Skip to main content
85 votes
Accepted

Why do mobile devices force user to type password after reboot?

First: password is used to get access to the full disk encryption key fingerprint is used to unlock the screen (of an already "decrypted" device) Encryption key retrieval must be: accurate - on ...
techraf's user avatar
  • 9,139
81 votes
Accepted

Why is iPhone's internal storage so hard to crack/decrypt?

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that ...
Steffen Ullrich's user avatar
47 votes
Accepted

Why are there more research papers on Android malware than iOS malware?

Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is ...
defalt's user avatar
  • 6,871
45 votes
Accepted

Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility ...
Akber Choudhry's user avatar
45 votes

Why do mobile devices force user to type password after reboot?

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements. As you probably know, the ...
watchowl's user avatar
  • 5,458
37 votes
Accepted

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

Unless you specified that your software has to be secure against TLS interception even in the case of a jailbroken/rooted machine - which I hope you didn't, because that's impossible and a fool's ...
CBHacking's user avatar
  • 49.1k
25 votes

Why is iPhone's internal storage so hard to crack/decrypt?

The rule you are referring to goes back to Scott Culp and is from this essay he wrote in 2000: https://technet.microsoft.com/library/cc722487.aspx In 2000, there was no such thing as an iPhone. ...
Tom's user avatar
  • 10.4k
23 votes

Why are there more research papers on Android malware than iOS malware?

I can think of a few reasons: Android is open source That makes easier to analyze its workings and identify vulnerable code. It's more used More people use Android than iOS, so the resulting malware ...
ThoriumBR's user avatar
  • 54.5k
20 votes
Accepted

What does Encryption at REST and HTTPS mean?

HTTPS is one form of "encryption in transit", which means that data passing over the network to or from the application is encrypted. "Encryption at rest" means that the data the application stores on ...
Mike Scott's user avatar
  • 10.3k
14 votes

Spying on a smartphone remotely by the authorities: feasibility and operation

There is no backdoor by design in the smartphones which would provide government agencies this kind of access. With a properly signed update process (i.e. only able to install signed updates, phone ...
Steffen Ullrich's user avatar
13 votes

Is using Basic Authentication in an iOS App safe?

Will the username and password be stored in any history or logs? Commonly authorization headers are not logged but, of course, one could configure the application or server to log these data. Thus ...
Steffen Ullrich's user avatar
13 votes
Accepted

Genuineness of Application Pentest On Jailbroken iOS Device

Generally iOS Security assessments (a.k.a penetration testing) are targeting applications running on an iOS device and not the Operating System/platform itself (which has already been subjected to a ...
Rory McCune's user avatar
  • 62.4k
12 votes

What does Obama's phone say about Android and phone hardware?

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states ...
Steffen Ullrich's user avatar
11 votes

Is it possible for someone to see under the "blacked out" part of this image (see below)?

PNG is a bitmap format, thus "blackening out" is a destructive method: what was in the original picture before it was replaced by black pixels is no more in the blackened picture. You can use any ...
A. Hersean's user avatar
  • 10.6k
11 votes
Accepted

Did I stumble upon a cell hidden network or is my device being attacked?

I strongly suspect those four characters are an "A", a "T", an "&" (the Sun symbol) and a "T" again. Possibly the UTF8 for 4F10, 5418, E298BC and 5418. Actually, as @Matt observed, the little-...
LSerni's user avatar
  • 22.9k
9 votes

Is using Basic Authentication in an iOS App safe?

You should use a temporary token after the first exchange, to avoid transmitting the real credential with every requests. Thus your apps only have to remember the temporary token, not the full ...
Tom's user avatar
  • 2,105
8 votes
Accepted

Pegasus iOS exploit & Kernel Memory Corruption

The exploit uses a combination of three vulnerabilities. Each vulnerability is a bug in an iOS component that allows the attacker to do things that are not supposed to be possible. Stage 1 (CVE-2016-...
Gilles 'SO- stop being evil''s user avatar
8 votes

How does the WhatsApp chat history recovery work together with their encryption mechanism?

WhatsApp includes a feature to explicitely cope with users losing their phones or the phones being broken. That feature is discussed in a article from the Guardian where it is seen as a back door: ...
Serge Ballesta's user avatar
8 votes

Is it possible for someone to see under the "blacked out" part of this image (see below)?

There are ways, but possibly not in your example case (blackeneing at end of line). If you blacken a word or short phrase (e.g., a name) in the middle of a paragraph of justified text in a ...
Hagen von Eitzen's user avatar
8 votes

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps?

The problem is that the server cannot store a hash of the fingerprint, because the fingerprint can come with slight variations that would give a completely different hash. And if your fingerprint is ...
Serge Ballesta's user avatar
8 votes

Why does Apple require your passcode when you restart?

The reason for requiring passcode is because the file system encryption key is encrypted using the passcode: The content of a file is encrypted with a per-file key, which is wrapped with a class ...
Lie Ryan's user avatar
  • 31.4k
8 votes
Accepted

Are updated iOS devices vulnerable to NSO Pegasus?

NSO Pegasus does not refer to a static software but it is a continuously evolving product, which will be adjusted to what is currently needed to evade the detection. The security issues that you refer ...
Steffen Ullrich's user avatar
8 votes

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

You cannot prevent a determined reverse engineer from bypassing your controls. You can make it more difficult but cannot prevent it. Pinning a key won't help you in this case. Popular SSL pinning ...
b4da's user avatar
  • 710
7 votes
Accepted

Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?

Oh yeah, those comments you quoted seem to be to be woefully ignorant (and rather disrespectful since you have a legitimate question). Welcome to the world of tin-foil-hattery! Your fear that the ...
Mike Ounsworth's user avatar
7 votes

How to prevent "JailBreak detection bypass" by Cydia tools such as "Flex 3" etc?

I am pretty sure there are no reliable methods to detect jail-break/root. And I would not recommend locking out users. My bank for example had me accept responsibility in case my account gets hacked ...
Peter Harmann's user avatar
7 votes

Is there always a user notification when smartphones record audio?

It's best practice to show when a device or application is actively listening, but it's by no means guaranteed. There's a lot of debate about which apps may or may not be listening - Facebook and ...
securityOrange's user avatar
7 votes

Why are there more research papers on Android malware than iOS malware?

It's easier and more profitable to write malware for Android, thus there is more research on, and more research papers about Android malware compared to iOS. To break down why malware is more common ...
TCooper's user avatar
  • 366
7 votes

Spying on a smartphone remotely by the authorities: feasibility and operation

Such a thing is not possible natively. Police would either need to: install something on the device get device makers to include this functionality So, this could simply be an allowance to try to &...
schroeder's user avatar
  • 131k
7 votes

Spying on a smartphone remotely by the authorities: feasibility and operation

Yes, it's possible. Every single competent intelligence service on Earth has access to dozens of zero-day vulnerabilities on most popular phone brands/models. In France, this includes foreign ...
hackishlackish's user avatar
6 votes

Intercept data sent via bluetooth

There is a better method today if you are using android. The developer tools offer a way to sniff Bluetooth packets into a log that can be opened in Wireshark. Go to Developer Options on your phone ...
Ziv's user avatar
  • 201

Only top scored, non community-wiki answers of a minimum length are eligible