Privacy lost...

nsaspook

Joined Aug 27, 2009
16,322
http://appleinsider.com/articles/18...romise-forensic-unlocks-for-apples-iphone-8-x
A startup called Grayshift is advertising a tool called "GrayKey," which costs $15,000 for an always-online version limited to 300 uses, Forbes said on Monday. An unlimited offline edition is priced at $30,000. Grayshift is said to be staffed by U.S. intelligence agency contractors and a former Apple security engineer.

GrayKey is marketed as being able to extract the full filesystem from a device, and brute-force passcodes, despite Apple's safeguards against that practice.
 

nsaspook

Joined Aug 27, 2009
16,322
http://www.scmp.com/news/china/society/article/2135940/chinese-toddler-disables-iphone-47-years
The incident happened in January after the phone was given to the child to watch educational videos online, the news website Kankanews.com said.

The mother returned home one day and when she checked the phone found it had been disabled for 25 million minutes by pressing keys repeatedly when the handset requested the passcode be inputted, according to the article. Each time the wrong keys were pressed the phone was disabled for a period of time, the report said.
 

Reloadron

Joined Jan 15, 2015
7,889

WBahn

Joined Mar 31, 2012
32,829
The human factor.
https://abcnews.go.com/Technology/w...rs-tested-opened-fake-phishing-email-53806850

Michigan auditors who conducted a fake "phishing" attack on 5,000 randomly selected state employees said Friday that nearly one-third opened the email, a quarter clicked on the link and almost one-fifth entered their user ID and password.
Definitely nothing new here. These kinds of tests have been done over and over and over -- including at places that do classified work -- and the results are almost always about the same. The humans are by far the weak link in most security protocols.

Several years ago as a course project several Air Force Academy cadets crafted an attack in which an e-mail was sent out to everyone in the cadet wing from a third-party domain that asked them to click a link to fix a problem or something (I forget the details) and, if they did, malware was installed that changed their wallpaper and configured their system so that they couldn't change it back without an access code (essentially it was a very benign form of randomware). A significant fraction of cadets (and more than a few faculty members) went around with their computers showing the telltale wallpaper showing that they had fallen for it despite all of the formal cybersecurity training that is required annually.

Shortly after thumb drives came out (and were outrageously expensive) they did a test at a defense contractor's site in which they went to the parking lot where their IT people parked and scattered some USB thumb drives on the ground. Within hours after people showed up for work that day they had major breaks into the networks because these IT professionals just couldn't way to try out these thumb drives that they were so lucky to come across.

At the company I used to work for I got an e-mail from a gal (Anna) at our parent company in California telling me to click a link to see the latest HR policy (or something like that). The link was to an .exe file. So I went down to our office manager's office and asked for Anna's number because I wanted to call her and tell her that I thought her computer had gotten infected because I had just received an e-mail from her with an executable file claiming to be a pdf file. While I was on the phone getting transferred to Anna several other engineers came down for exactly the same reason. As about six of us were standing there and I was talking to Anna a few feet away from our office manager, she received that same e-mail and clicked on it, infecting our network so bad that it took a couple weeks to get it cleaned up. When I asked her why the hell she clicked on it her response was simply, "Well, it was from Anna."
 

nsaspook

Joined Aug 27, 2009
16,322
Definitely nothing new here. These kinds of tests have been done over and over and over -- including at places that do classified work -- and the results are almost always about the same. The humans are by far the weak link in most security protocols.
I get sometimes irritated pages (yes, I still have a real pocket pager) about being paranoid about opening e-mails at work. I'm usually the last person to approve some change notice to a procedure if the notification is sent by e-mail.:D
 

Thread Starter

cmartinez

Joined Jan 17, 2007
8,760
I get sometimes irritated pages (yes, I still have a real pocket pager) about being paranoid about opening e-mails at work. I'm usually the last person to approve some change notice to a procedure if the notification is sent by e-mail.:D
:eek:

You mean you still own one of these, and actually use it?

images (9).jpeg
 

Thread Starter

cmartinez

Joined Jan 17, 2007
8,760
http://www.bbc.com/news/technology-43639709

Spy kits that can track mobile phones and intercept calls and messages have been discovered in Washington and beyond, the US government has said.
...
Stingrays, a brand name for a type of International Mobile Subscriber Identity catcher (IMSI), are mobile phone surveillance devices that mimic mobile phone towers.
The size of a briefcase, the devices send out signals to trick mobile phones into transmitting their location and identifying information.
As well as tracking the mobile phone of a suspect, the devices also gather information about phones of bystanders who are nearby.
It is believed to be the first time the US government has acknowledged the use of rogue spying devices in Washington.
 

WBahn

Joined Mar 31, 2012
32,829
But these things have been around for years and years. The don't have to be the size of a suitcase, either. One of the ways that people create no-cell zones, say in a theater, is they bring in a small unit in their pocket that mimics a cell tower. It doesn't have to be high power since it is much closer to the cell phones in the theater than the nearest real cell tower is (probably). It thereby tricks the cell phones into connecting to it instead of the real tower and then simply doesn't complete the calls or route calls to it. But they can also be used to sniff whatever information a legitimate tower could access or to act as a man-in-the-middle attack on conversations.
 
Top