Tag Info

Hot answers tagged

40

I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own Crypto. Especially if you aren't trained ...


20

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in ...


19

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF. Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth. However, I think you're just very paranoid and/or ...


11

The whole idea about a second factor/step for authentication is to provide two independent layers of security. Vulnerabilities in one layer should not affect the security of the other. Second factor authentication was designed and used properly in the past but lately it has been weakened by companies who care more about profit than security. SMS messages ...


11

There are other two options that come to mind: text messages caching of information Text messages was shown by Georgia Weidman back in 2011. The botnet comms ran through SMS. So you can imagine it can be quite easy to spread information by SMS. The other option would be to store the information you used and upload it the next time you have an internet ...


10

You're trying to take away communications capabilities from a tool designed to communicate. It's probably not the best choice of devices. You can start by setting the phone into "airplane mode", which is intended to shut off the radios. Because of the way RF works, that means it shuts off both transmitting and receiving. It should keep you safe, but of ...


10

I will compare Telegram and Whatsapp in 3 aspects: Storage of messages, encryption, and zero-day vurnerabitiles. In fact I will be comparing 3 technologies: Telegram's regular chats (which I will refer to as "normal chats", or simply "chats"), Telegram's secret chats, and Whatsapp. 1. Storage Let us assume that both Whatsapp and Telegram completely adhere ...


10

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and ...


9

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


6

I will have to vehemently disagree with the comment that "your mobile phone is more secure against malware". This is a dangerous and very wrong statement of the state of mobile phone "security" - and if it is based on anything, it is based on inappropriately interpreting currently skewed statistics. As a security enthusiast and a developer on mobile phone ...


6

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


6

This is a really broad question that does not have a single answer. Some categories of challenges and risks include: Reduced control. The corporation has to take whatever devices the employees select, and loses control over them. The corporation may also have reduced leverage to control the software on those devices. Dependence. The corporation becomes ...


6

Whilst I don't believe that there's a definitive confirmation that this is the situation, I'd suggest that the problem with android likely comes down to a conflict of interests between the carrier, handset manufacturer and OS manufacturer. It's in Googles interests that handsets are upgraded regularly, as it improves peoples perception of the OS and makes ...


6

A piece of mobile phone malware could be designed to use any communications technology the mobile can access. If a phone doesn't have internet access it could send texts for example. There are considerations with each connection method: Internet access: this is pretty cheap or free for the malware to use, as long as the malware is not too greedy it is ...


6

You must define "transmitting". There are two categories; active and passive. Active transmissions require relatively large amounts of power to actually send out data whereas passive transmissions require little to no added power and could represent a NFC transmission such as an RFID chip being read by a scanner. There are also some theoretical ...


5

Since Ice Cream Sandwhich, Android devices support full disk encryption. This is based on dm-crypt and requires password or pin to unlock your phone. While users may find this irritating (the swipe method is not supported), it is a tradeoff you will need to consider to keep your info safe. Apps that can whipe data or more: Kaspersky Mobile Security ...


5

Yes, the "phone" itself is an application. It can be hijacked or replaced entirely. In fact, Android handsets are DESIGNED to do this so that you can automatically use a VOIP provider when making phone calls if you so desire. Malware with complete device control could simply place itself as such a service and when you dialed a call, it would be connected ...


5

Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit ...


5

If your roommate got access to your phone once to install spyware, what's to stop him finding another opportunity to read the cached results of the surveillance? Who needs a data connection?


5

In your specific case, there's a different answer: never carry sensitive data through a border. Border agents almost always have enormously wide legal powers to search devices on their own, and are very happy to utilise them when asked to by intelligence agencies. In fact, if you expect to be subject to a targeted attack by an intelligence agency, I ...


5

The risks include: Physical theft Bad passwords Badly written code Bad code segregation Data loss, interception or theft MITM Jamming etc You'll have spotted that none of these are new... And the solutions to these are just the same as they have always been. Mobile devices are not 'new' from a security perspective. And the only reasons they are ...


5

If a client is compromised, it can not be trusted, period, full stop. Any device you don't control and can't trust could potentially misbehave in any way. You need a trusted third party to validate the behavior of the untrusted device if you want to trust it for a portion of the security. Unfortunately, computers are too complex for an end user to be of ...


5

There are potential technical options you can pursue, and several of those have been mentioned in other answers, such as global policies or BIOS settings to disable the USB ports, or physically disabling the USB ports. However... My suggestion is that if you have a systemic problem with this sort of thing, it isn't, in fact a technical problem at all, but ...


4

One risk of BYOD is the idea that it reduces sysadmin and helpdesk costs. It is a myth but it can damage productivity a lot. With BYOD, the users themselves take charge of inventory and replacement of failed parts. But they still need to connect to the internal network and be helped with the corporate applications (i.e. intranet Web site), and since the ...


4

iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data. An iPhone has two partitions: System data User data The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your ...


4

It's been done when using two factor entered into computers (and directly at ATMs; see link at very bottom for the ATM 2-factor SMS problems). KrebsOnSecurity.com blog lists many banking eheists, including this one: https://krebsonsecurity.com/category/smallbizvictims/page/4/ "The year before the cyber theft, Comerica had switched from using digital ...


3

There is at least one Exchange compatible Android client that stores the enterprise information in a separate encrypted file and wipes only that file when a device wipe request is issued by Exchange. The down side was I do recall it being something like $50 a seat. Presumably there are similar options for iPhone. The ability to remote wipe their data is ...


3

I believe that the company is entirely justified in it's approach. If you want to avoid the risk of having your personal data wiped out, keep your personal and work data separate. Your company might consider deploying something similar to BlackBerry's Secure Work Space technology that claims to keep work data in a completely separate workspace. This should ...


3

Where I am, the perceived problems are: support costs - that the company will bear the burden of issues which aren't realy it's problem (Hello helpdesk, how do I configure my Whizzbang 3728-T for accessing the VPN?) that unmanaged user devices become a conduit for malware into a controlled environment that data on this devices is not adequately secured and ...


3

There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft. The malware was spread by using independent application stores. Almost all of the phones resided ...



Only top voted, non community-wiki answers of a minimum length are eligible