As a pentester, it’s always a different story when we are the ones writing the report. Being on the receiving end is stressful, even more so when you throw compliance into the mix. I figured since I have been fielding questions left and right about what to do when it comes to mobile applications and HIPAA compliance, I would simply write a blog post on the topic.
I like to think about myths as common ideas that seem to perpetuate regardless of the rapid pace of technology change that is part of the modern world. When I’m out talking to folks about securing mobile apps I find that the same ideas about what enterprise security being perpetuated.
Many of the myths that I come across appear to offer panaceas that are comforting to the status quo. The idea that the newest iPhone or Samsung device will automatically make enterprise mobility safe. If enterprise data is encrypted then it is perfectly safe. If we put a wall around our apps and data then no one will be able to get in. These are comforting myths.
One of my national cyber security month activities was participating in an employee awareness day at NYU Langone Medical Center. Kudos to the infosec team for putting on a nice event.
Since the audience was doctors, nurses and students my goal was to present mobile security statistics in a memorable way. I had two slides showing at a very high level how mobile malware works, but one of the main points I wanted to convey was an app doesn’t have to be malware to do you harm.
We know that any type of software is bound to be hacked eventually, but Apple is claiming that nothing will get past its new fingerprint scanning technology. While its security implications far exceed those of a traditional PIN, could a hack of this nature truly be dangerous to high profile individuals? What would a hack like this mean for an enterprise or government agency? In part three of our discussion of Apple’s fingerprint scanning technology for the iPhone 5S, we discuss where these attacks are likely to come from and what this means for your mobile security.
Apple’s making a lot of claims about how well they securely store that fingerprint and who can access it and what’s actually being stored. Nobody’s ever been really too deeply verify any of this yet. We do have a few hints from patent filings, from documentation of the company that makes the sensor, documentation of the trust zone technology that Apple says they’re using to store. Apple really put quite a bit of engineering effort into this, so they claim a couple of things.
Did you know that 30-50% of people choose not to use any sort of passcode on their smartphones? The inconvenience that comes with typing in a long passcode means users are willing to put their mobile lives at risk. Apple has attempted to solve this problem by creating a fingerprint scanning application that allows for convenience and security without compromise. With this type of technology on the rise, users may be wondering how it works and if this type of passcode is really safer. In part 1 of our Apple fingerprint technology series, Jared Carlson and Darren Meyer, both senior security researchers at Barracuda, discuss this type of technology and what it means for mobile security.
Mobile devices are extremely interesting for attackers because they hold a digital representation of our lives.
Every application that resides on our devices contains information on some aspect of our lives. What games we play, who we talk to, where we work, what utilities make our lives easier are all captured in our mobile devices. Anyone armed with this information can mimic our digital lives to friends, family, colleagues and corporate systems.
The ability to mimic your life is valuable to a variety of people. A marketing department that can mimic your life will get better at selling you things.
Last week, a fake iOS App Store server went live with simple instructions for how to circumvent paying for in-app purchases (such as bonus levels in games) and unlock them for free. Most apps were vulnerable to being duped into believing the user had already paid for their content. Many people willing to engage in software piracy eagerly followed the steps and found that they worked, but there was a lot of confusion about how it could possibly work and whether it was safe.
The particular person who published the instructions added a note to remember not to type in …
In the rush to play with new online services – which, admittedly, are often awesome – it’s easy to forget that anyone with fifteen dollars in their pocket can rent a server to store your personal data in whatever haphazard way they want. It was only …
[UPDATE! April 15: Pandora removes all advertising libraries from its Android and iPhone apps!]
The blog post we made earlier this week entitled, Mobile Apps Invading Your Privacy, gives detail around the information being requested by the advertisement libraries embedded inside a popular online radio application. There have been a number of great posts and comments that got us thinking more about the issues and the types of data being requested.
First off we want to thank some people who commented about the Pandora application not having permission to actually access the GPS on the device. Below are the …