Tag Info

New answers tagged

0

You don't exactly need to store anything in the headset, there are plenty of "older" Bluetooth exploits. Assuming that there is a exploit in the Bluetooth hose ( aka the phone ) it could be possible to modify the headsets firmware to exploit it lets say "post pairing" remote code execution. From there it would be possible to download a second stage payload ...


1

Yes, but very unlikely. A bluetooth headset has a microcontroller, EEPROM with firmware, audio circuitry and bluetooth chip (which is itself a microcontroller with its own, distinct firmware implementing the bluetooth stack); I'm pretty sure there are manufacturers that combine all of these elements on a single physical chip. If you can find a ...


0

As far as I can see that it is impossible for malware (e.g. virus, spyware,etc) infects data in phone cell even to store it through a wireless system. This is two different cases; hardware and software. Based on my usage, no data transferred into a phone cell but byte of transfer recording (voice)through wireless headphone. When the data voice is being ...


3

Can This be done? I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking). Intel has some tech to circumvent this kind of attack: ...


2

For the first question, your MAC address is simply not generally considered sensitive information; protocols are not designed to protect it. MAC addresses are used to let multiple devices share a physical link; packets have a source MAC and destination MAC, so that everyone but the destination knows they can ignore the packet and the destination knows which ...


1

In addition to what Michael Karcher said, monitor mode has the advantage of not having to be associated with the AP. This makes it possible to be completely invisible, and to sniff packets on a network you don't have the password for. In promiscuous mode you have to associate with the AP, so your're sending out packets. Monitor mode can be completely ...


0

Packets captured in Monitor Mode will most likely be (Layer 2) encrypted with WPA or WEP. Wireshark can decrypt these packets when properly configured with SSID/passphrase, if properly configured with SSID and passphrase of the AP. Additionally, the EAPOL handshake packets must be observed by Wireshark in order to decrypt these packets.


2

No, it's not possible to prevent someone from capturing the handshake. A properly implemented password with enough entropy can withstand even a very well funded attacker. The example hash rates given for the highest end machine are still only about 1 million hashes a second on a machine with 8 GPUs. In a year you could do 1,000,000*60*60*24*365=3*10^13 ...


1

The PIN is verified online with the bank - see the footnotes on this page http://www.maestrocard.com/gateway/about/about_maestro_paypass.html. The card does not tell the reader the PIN number, it tells the reader its identity details (such as card number). If required (due to high price of transaction), the reader makes a (presumably secure) connection to ...


3

In "Promiscous mode", the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client ...


0

For ultimate security you should disable HTTP in your browser when on untrusted networks. This can often be achieved by setting an invalid proxy address for HTTP traffic (e.g. 127.0.0.1) and leaving the HTTPS one to directly connect. This is only really an issue if any of the sites you use are vulnerable to cookie poisoning attacks. See my answer here ...


0

I would say that you should tell them to use a trusted VPN. Although they may think they are secure using HTTPS, it is possible for an attacker to setup a rogue Wi-Fi hotspot and then intercept SSL connections, removing the protection that HTTPS offers and seeing the data in plaintext. If you use a VPN you know about and are sure that no-one can get into ...


4

First of all, you need to disable SSLv3 on your browser, to prevent POODLE attack (SSL3 "POODLE" Vulnerability) Then, there's no issue using HTTPS even in "not safe" areas, because TLS protect you from Man In The Middle attack, with handshake, end-to-end encryption and Certificate Chain verfication. One common problem you could encounter, is SSL ...



Top 50 recent answers are included