The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

222

Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable. It also does not achieve the political goals of forcing Apple to assist in decrypting the device, paving the way with precedent for the flurry of future requests of this sort to come, some of which are certain to have less ...


103

Unless you can come up with some other explanation of how this happend, it sounds like your phone has been infected by some malware. It's impossible for us to say if the infection was the result of something the factory did or something you did. Either way, you should be very concerned. I'd recommend the following course of action: Make a backup of any data ...


93

What makes you think that they haven't already? This case is about setting a precedent to obtain access whenever the government desires. They chose this case because America's fear of terrorism will give more popular support for setting this precedent than, say, busting a pot grower or catching a tax cheat. What would be even better? Privacy advocates ...


85

Android Yes, it's possible in Android. Any app/service can read your clipboard data. In fact, there is a lot of code online which creates a service running with a listener in the background, which will inform the app whenever the content on the clipboard changes, along with the content. There are a few Android apps that I know which use this feature. One ...


82

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that the encryption was done properly. This is true for an iPhone as much as it is for an fully encrypted notebook or an encrypted Android phone. The situation is ...


78

It doesn't scale While the general consensus is that such technology exists and would be available to FBI, it's not an appropriate general solution because it might be applicable to this case but (unlike a legal battle with Apple) it doesn't scale to all the other cases where they would want to do the same thing. It is expensive - this case might be ...


72

Unless you have secrets on that phone that someone would pay a lot of money to uncover, you don't need to go overboard. A factory reset would work just fine. To decrease the chances someone would still recover something, point the camera out of the window and let it record until it fills up all memory. Repeat if you want. Doing that will overwrite almost ...


64

It's a known scam attempt. The caller probably compromised one of your accounts, and got stopped by the 2FA token sent to your phone. If you send them the token, your account is fully compromised. Or, as Nic pointed very well, may be the account of someone else. What you do? First: don't send them any code or token. That will prevent them for compromising ...


49

Under the assumption that you have a somewhat recent phone (Android 6+ installed from factory, I don't know for Apple but read something about from iPhone 6 on): Wipe the phone/do a factory reset (assuming the phone is still working) Modern devices always encrypt all the data and only delete the key for this encryption if you wipe it. This makes it ...


45

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


42

Since iOS 8, full disk encryption is enabled by default and the passcode is used as key (paired with some secret kept in the phone's HSM so offline bruteforcing is not possible, making it relatively secure even with only a numerical code). For FDE to work we need something consistent as a key. A passcode fits the bill perfectly, it either matches or doesn't....


31

I would be very concerned. One thing I have learnt about security, in all the years I have been trying to understand it, is that if you didn't put something there, somebody else did, and if you don't know what it is doing then the only thing to do is reset, reinstall, and be happy with everything. If you don't know why that software is there, be assured, ...


28

[Update #2] According to the Washington Post, sources familiar with the matter, have stated that the initially suspected collaboration with Cellebrite is not how the data from the encrypted iPhone was recovered. Instead an unknown security vulnerability was used (purchased) from "professional hackers" to prevent the phone from erasing its data and slowing ...


26

Just wanted to chime in and say that the list you have there isn't entirely 100% accurate, but it is close. Keep in mind that this will vary per MDM vendor and mobile OS, but MobileIron can see your location if your employer enables the functionality and you choose to accept sharing your location data. How exactly is this done? They just configure ...


25

The rule you are referring to goes back to Scott Culp and is from this essay he wrote in 2000: https://technet.microsoft.com/library/cc722487.aspx In 2000, there was no such thing as an iPhone. Moreover, the "10 Immutable Laws of Security" are meant as guidelines, aphoristic memory jogs, and (despite the name) not really as laws. They are also outlined in ...


23

@AndréBorie gives the correct technical reason why a passcode is required for full disk encryption. I want to dispel the myth that fingerprint is more secure than passcode. This is a dangerous - yet surprisingly common - misconception. If your goal is to prevent your kid sister from getting into your phone, or you want to increase your security a bit ...


22

Yes, and be concerned about more than your phone. I can’t imagine a situation where an app was installed without your pin/password. without them first jail-breaking or otherwise significantly compromising your phone's OS. I think the only safe assumption is that anything your phone had access to, they also had access to. So any account your phone has ...


21

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


20

There is a semantics issue at play here that make answering definitively very difficult. What precisely did Mr. Snowden talk about when he said "Yes they can turn your phone on." Did he mean activate a device that is in a shutdown (not standby, low-power-ready-to-function) state? Doubtful. Did he mean activate a device in a low-power, standby state? ...


20

You are assuming the problem is technical. It might be political / legal. Let's assume the government already has the technical capability of extracting this information from phones, without Apple providing them a back door. The government, for both legal and technical reasons, can't admit that. Legally, because it might tip its hand to other investigations ...


17

There is a possibility that the other iPhone was... yours. Your IP address is awarded to you by whatever technology provides your Internet access. When you connect over 3G, the IP address comes from your phone company. When you connect over WiFi, you get an IP address from the WiFi access points. The IP addresses can be "dynamic", i.e. it may change over ...


16

Under the assumption you do not trade state secrets I would: Wipe the phone/do a factory reset (assuming the phone is still working) Remove the SD Card (keep it for later use) (does not apply to the iPhone5, since it has none) Open the phone Locate the motherboard (the largest piece of printed circuit board) Unseat or destroy the following chips as possible ...


14

Not using a cryptographic hash - no. But you could use a Fuzzy Hash or Locality-sensitive Hashing. Fuzzy hashes are different from normal hashes in that they allow similar content to cluster together in the hash collision space*. Typically one-way means you can not infer what was hashed - but with fuzzy hashes, if you know a similar file (fingerprint image)...


12

There's any number of ways that your company's network administrator may have identified you. The principal thing you need to realize is that, while you may be using your own device, you are on your company's network. That grants the company a lot of visibility to the traffic your device generates, should they choose (as it appears they have) to examine it. ...


12

My company is currently going through the process of implementing an MDM for all work phones... So perhaps something that I can help with. The company will install profiles and policies onto the mobile device which (On top of what you have outlined above in image) can enforce the following: Constant VPN connection (Ability to intercept network traffic to ...


11

Regarding your dad's iPhone, there's nothing to worry about. This is just an automated attack against Wafer GSM-AUTO (SMS-capable) devices. The Wafer GSM-AUTO is a very simple Microcontroller. You can think of it as a remote power switch. It control anything from a security door switch to a normal light switch. I'll try to translate the commands for you #...


11

A mobile phone, generally speaking (*), is broadcasting the message "the SIM card I have with the ID XXXX is now available on the network". This ID is called IMEI IMSI (**) and is unique to a SIM card. The IMSI is then mapped to a phone number by your provider. If you break this chain (by going to the network provider and requesting a new SIM card) the ...


11

The most concerning point is that the repair shop employee claims not to know anything about it. The app may or may not be okay. If someone in the repair shop installs a new app, i.e. for testing if installing works again, this can be a problem, but doesn't have to be. But if they tell you they do not know about it, either it was some malware installed it, ...


10

I'm sorry for the long answer, but I felt it's needed here. Plus, you're not the regular OP looking for a quickie. I've looked into this when we studied GSM in school. The are several methods to find out the SMSC from your phone; however, that's completely different from what you're looking for. Let's start with how an SMS is sent (very basic description): ...


10

iPhones default to "Chuck's iPhone" as their network name. You change that by changing your device's name. Same with any iOS device.


Only top voted, non community-wiki answers of a minimum length are eligible