Category Archive

A presentation and paper on Reverse engineering JTAG at the 26th Chaos Communication Congress is now available to download here:

http://events.ccc.de/congress/2009/Fahrplan/track/Hacking/3670.en.html

Other Hacking and reverse engineering papers and talks from the conference can be found here:

http://events.ccc.de/congress/2009/Fahrplan/index.en.html

The hacking track is here:

http://events.ccc.de/congress/2009/Fahrplan/track/Hacking/index.en.html

Hackers claim to have stolen all T-Mobile US’s corporate data, customer accounts and network infrastructure. More information from the Register can be found below:

http://www.theregister.co.uk/2009/06/08/tmobile_us_loss/

Here is an article about the security of the newly released iPhone 3.0 software for both iPhone 3G and iPhone 3G S:
http://www.net-security.org/secworld.php?id=7647

The research team, which included Edith Cowan University of Australia and BT, revealed some early results yesterday in news reports by the BBC and British television affiliates.

To read more about the research go here:
http://news.bbc.co.uk/2/hi/uk_news/wales/8036324.stm
and here:
http://www.darkreading.com/security/storage/showArticle.jhtml?articleID=217400054&cid=nl_DR_DAILY_H

The video talks about a couple of people who’s lives are ruled by harrasing calls and threats. They claim that their phones are tapped with special software.

Rick Mislan talks about the software and how easy it is to be placed on mobile phones.

Software such as:

• http://www.mobile-spy.com/
• http://www.world-tracker.com/
• http://www.flexispy.com/
• http://www.e-stealth.com/
• http://www.fonefunshop.co.uk/spyphone/
• http://www.thespyphone.com/allinone.html

Link to Video on YouTube:
http://www.youtube.com/watch?v=uCyKcoDaofg

It looks and functions like a Blackberry 8830 but it sure is NOT a regular Blackberry. It is locked down by NSA. I am not really sure if it is a good idea at all. NSA is installing the SecurVoice software on it for both voice and messaging as one of the ways to secure the phone. I am sure that there is a whole infrastructure that is required to run his handset services. Even considering all that, I Still believe that a mobile-phone-carrying president opens so many doors for hackers.

Can NSA and Obama get away with using a (persumably) secure mobile phone service and handset? That is the question of the day!

Read more here:
http://blog.wired.com/gadgets/2009/04/obama-to-get-ba.html

It might not be because they are secure, but simply because the ROI is just a mere phone handset! Add to that the device, OS, and carrier variations.

Read more here:
http://mobile.slashdot.org/article.pl?sid=09/03/25/1238246&from=rss
and here:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Mobile+and+Wireless&articleId=9130346&taxonomyId=15&pageNumber=1

Chris Ogle (29) from Whangerei, New Zealand has stumbled across the sensitive military details of U.S. military personnel after purchasing a secondhand MP3 player in Oklahoma, USA. He discovered around 60 sensitive military files dating from 2005 on the used music player. The files were clearly marked as ’secret’ and contained the phone numbers of numerous soldiers serving in Afghanistan and Iraq.

For more on the story visit:

http://www.thetechherald.com/article.php/200905/2852/Man-finds-U-S-military-secrets-on-secondhand-MP3-player

I don’t know if this is true or not yet but here it goes! There seems to be a vulnerability that affects Nokia Series 60 phones, including N95 and N73 handsets that blocks all SMS and MMS from reaching the phone, hense the name “Curse of Silence”. attacker in this case sends a specially designed SMS message to the target phone. What’s worrying is that the recipient will receive no indication that they got the message.

The only way to get the target phone to recieve messages again is to factory reset it. Even after the factory recet, the phone still remains vulnerable to future silent curses. The attack will only work on phones running version 2.6, 2.8, 3.0 or 3.1 of Symbian S60.

Source: http://www.dialaphone.co.uk/blog/?p=2505

Cellphone Gun:

Pen Gun:

In an article in The Register, Google defends limiting accress to Non-Marketplace applications to the following:

At this point, we think it is too dangerous to give a third party application blanket access to install applications without the user being involved. That may change in the future, but for now that is the way it is.

