Dr. Alexander Loew’s Post

These days, many organisations allow the use of mobile devices for work without much controls on its use, from normal communication to files sharing resulting in the mobile devices becoming endpoints; increasing the number of endpoints in the organisation, thus the risks. Many will argue that since the mobile phones are locked using biometric, they are safe, but this is not true.... Biometrics Aren't Foolproof: While biometrics add a layer of security, they aren't invincible. Sophisticated attackers may be able to bypass them with techniques like replaying fingerprint scans or using advanced facial recognition hacking methods. Data Might Not Be Fully Encrypted: Even with a biometric lock, not all data on your device may be encrypted. Information like contacts, browsing history, or even cached data from apps could be vulnerable if accessed. Finding Ways Around the Lock: A determined attacker might exploit vulnerabilities in the operating system or bypass the lock screen altogether to access the device's storage. Social Engineering: Someone who finds your device might trick you into giving them access through social engineering tactics. For instance, they could pose as a helpful stranger who "found" your phone and ask you to unlock it with your fingerprint to "verify ownership." Here's how to mitigate the risk: Enable Full-Disk Encryption: Most modern mobile operating systems offer full-disk encryption, which scrambles all data on the device. This makes it much harder for anyone to access your data, even if they bypass the lock screen. Use 2FA: Even with biometrics, consider using an external 2FA as an additional layer of security. Enable Remote Wipe: Many mobile devices allow you to remotely wipe them if they are lost or stolen. This ensures that even if someone gains access to the device, your data is erased. Find My Device Features: Utilize "Find My Device" features offered by Android and iOS. These allow you to locate your device, lock it remotely, or even display a message on the screen. Be Mindful of What You Store: Avoid storing highly sensitive data on your mobile device if possible. If it's essential, ensure all data is encrypted. The better way is for organisations to restrict the use of mobile devices for file sharing and only for communication, to cut down mobile devices as endpoints thus increasing the security. https://lnkd.in/gwSwnfcz?

Day 24: Mobile Analysis on TryHackMe | Advent of Cyber 2023 🕵️♂️ Task Overview: Focused on forensic techniques for computers and smartphones, this challenge delves into forensic image acquisition and the significance of maintaining a chain of custody for evidence integrity. 🖥️ Key Techniques: * Static and Live Acquisition: Creating exact disk copies with the device turned off (static) and on (live). * Smartphone Encryption Challenges: Addressing the complexities of extracting data from encrypted Android devices. 🛠️ Tools Used: * Write Blockers: Essential for cloning disks without altering data. * Android Debug Bridge (adb): For smartphone data backup. * Autopsy Digital Forensics: Analyzing the extracted data. 📈 Learnings: * Importance of adapting forensic methods based on the device's state and encryption. * Mastery of specific forensic tools is crucial for effective data analysis. 🌟 Takeaway: This challenge highlights the intricate balance between technical expertise and procedural diligence in digital forensics, emphasizing adaptability and in-depth knowledge of encryption and data acquisition techniques. 🚀🔐 #DigitalForensics #TryHackMeChallenge #CyberSecurityLearning #InfoSec #ForensicAcquisition #DataEncryption #AndroidForensics #CyberTech #EthicalHacking #SecuritySkills

Self-Destructing #USB Tool Heats Your Flash Drive To Over 100C To Lock Your Data Down https://lnkd.in/dWSBmm53

All authentication strategies--including KYC--need to be fundamentally rethought and redesigned. Cost-effective and scalable LLM and GenerativeAI efforts are forcing all of the rules to be changed.

Apple has released updates to address a zero-day #vulnerability (CVE-2024-23222), actively exploited in the wild. This Type Confusion vulnerability could allow a threat actor to execute arbitrary code when processing maliciously crafted web content. Type confusion arises in dynamically typed, interpreted languages, where a variable's type is assigned and can change during runtime, unlike in statically typed languages where it's fixed at compile-time. While dynamic typing enhances software flexibility and speeds up development, it also increases the risk of type confusion attacks. In this type of attack, an attacker modifies the type of a given variable to trigger unintended behavior. This can lead to various vulnerabilities, such as cross-site scripting, access control bypasses, and more. https://lnkd.in/dNK2REZf

#DailyDealflow: Concerned about the security of your mobile device's data? Here's a breakthrough innovation that's set to revolutionize privacy protection. Introducing Metron, an information flow tracking (IFT) technique. Unlike current methods, it doesn't require modifications to your device's operating system or apps. It can accurately detect data leaks without draining memory or computational resources. Competitive Benefits: ✅ Provides more detailed leakage reports ✅ Uses less memory and computational power ✅ Compatible with current Android and iOS platforms Call to Action: Are you a Mobile #SecurityAnalyst, #PrivacyCompliance Specialist, or #SoftwareEngineer? Join us in learning more about this new innovation. Together, we can safeguard sensitive data effectively.

𝗜𝗻 𝘁𝗼𝗱𝗮𝘆'𝘀 𝗱𝗶𝗴𝗶𝘁𝗮𝗹 𝗮𝗴𝗲, 𝗲𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗻𝗴 𝗖𝗨𝗜 𝗼𝗻 𝗺𝗼𝗯𝗶𝗹𝗲 𝗱𝗲𝘃𝗶𝗰𝗲𝘀 𝗮𝗻𝗱 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺𝘀 𝗶𝘀 𝗲𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹 Our newest short provides key insights on implementing BitLocker and drive encryption effectively. Watch now to ensure your data is secure and compliant. #DataSecurity #Compliance #Encryption 📱💻🔒

via @PerilOfAfrica #Technology Apple iOS 17.4: iMessage Gets Post-Quantum Encryption in New Update: By WIRED Source link Apple is launching its first post-quantum protections, one of the biggest deployments of the future-resistant encryption technology to date. Billions of medical records, financial transactions, and messages we send to each other are protected by encryption. It’s fundamental to keeping modern life and the global economy running relatively smoothly. However, the […] The post Apple iOS 17.4: iMessage Gets Post-Quantum Encryption in New Update first appeared on Peril Of Africa.

This is somewhat scary a technique. Probably negates all non-Android VPNs. Since 2002. https://lnkd.in/eyEnjP-C

Looks like #Siri and #AppleIntelligence can become a biggest #security threat to #Apple #ecosystem (if not became already!)
1. Integrations require context access. Namely — private data. 
2. To serve well Siri must know what, why, and when you do. Therefore it will be a challenge to collect the context without revealing location and ask to the service layers. 
3. Analysis of messages and emails. While it is promised to process only locally — the API layer would be needed between data and Siri. Possible attacker could trick the app to give out the data to a fake Siri on request. 