Hot answers tagged

348

This may not be the answer you will be happy with but how about abstaining from having any undesirable data inside your phone in the first place and instead using the right tool for the job? According to Wikipedia: The app records information about the device it is installed on, including its [...] IMEI, the phone's model and manufacturer, and the phone ...


187

Get a phone which doesn't support Android apps. Why are so many of the answers complex? And not just complex, fragile and suspicious and downright dangerous to the questioner? You want to use your phone to send messages and make calls, right? You don't want this app installed, right? Say hello to your new phone: Good luck getting an Android app running ...


113

Let's go through the process of what actually happened: Telegram requires a cell phone number to be linked in order to create an account. To verify that the number exists, they send out a verification code for you to enter in the app while creating the account. This person obviously didn't want their own cell phone number to be linked to the Telegram ...


103

GSM includes some protection through cryptography. The mobile phone and the provider (i.e. the base station which is part of the provider's network) authenticate each other relatively to a shared secret, which is known to the provider and stored in the user's SIM card. Some algorithms known under the code names "A3" and "A8" are involved in the ...


103

Unless you can come up with some other explanation of how this happend, it sounds like your phone has been infected by some malware. It's impossible for us to say if the infection was the result of something the factory did or something you did. Either way, you should be very concerned. I'd recommend the following course of action: Make a backup of any data ...


89

This is a serious problem in password-management. The first problem here is the way they managed his key in their source code. SnapChat states that they send the photos encrypted over internet, and it is true after all, but they are using a "pre-shared" key to encrypt this data (badly using also AES in ECB mode) so, every user around the planet has the key ...


87

Eye Tracking for Everyone. 2176-2184. 10.1109/CVPR.2016.239. (2016) - Krafka, Khosla, Kellnhofer et al Our model achieves a prediction error of 1.71cm and 2.53cm without calibration on mobile phones and tablets respectively. With calibration, this is reduced to 1.34cm and 2.12cm. So yes - it is possible. This particular study was performed ...


82

First: password is used to get access to the full disk encryption key fingerprint is used to unlock the screen (of an already "decrypted" device) Encryption key retrieval must be: accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be ...


81

It's quite easy to send an SMS message that appears to come from the phone number of your choice without actually controlling that number. And so sending an SMS from a number doesn't verify your ID in the same way as receiving an SMS to a number.


80

This is a tricky one. It goes without saying, but it's also a dangerous one. Attempting to circumvent these restrictions and getting caught doing so will potentially cause a lot of legal trouble. If they throw people in jail for refusing to install the app, I wouldn't want to figure out what they do to people circumventing the app restrictions. It is ...


79

Because this is a fundamental principle of information theory. If a machine can decrypt a piece of information and keep it for ten seconds, it can decrypt it and keep it forever. Any attempt to disguise this is simply smoke and mirrors.


77

Some telephone or SMS numbers allow for an additional charge that is automatically recovered by your phone provider and reversed to the owner of the number. This is mainly used (legally) for some TV games where each participant pays a little money when calling a special number or sending a SMS. At the end, either one of the players earns something, or the ...


67

tl;dr - the protocols were developed prior to MITM being perceived as a threat; the deployed infrastructure now serving billions of cell phones worldwide can't easily be changed to add cell tower validation; and governments have no interest in fixing this issue. Cell phone protocols differ from IP protocols in that they were never a peer-to-peer network of ...


66

That way the hacker won't know if they have got the login details correct or not. If the information presented after login has no relationship to the person who the login should be for, then most hackers will quickly recognize that the login is probably not the real one. But, in order to show information which looks like it fits the user, considerable ...


62

This is known as a 'Smudge Attack' It really depends on how much you've used your phone since you've last unlocked it, but the general principle still stands. If you use the pattern feature of Android phones, this can be particularly obvious. The University of Pennsylvania published a research paper on the topic and basically concluded that they could ...


61

The problem with this scenario is that emails are typically not sent from the device itself, but from a central service. In order to do what you want, the investigators would have to make a few hops: to the email service (gets the user account details, including the IP the user used to connect with) to the ISP the device used at the time of sending (gets ...


55

The SIM card contains a private key or more commonly a symmetric key called the "Ki", and the card is designed to never divulge this key to the outside world. The SIM card itself has physical security measures to make reading the key from the card very difficult without destroying the original card and/or the data stored in the card. For a long time, this ...


54

They can execute code on your device while they have physical access to it. And you can't refuse it. I'm sorry to say that but you are basically doomed. There's no way to trust this device anymore. That's part of the 10 immutable laws of security. In your case the rules #1, #2, #3, #6 and #10 are applicable. But when you act like you don't trust the device ...


50

The concept you're describing is called Plausible Deniability and methods to provide it have indeed been implemented in some software, VeraCrypt being one example. One problem with implementing it in websites, as you suggest, is that it's very hard for the website developer to come up with fake data that is realistic enough to fool an attacker while not ...


46

What are the technical aspects to tracing a phone call; is it more difficult for mobile phone? In the old days, signaling was inline, hence the 2600hz hack. Calls were setup as one switch talked to another, then another, and so on until a circuit was established end-to-end. In the modern age, everything is out-of-band over SS7 and every switch is lined up ...


46

If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know when it was sent) to find out - from the service provider - the precise location the email was sent from? Yes, this is very easy. However... the key word here is "precise location." Not exactly. Not unless the phone is hacked. Government ...


45

I am just going to take a guess here. Your telephone data carrier may have an optimizing or caching proxy for content whose IP address appears in your JSON result. As the proxy has no visibility into encrypted HTTPS packets, it cannot proxy the content, so it may be routing directly with your public (routable) IP address. If this is the case, your phone ...


44

The code is not "cracking" the encryption. You are merely decrypting the data with the correct encryption key which was obtained by reverse engineering the application. How could they do better? Not hard code the encryption key for one.


43

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements. As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin /...


42

Correct: The Web-Client is establishing a secure connection to the phone. The messages you send through WhatsApp Web are encrypted by the WebClient, decrypted by the phone, then re-encrypted to fit the end-to-end scheme and then sent to the recipient. Same thing the other way around. I dont know details about the protocol, but this is what i suspect (or how ...


41

Who's to say that the phone is really off? If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user. However firmware cannot stop you from introducing a hardware switch to disconnect the microphone. A ...


40

One way to mitigate smudge attacks on smart phones is with an application called WhisperCore. It arranges the numbers vertically and it then asks you to wipe the screen in order to unlock the phone, obfuscating the original smudges. If you use a pattern to lock your phone, after you input the correct pattern, it a screen full of stars. Swipe the highlighted ...


40

There are two main reasons why smartphones have fine-grained permissions while desktop computers don't. History. Mainframe operating systems have a tradition of giving permissions to the user rather than to the program, and this carried over into minicomputers/workstations/desktops; the desire to maintain compatibility with existing programs limits the ...


38

This started as a comment reply to @user10008 but got too long... Even after the towers are all upgraded, the carriers can't immediately switch off 2g service for a number of reasons. The biggest issue there is that not everyone upgrades their phone frequently; in particular this is true of people who use it as just-a-phone or an emergency-use-only-phone. ...


33

For telecommunications, check out GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper ...


Only top voted, non community-wiki answers of a minimum length are eligible