Read more about it in the article.

Ideally the emergency dial screen should allow ONLY EMERGENCY NUMBERS to be dialed out on a passcode locked phone. The iPhone however allows for ANY NUMBER to be dialed when it is passcode locked! This bug is not new, it was present in iPhone 2.0.2 as well!

Here is a video demonstrating the issue:

I discovered this bug in 2.0.2 just a couple of days before 2.1 came out. So, it was too late for me to give a heads up to Apple. So, I waited for 2.1 to come along to see if it was fixed. I did that today and found out that it wasn’t fixed.

This of course could be an Auatralia-only issue or even an Optus-only issue. Nevertheless it is a security issue with the iPhone and should be addressed.

UPDATE 18 Sep 08:

There is some debate on whether it is a bug or feature! Look at the following link for some more information on the issue:
http://www.macrumors.com/iphone/2008/09/17/iphone-2-1-emergency-call-anyone-bug-or-feature/

–
About the author:

Marwan Al-Zarouni CISSP is currently pursuing a Doctor of Information Technology award at Edith Cowan University. He is a member of the Security Research Centre at Edith Cowan University in Perth, Western Australia.

In a previous post http://www.mysecured.com/?p=202 I showed that your data is not wiped when you do a normal restore. So in this post I will show you some of the ways you can wipe your phone with some degree of certainty that the information on it is wiped.

If you want to wipe your iPhone before you sell it on eBay or give it back to Apple because the touch screen stopped working all of a sudden! Then here are the different ways you can wipe it:

- Jonathan Zdziarski’s method:
http://www.zdziarski.com/papers/wipe.html

It involves jailbreaking and command line access. It is best suited for people with jailbroken iPhones and are really paranoid and control freaks!

- Rich Mogull’s (securosis.com) method:
http://securosis.com/2008/05/20/formatting-an-iphone-to-wipe-data/Which is an easy to do 2 restores and 3 overwrites of the iPhone device’s user data area. Look at this video from CNET on youtube:

- BigBoss Wipe App Method:
http://sleepers.net/news/?p=174
This needs the iPhone to be jailbroken as well. It does a zero out wipe on the device, so it will require a restore afterwards.

The basic idea of all of the methods is to overwrite the data in the user area. Be it by overwriting it with music as in Mogull’s method or by using a wipe tool as with BigBoss or by overwriting it with zeros as in Jonathan’s method. I prefer the latter two methods as overwriting with music might leave some of the data intact (call me paranoid!). But on the other hand it could be the only option for people who do not want to jailbreak their iPhone or do not have the technical expertise to do so.

UPDATE (28 August 2008):

iPhone software 2.0 and above comes with an erase all feature that was not available in previous versions of the iPhone and therefore this feature can be used to completely wipe the iPhone. This can be done on the iPhone itself without needing to connect it to iTunes.

So, on the iPhone tap Settings -> General -> Reset and then select the “Erase All Content and Settings” option from the buttons shown. Users must note that under the 1.x iPhone software, invoking this setting erased the iPhone’s obvious data, but not did NOT PERFORM A ‘bit-by-bit’ WIPE. Under the 2.0 software however, you get a much more thorough wipe (bit-by-bit). which can take an hour or two to complete depending on the storage size of the iPhone being wiped.

According to Jonathan Zdziarski:

So, if you have to return your iPhone to an Apple or AT&T store and they offer to replace it with a new one, make sure that you wipe your data properly first. A proper bit level wipe is needed here and NOT a system restore!

This is a stand-alone hard disk wiper! No computer needed. Wiebetech’s pocket-sized eRazer erases at a rate of 35MB/s, effectively wiping a 250GB hard drive in under two hours. The eRazer meets the DoD erasing standerds and sells in two versions one for $99 and the Pro which supports SATA and Multi-pass sells for $150… Cheap!

http://www.gizmodo.com.au