The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

82

First: password is used to get access to the full disk encryption key fingerprint is used to unlock the screen (of an already "decrypted" device) Encryption key retrieval must be: accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be ...


82

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that the encryption was done properly. This is true for an iPhone as much as it is for an fully encrypted notebook or an encrypted Android phone. The situation is ...


66

Various commentators suggest that this would be possible, on the specific hardware involved in this case. For example, Dan Guido from Trail of Bits mentions that with the correct firmware signatures, it would be possible to overwrite the firmware, even without the passcode. From there, it would be possible to attempt brute force attacks against the passcode ...


46

After doing some research, I now believe this is possible, but that it isn't very easy. Without getting too technical, if you look closely, Apple repeatedly implies that they can do it: The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. But now the U.S. government has asked ...


45

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


43

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements. As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin /...


31

The whole story is weird. Since the iPhone in question does not have a tamper-resistant device, the FBI should be able to open the case, read the whole Flash chip, and then run the exhaustive search themselves without even running the phone's firmware. Updates from Apple should have no effect at all. (Edit: in fact it is a bit more complex; see below.) ...


26

There are many ways to track user's location on a mobile device (I will go into how that works later). None of the tracking methods are particularly easy to spoof. It can be done but it is simply outside of the realm of the average user as it generally requires either a modified device (physically or programmatically) or external gear. Moreover, it is far ...


26

Could they actually accomplish this for an existing encrypted phone? Yes. They could provide a compiled image of os with anti-bruteforce features disabled. The fact they're making an open letter IMHO means they've already exhausted all excuses to not do so, implying they are fully capable of doing it. They would have to be able to auto update a phone ...


26

Unfortunately, unless you sniff and inspect your own traffic, you can not... My advice is not to use built-in browsers that do not indicate the protocol being used to handle sensitive information


25

The rule you are referring to goes back to Scott Culp and is from this essay he wrote in 2000: https://technet.microsoft.com/library/cc722487.aspx In 2000, there was no such thing as an iPhone. Moreover, the "10 Immutable Laws of Security" are meant as guidelines, aphoristic memory jogs, and (despite the name) not really as laws. They are also outlined in ...


21

You can't. This is a fundamental principle of general purpose computing. You're running into Shannon's maxim: The enemy knows the system. One ought design systems under the assumption that the enemy will immediately gain full familiarity with them. Just to make my point completely clear: you're giving someone a car, and asking them to only ever drive to ...


19

HTTPS is one form of "encryption in transit", which means that data passing over the network to or from the application is encrypted. "Encryption at rest" means that the data the application stores on its local storage is encrypted, so that an attacker who can access the storage but not the application itself can’t read the data.


18

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


18

Only Apple knows, but I'm going to guess they won't do it. I suspect the FBI has a pretty good idea what is and what isn't possible, especially since Apple has otherwise been cooperating with them. Also the people who work for the FBI aren't idiots, and I bet this isn't the first crime they've investigated with an iPhone. Furthermore, Apple's argument ...


17

I am trying to mitigate SSL bypassing on a jailbroken iOS. ... My application handles confidential data so securing from SSL kill switch and mobile substrate is necessary. There is nothing to mitigate here. SSL is only used for transport level security, that is to protect everything between the client and the server. It is not used to protect the data on ...


15

There have been some other good answers here, but there are some other measures that can be useful too. In fact, not all of these are particularly technical. As others have pointed out, adding a passcode to your iPad will allow for full system encryption, which prevents anyone from stealing data from the device. Combining this with auto-lock and auto-wipe ...


13

Carrier IQ is a rootkit previously installed by mobile phone operators on Android and on iOS 4 iPhones. It is capable of recording every keystroke on your virtual keyboard. See What risk does Carrier IQ pose, exactly?


13

Please refer to Thomas Pornin's answer. Apparently, they don't even need Apple's help for this. In my opinion, they're trying to create a legal precedent. My question is, if the cracking takes seven minutes, why not just release the update, wait ten or so minutes (coordinate with the FBI on this) and then release another update rolling back the change. ...


13

Will the username and password be stored in any history or logs? Commonly authorization headers are not logged but, of course, one could configure the application or server to log these data. Thus check your setup. As for storing in the history: In case of a browser, such credentials will not be stored in the history but might be stored similar to cookies ...


13

Generally iOS Security assessments (a.k.a penetration testing) are targeting applications running on an iOS device and not the Operating System/platform itself (which has already been subjected to a large number of assessments). In order to effectively assess the security of an application running on iOS a jailbroken device is needed as debugging and ...


12

In terms of the second part of your question about the privacy trade-off, that's very dependent on the organisation in question and their priorities. Unfortunately a lot of companies would place their security concerns much higher on an agenda than privacy concerns for their employees (unless regulatory requirements dictate otherwise). On the first part, ...


12

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states that this phone was explicitly chosen because of the KNOX technology which includes secure boot and separation of work and private activities. The reason this ...


11

Start with the Emulator and Simulator, which are part of the standard SDKs. If you prefer certain environments over others, you will gravitate towards a reliable framework for pen-testing these platforms. For example, with an iOS app, I always start with the iOS Simulator after building the code in Xcode. I set my Mac OS X system HTTP and SSL/TLS proxy to ...


11

As @StefHeylen says, you can't, generally. And as @d1str0 says, Burp is one way to see if the traffic is encrypted, if you can proxy the app through it. It's actually worse than that though - mobile apps don't always only make a single connection to a server. It's not uncommon for them to use HTTP for some parts, and HTTPS for others. They can also do some ...


10

The IDFA (advertisingIdentifier) identifies the device but is reset when the device is erased. The IDFA is intended for use by advertising networks which need to be able to identify users across apps. As far as privacy is concerned, the IDFA is very similar to the UDID, but does the following to mitigiate the UDID privacy issues: Unlike the UDID, the user ...


10

Question Restatement: Could [Apple] actually accomplish this for an existing encrypted phone? If yes, then isn't simply knowing this is possible also undermining the security? It seems to me it would be just one step removed from the backdoor they are trying to keep closed. Quick Answer: Yes, Apple can easily modify their minimal version of ...


10

I strongly suspect those four characters are an "A", a "T", an "&" (the Sun symbol) and a "T" again. Possibly the UTF8 for 4F10, 5418, E298BC and 5418. Actually, as @Matt observed, the little-endian UTF16 sequence 4100 5400 2600 5400 ("AT&T"), if interpreted as big-endian, becomes 䄀吀☀吀 which closely matches the strange logo that appeared in the ...


9

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


9

I'd scrap the direct syncing option and simply allow the user to export their private key to a location of their choice, e.g. iCloud, DropBox, internal storage, etc., in an encrypted format. On export I'd do something like this: Ask the user for a password to use. Don't impose any restrictions on them - it's their job to use a good password! Use a strong ...


Only top voted, non community-wiki answers of a minimum length are eligible