Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
iOS 8 Vs. Android: How Secure Is Your Data?
Newest First  |  Oldest First  |  Threaded View
SDiver
SDiver,
 User Rank: Strategist
11/13/2014 | 9:31:01 AM
Secure Element vs. HCE
Unfortunately, I think this article misses the heart of the differences between iOS and Android.  Apple utilizes a Secure Elemenent (SE) which is a hardware device that stores cardholder data crytpgographically while Wallet uses a software emulation of the SE called the Host Card Emulator (HCE).  The core difference is that the SE is a crytpographic hardware "black box" while the HCE is a software emulation of the HCE.


Software is traditionally one of the weakest points of security of any enterprise system so Google has their work cut out for them.  There have been compromises of Wallet in the past.  This article fails to compare the security between both solutions.
Helpful
Helpful,
 User Rank: Apprentice
11/6/2014 | 12:32:33 PM
Misunderstood security of App Groups
An App Group is an Xcode mechanism of specifying that an App and it's Extension can access a shared data container. As shown in the diagram, the Extension must be enclosed within the App. The Extension's data container and the App's data container remain distinct and separate. An app by the same Company / Developer cannot access any of their other app containers. Apple does not break the fundamental rule of sandboxing -- not even for a Developer's set of apps. See Figure 4-1 on Apple's documentation, it illustrates the very secure sand boxing of App Extensions and the true usage of App Groups: https://developer.apple.com/library/ios/documentation/General/Conceptual/ExtensibilityPG/ExtensionScenarios.html
Helpful
Helpful,
 User Rank: Apprentice
11/6/2014 | 12:25:25 PM
Mis-understood usage of Extensions
An App Extension is another word for "widget", a user-facing capability. The Extension is small set of information that the App Developer has decided to display within the Notification Center. Apple keeps the Developer within his app, there is no data spill into other apps nor from other apps.
Marilyn Cohodas
Marilyn Cohodas,
 User Rank: Strategist
11/5/2014 | 4:07:53 PM
iOS 8 Vs Android
This is indeed an interested development , Adam. Thanks for sharing your insights. On the Android side of the equation, I'm curious to know what enterprise security features Android has added to its operating systems that's making it a tougher competitor to iOS 8.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Black Hat USA 2022 Attendee Report
Black Hat attendees are not sleeping well. Between concerns about attacks against cloud services, ransomware, and the growing risks to the global supply chain, these security pros have a lot to be worried about. Read our 2022 report to hear what they're concerned about now.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-38129
PUBLISHED: 2022-08-10
A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.
CVE-2022-38130
PUBLISHED: 2022-08-10
The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<at...
CVE-2022-37024
PUBLISHED: 2022-08-10
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
CVE-2022-37003
PUBLISHED: 2022-08-10
The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized access to files.
CVE-2022-37004
PUBLISHED: 2022-08-10
The Settings application has a vulnerability of bypassing the out-of-box experience (OOBE). Successful exploitation of this vulnerability may affect the availability.