Comments for Intrepidus Group - Insight

Comment on Java Reflection in Android…FTW by Zach

Zach — Sat, 14 Apr 2012 16:06:39 +0000

Nice post, Corey. I’d also like to point out a rather good research paper about some automation around reflection (for purposes of enumerating Android permissions and associated checks) over at http://www.cs.berkeley.edu/~afelt/android_permissions.pdf

Comment on Busybox Command Injection by ssybesma

ssybesma — Wed, 11 Apr 2012 19:21:43 +0000

I have an A/V receiver that is network-connected and it does use Busybox (I know this because the documentation that came with the receiver mentions it specifically).

Only thing is that I cannot ping from that A/V receiver, but I can ping _to_ it from my Windows XP computer.

I have heard of using Ping injection from within the device if it has the ability to use ping, but the A/V receiver may not have that (if it does, it’s hidden).

I’m forced to ping from another machine.

Is there a way I can send the following command line from a Windows machine to enable Telnet on my A/V receiver, as it’s obviously disabled:

; /usr/sbin/iptables -A INPUT -p tcp –dport 23 -j ACCEPT ;

I think the command line might be pretty standard for any box that uses Busybox.

The (local) IP address of my A/V receiver is hard set to: 192.168.0.7

I was trying to use the following command line, but I really don’t know what I’m doing and it didn’t work:

ping 192.168.0.7 ; /usr/sbin/iptables -A INPUT -p tcp –dport 23 -j ACCEPT ;

Comment on Android MDM. Part I: Build Up by Steve

Steve — Thu, 05 Apr 2012 20:05:36 +0000

I don’t understand why Google has only gone so far as to enable MDM providers to build their own “policy equivalent” to an iOS Exchange Activesync payload (configuration profile), and leave it up to the MDM providers to deliver this functionality. I think Google should step it up if they want to see BYOD Android more broadly accepted in enterprises. By the way there is another cloud-based MDM solution out there – http://www.trellia.com

Comment on Mallory: Transparent TCP and UDP Proxy by Le gang stalking c’est ça ……..et toujours pas de mots latins…..technique applicable dans l’étendue du spectre electromagnétique « Gang Stalking Network Belgique

Thu, 01 Mar 2012 03:13:14 +0000

[...] Mallory - A transparent TCP and UDP MiTMing proxy. Extensible to MiTM SSL, SSH, and many other protocols. [...]

Comment on Changes to Apple MDM for iOS 5.x by dschuetz

dschuetz — Wed, 29 Feb 2012 16:14:02 +0000

Ah! good catch. I thought developer push certs could use either server, but that they should use the sandbox when testing. Or perhaps that’s just how you created the certificate in the first place. I’ll try to make a note of that, it might trip up someone else too.

Comment on iOS MDM: Preventing Disassociation DOS and Potemkin Devices by Alexander

Alexander — Wed, 29 Feb 2012 06:02:02 +0000

Interesting what command Apple use in Find my iPhone… maybe mitmproxy can help

Comment on Changes to Apple MDM for iOS 5.x by Van

Van — Tue, 28 Feb 2012 16:28:18 +0000

I found why device don’t receive notification from server. I testing with developer provisioning profile, so must use gateway.sandbox.push.apple.com as notification server. But server was configured to use gateway.push.apple.com. To use sandbox I’m changed APNSNotificationWrapper param: “wrapper = APNSNotificationWrapper(‘PushCert.pem’, True)” It was False.

Comment on Changes to Apple MDM for iOS 5.x by Van

Van — Tue, 28 Feb 2012 15:17:53 +0000

Hello.
I have use your advice about manual MDM-formatted push message and it work. If I send push notification ["aps":{"alert":"My first push notification!","sound":"default"},"mdm":"A0433A31-2B0B-41FD-B79B-002F8C1A28D7"] when device connect to server and perform action (lock at least, don’t test another yet). So problem is with MDM-push-notification part of server.
I have send request to join enterprise program but doubt I’m already accepted. So this mean even with developer profile you are able to implement MDM .
I will try to investigate why server from post doesn’t work fine. If server’s code have some error and I’ll find it – I’ll post here.
Thanks for help.

Comment on iOS MDM: Preventing Disassociation DOS and Potemkin Devices by david_schuetz

david_schuetz — Mon, 27 Feb 2012 17:04:38 +0000

That’s correct — MDM can install an application (which still needs the user’s approval), but it cannot force the app to actually launch. Even the push notification system won’t cause the app to launch (but the app will get the notification directly if it’s in the foreground when the push message arrives).

I was kind of surprised that coordinates weren’t returned in the generic DeviceInfo command, or that there wasn’t a specific GPS command. It may be that there is some method, and that I simply haven’t found it yet, but I believe that 3rd party vendors also require the use of the external application to collect geolocation information.

Comment on iOS MDM: Preventing Disassociation DOS and Potemkin Devices by Alexander

Alexander — Mon, 27 Feb 2012 16:05:46 +0000

Thank you for response!
With third party app installed, from mdm I cant launch this app on user device? and if user disables location service or close app I couldnt trace it? Too bad there is no way in mdm to get just gps coordinates…