Compass Security Blog

Offensive Defense

Category: Mobile

Hello Roger! A new way to spoof a caller id

Did Roger Federer call us for some IT-security advice or did Nicolas Heiniger and I find a new way to spoof a caller id? The Human Factor is, and remains, the biggest and most relevant threat to the security of every company. The latest statistics state that “only about 3% of the malware they run […]

Continue reading

Android 7.0 Security Features: Direct Boot

Android 7.0 (Nougat) brings a lot of new interesting security features such as: Direct Boot Key Attestation Network Security Configuration Scoped Directory Access Media Server Hardening All of these topics are very interesting from a security perspective. However, in this blog post we will solely focus on Direct Boot. Motivation There are apps, which should […]

Continue reading

Windows Phone – Security State of the Art?

Compass Security recently presented its Windows Phone and Windows 10 Mobile research at the April 2016 Security Interest Group Switzerland (SIGS) event in Zurich. The short presentation highlights the attempts made by our Security Analysts to bypass the security controls provided by the platform and further explains why bypassing them is not a trivial undertaking. Windows 10 Mobile, which […]

Continue reading

IP-Box – Why a 4 digit passcode is still a bad idea

Up to the iPhone 4, 4 digit passcodes could be brute-forced within a short amount of time – maximum 30 minutes, depending on the passcode. With the iPhone 4s, the Boot ROM vulnerability required to upload a custom RAM disk has been closed thus rendering newer phones immune to this attack. This is where the IP-Box […]

Continue reading

Presentation about Windows Phone 8.1

Earlier this month, my colleague Cyrill Bannwart and I held two Compass Security Beer Talk presentations in Bern and Jona about Windows Phone 8.1 security. The slides are now online and cover: Our (unsuccessful) black box attempts to break out from a Windows perspective A review of the implemented security features in Windows Phone 8.1 from a mobile perspective Our findings […]

Continue reading

Aktuelle Security Trainings

Web Application Security Training Die Compass Security hat im Moment im Bereich Web Security zwei Kurse ausgeschrieben. Ein Basic und ein Advanced. Unsere öffentlichen Kurse dauern jeweils 2-Tage und bestehen zur Hälfte aus praktischen Beispielen (Hands-On Lab) und zur anderen Hälfte aus Theorie. Wobei die Doing-Aufgaben in der Regel eine Schritt-für-Schritt Anleitung sind. Der Hacker-Angriff […]

Continue reading