, which has legal implications, so consult a lawyer, and be prepared for them to yell at you for even thinking of intercepting phone calls without a warrant. There are also devices that can jam a 3G signal. Again, there may be ...

Your mobile phone is more secure against malware. There's a lot of data indicating that if you follow basic security practices (only download apps from an official app store; don't side-load apps from other sources keep the phone updated; keep backups), then phones are more secure against malware than desktop PCs. Malicious apps on the official markets are ...

I'd say there are tradeoffs. Mobile operating systems enforce stricter security policy than PCs, for example actively monitoring the controlled app market for malware, giving apps specific permissions to access certain information on your phone, lack of traditional file system, sandboxing, etc (this often goes out the window if the phone is rooted/jailbroken ...

I think the answer to that is 'it depends' - I was looking at something similar recently, for example the IPs issued to the AT&T phones we tested all resolved to an Atlanta, GA address - even though none of the devices were within a few hundred miles of Atlanta. Different carriers are likely to yield different results though - some may yield more ...

The ultimate security of any system depends on the mindset, knowledge, and intelligence of the user.The second consideration after this would be the mobile phone platform we're discussing. iOS based devices are generally less susceptible to compromise due to a centralized secure appstore and the lower numbers of known viruses of their kind. But that doesn't ...

I have no idea how apps store the data I punch in, or how to tell whether they use secure/encrypted transmission techniques. You can't. Many apps don't, or they claim to, but have been found to use protocols in an insecure way (not checking certificates). You also don't mention your mobile web-browser. There have been articles suggesting they're not ...

No they are not. Initial thoughts: Reason 1: Most smart phones are protected with a 4 digit pin. Even simple Windows/Linux/Mac passwords are generally better. Reason 2: Smart phones very often go online through public routers without password. That means the data 'in the air' between your phone and the router can be sniffed. Reason 3: Security updates ...

Actually, the maximum number of combinations an Android pass-pattern can have, given that the user must choose a pattern of at least four unique dots and can use up to all nine, is 9!+8!+7!+6!+5!+4! = 362880+40320+5040+720+120+24 = 409104 combinations, about 2^18.6. Child's play for a computer, made marginally more difficult by its being a UI-based entry ...

Unlike iPhone and Android who have (flawed) full disk encryption, there is no option in the latest version of Windows Phone 7.5 to encrypt your whole device. Windows Phone 8 however will have a lot of improvements (security wise) but they will still need to be proofed in the field. However the full disk encryption will be handled by Bitlocker, which has ...

Spam Soldier (see here, here, and here) targets android devices with text messages that lead you to download malware. The malware is then used to make your device part of a spamming botnet. This is a 'in the wild' attack, not just a theoretical exercise. The 'business model' behind the attack is the standard standard spam business model.

The problem here is that if you base your data security on the apple monolithic architecture (which is a good start) then you will be at risk when that architecture fails. So the question you have to ask yourself is: "What happens when the device is jailbroken?" A defence in depth approach would be to use Apple's APIs, but also to add your own independent ...