Feb
11
2011

Steal iPhone passwords in six minutes

AppleLogoIf you lose your iPhone you better issue a remote wipe ASAP with “Find My iPhone” available in the Apple App Store. Researchers have shown that they can jailbreak and decrypt passwords from the iPhone’s key-chain in about six minutes. If you think you are safe because you have a lock-screen password, think again, this hack by-passes the lock screen protection.

The attack requires possession of the iPhone and targets the handsets individual keychain, the iPhone’s password storage platform. Researchers, utilising existing exploits, are simply able to jailbreak the device, install an SSH server on the device that allows them to run queries and execute third-party software on the phone.

Once access to the phone has been established, researchers were then able to copy a script to the phone that would access the keychain on the device. In-built system functions are employed to open the keychain and then output all of the users passwords, removing the need to physically crack any of the devices protection methods.

In short, if someone gets the hold of your device all you can hope is that you can issue a remote wipe command in time. Otherwise they will get your data if they are persistent enough.

Check this video out to see the hack in action.

This is a list of passwords / applications thought to be safe against this hack.

  • AOL Email
  • App using keychain with default protection
  • Generic IMAP
  • Generic SMTP server
  • Google Mail
  • iOS Backup Password
  • Website Account from Safari
  • Yahoo Email

This is list of passwords / applications that have been confirmed to be vulnerable to theft.

  • Apple Push
  • Apple-token.sync (mobile me)
  • CalDav
  • Google Mail as MS Exchange Account
  • iChat.VeniceRegistrationAgent
  • LDAP
  • Lockdown Daemon
  • MS Exchange
  • Voicemail
  • VPN IPsec Shared Secret
  • VPN PPP Password
  • VPN XAuth Password
  • Wifi (Company WPA with LEAP)
  • Wifi WPA
Feb
02
2011

Bing Responds to Cheating Claims by Google

google-vs-bingYesterday, Google shed light on a sting operation they conducted and said they had proof that Bing has been watching what people search for on Google, the sites they select from Google’s results, then uses that information to improve Bing’s own search listings.

Today Mehdi, Microsoft’s Senior VP of Online Services responded.

We do not copy results from any of our competitors. Period. Full stop. We have some of the best minds in the world at work on search quality and relevance, and for a competitor to accuse any one of these people of such activity is just insulting.

Mehdi, then took it one step further and accused Google of performing “Click Fraud”

Google engaged in a “honeypot” attack to trick Bing. In simple terms, Google’s “experiment” was rigged to manipulate Bing search results through a type of attack also known as “click fraud.” That’s right, the same type of attack employed by spammers on the web to trick consumers and produce bogus search results. What does all this cloak and dagger click fraud prove? Nothing anyone in the industry doesn’t already know. As we have said before and again in this post, we use click stream optionally provided by consumers in an anonymous fashion as one of 1,000 signals to try and determine whether a site might make sense to be in our index.

Read the full post here

Is Google just trying to redirect focus from the recent discussions surrounding Google’s SERPS being full of spammy results? Maybe, they chose to wait 30 days before going public with thier findings.

What are your thoughts? Is Bing cheating from Google?

Dec
10
2010

Experiment – How Twitter Links Effect Search Engine Ranking

Last week both Google and Microsoft confirmed that they do in fact take in to consideration social media links (links within Facebook and Twitter) in their ranking algorithms.

I thought it would be interesting to try a little albeit slightly selfish experiment to see if I can gather some data to support what both search engines have confirmed.  This is an informal experiment that will both help start to answer the questions these changes have brought and at the same time promote my wonderful wife’s website.

Below is a pre-crafted tweet with Keywords built in to the structure of the tweet, simply click the share button below to participate in the experiment.

I will be tracking the results with topsy.com and will publish a findings post once the experiment has concluded and I have had time to correlate the date.

I need your help!

If tweeting or linking is not your thing what are you doing reading an SEO blog? ;)

Full Disclosure / Disclaimer – Participating in this experiment will promote a site that is owned by my wife, I do not want to hear from people that I was performing a selfish experiment. Though I fully believe the results will be useful to all SEO’s out there.

Nov
07
2010

Hacking With Copier Machines

Think your identity is safe because you take all the necessary measures to protect yourself? Think again!!

Sep
29
2010

Google Instant Expands – Adds Keyboard Navigation

Google Instant is expanding. The company has just announced new features and wider availability of the search-as-you-type feature.

Let’s start with the latter; Google says Instant is expanding in two ways:

Google Instant On Vertical Search Properties: In addition to being available on Google.com searches, Instant Search is now functioning on “many” of the vertical search options in Google’s left navigation column, like Videos, News, and Blogs.

Google Instant In New Countries: Instant Search is now available to signed-in users in 12 new countries: Austria, Belgium, Canada, Czech Republic, Ireland, Mexico, Netherlands, Poland, Slovakia, Slovenia, Switzerland and Ukraine.

Finally, when using Google Instant, there are new keyboard navigation options. You can use the up and down arrows on your keyboard to navigate through the search suggestions (pretty sure that’s always been the case) and through the search results, too. This video shows how it works.