Timeline for Pen test cell-phones
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Feb 24, 2021 at 6:42 | history | suggested | The Obscure Archivist | CC BY-SA 4.0 |
Corrected spelling, formatting, and grammatical issues.
|
| Feb 24, 2021 at 3:25 | review | Suggested edits | |||
| S Feb 24, 2021 at 6:42 | |||||
| Mar 1, 2011 at 21:04 | answer | added | Woot4Moo | timeline score: 3 | |
| Mar 1, 2011 at 18:48 | comment | added | Henri | Thnx for the info and advice guys :) | |
| Feb 28, 2011 at 19:04 | comment | added | AviD♦ | I'm not so clear on what you're trying to acheive here. Can you elaborate? In fact, I would suggest you back up, and as a first step figure out your threat model. What do you expect to be protected? What attack scenarios are you expecting, and want to prevent? Etc... Then, you can work from there and figure out how to verify these things. E.g. are you looking at sensitive company info in SMS? Pics of stolen docs? Cached data from corp apps on smartphones? Worried about stolen phones? Spoofed phone #? And so forth.... | |
| Feb 27, 2011 at 18:58 | comment | added | labmice | You see where this is going right? I hope the company boss have a good lawyer support, cause it seems he will need it. Even if the company bought the devices, and the SIMs, and pays the bills, letting employess store PERSONAL info (and NOT company data), will lead you in trouble. Also I don't know of ANY cell phone provider that allows throught their contracts anyone to clone THEIR SIM cards. You need to see and solve the legal side of things before moving to the technical one. Just my 2 cents | |
| Feb 27, 2011 at 18:57 | comment | added | labmice | Henri.... these SIM cards, belong to the employees? What about the cell phones? As devices. I don't care who is paying the bill. The cell phones (as devices) and the SIM cards (as just SIM cards) belongs to the company or the employees. And if they belong to the company, what was the "written aggrement" about the use of those devices. Can the employees make personal calls? Take personal photos? Sent personal sms having NO company info inside the text? | |
| Feb 27, 2011 at 18:24 | comment | added | Giacomo Verticale | Newer SIM cards should have anti-tamper protection that makes it useless if you try to clone it. Have you already succeeded in cloning one? | |
| Feb 27, 2011 at 16:09 | comment | added | Henri | labmice, yes different phones and different pins but the point is that almost all employees have sms-messages with confidential info. Besides, having access to the phone allows for impersonation. The customer wants to know how much effort it costs to break/bypass the pin and depending on that if it is better to switch. A proof-of-concept is required with a detailed approach such that the customer can decide for himself if it is safe and for how long. So about the repair shop, how can a PIN be resetted? Any detailed info? | |
| Feb 27, 2011 at 16:05 | history | edited | Henri | CC BY-SA 2.5 |
added 1 characters in body
|
| Feb 27, 2011 at 11:18 | history | tweeted | twitter.com/#!/StackSecurity/status/41819349329125377 | ||
| Feb 27, 2011 at 0:01 | comment | added | labmice | Since I am not a native english speaker, I have missed some things. First all of you said "phones of employees". So differents phones, with different SIMs and different PINs. Right? Are you gonna clone ALL of them and brute force them ? And I didnt get the "Physical access to the phones is allowed only when the code is turned off". You mean when the phone is turned off? What are you/your costumer wanna prove/test. That you can crack the PIN? Any small cell phone repair shop (or even you with the right service manuals) can reset the PIN if you have physical access to the SIM. I'm missing sth ? | |
| Feb 26, 2011 at 23:41 | history | edited | AviD♦ |
edited tags
|
|
| Feb 26, 2011 at 23:32 | history | asked | Henri | CC BY-SA 2.5 |