Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

0
votes
1answer
34 views

How much security would I lose if I enabled “easy enter” pins on an android device?

There is an option on android devices to unlock when the correct pin/password is entered, but without the user explicitly pressing the "done" or "enter" button. How much security does this remove from ...
1
vote
1answer
34 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
2
votes
2answers
57 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
2
votes
1answer
73 views

Offline phone security

How secure is an offline android phone? Some background. I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone. Cold ...
3
votes
1answer
64 views

How does Android's security model differ from UNIX's?

In UNIX's security model, you log in as a user, and then every process you start can access everything that belongs to your user account - that is, the trust is based on the user account, not on the ...
-1
votes
0answers
36 views

secure communications on mobile platforms [migrated]

What means are there to securely message your friends on mobile devices? Specifically if you and your friends use different operating systems like android and iOS. Are there ways to have group ...
1
vote
1answer
66 views

encryption of Google's android apps

Does Google use encryption on it's Android apps like Gmail, drive, Google Play, docs, others in authentication and transit? What the type of encryption is it? Is it secure? I have tried searching ...
1
vote
1answer
84 views

What are methods to protecting an android phone from law enforcement

From what I hear, android uses the standard linux dm-crypt for encryption. Obviously you should have: A pin/password for your phone That pin/password should at least be 8 characters The question ...
1
vote
2answers
174 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
1answer
42 views

Rooted android cached password

Assume you could exploit a vulnerability on an old Android 2.2, the questions are: 1- Is there anyway you could see stored passwords on that operating system, specially Facebook password. 2- Can you ...
6
votes
1answer
716 views

Competitor app blocks our app, need a way to bypass their check [closed]

We have a taxi app which has been quite successful in Europe. But recently one of our competitors has started checking if our app is installed and if it is, theirs won't run until the user uninstalls ...
2
votes
2answers
76 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
0
votes
2answers
154 views

Fake phone call

I have a problem, getting call from known numbers and when he lifts it, no one is speaking from other side! Well, the awkward part is, the call is from known numbers only, but if I ask the person ...
-4
votes
2answers
96 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
0
votes
1answer
39 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
1
vote
2answers
99 views

Unexpected emails have been sent - do I need to wipe my Android?

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large. I opened my Gmail App and found 5 messages in the Sent Mail folder ...
1
vote
0answers
21 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
7
votes
1answer
2k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
11
votes
3answers
6k views

Shellshock Bash bug on mobile systems

Does the bug in Bash affect Android or iOS mobile systems?
0
votes
1answer
269 views

Is it possible to hack an Android App or an Android device without being root? [closed]

Simple question, as the title said. I wondering if in an ideal world where rooting Android devices is not feasible mobile pen testing would be still possible or not. Most of the sensitive folders ...
6
votes
3answers
2k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
11
votes
2answers
483 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
1
vote
1answer
334 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
2
votes
3answers
125 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
0
votes
1answer
87 views

Virus (or Trojan) in Android

Definition of virus is (from Wikipedia): A computer virus is a malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data ...
0
votes
1answer
82 views

Secure communication End-to-end with android and Server

I´m building a enterprise application and I need to create a secure communication between android and a server. What is the most secure way to do End-to-End communication? Should I use HTTPS or VPN? ...
0
votes
3answers
86 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
0
votes
1answer
89 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
1
vote
1answer
538 views

Can virus save to SIM Card?

(Before everything excuse me because of me English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that ...
2
votes
5answers
471 views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
3
votes
2answers
629 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
6
votes
4answers
1k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
1
vote
1answer
56 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
1
vote
1answer
45 views

Charge only in Android

In older versions of Android, when connected via USB the default behaviour was "Charge Only". This allowed the device to charge via USB without exposing its file system to the device providing power, ...
0
votes
1answer
134 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
-1
votes
2answers
166 views

Why no one makes a message application like whatsapp using RSA keys?

I'm really new and I may sound like a noob so please forgive me. Since gnupg is avaible for android, why does no one makes an app that encrypts every message using a rsa key and just swap the keys ...
5
votes
1answer
66 views

To what extent can Google access data in the standard Android storage locations without restriction?

Android docs lists a number of places to store data here. To what extent can Google access data in these places assuming the developer does not want them to have it? In other words, if I save a ...
1
vote
0answers
67 views

Does BlueBox “Fake ID” vulnerability break protectionLevel: “Signature”?

Referring to this vuln: http://bluebox.com/technical/android-fake-id-vulnerability/ and this permission: http://developer.android.com/guide/topics/manifest/permission-element.html "signature" ...
6
votes
2answers
814 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
0
votes
1answer
59 views

What is the strategy used by the itunes store and Google Play to protect and securely install applications on eligible devices?

The requirements for a system like itunes store or google play are as follows; identify and authenticate the user determine if the user has paid for a given app if s/he has, securely transmit the ...
3
votes
1answer
93 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
3
votes
3answers
242 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
0
votes
1answer
1k views

Memory dumping Android

I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or ...
2
votes
3answers
1k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
0
votes
0answers
73 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
5
votes
1answer
4k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
0
votes
1answer
89 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
-2
votes
1answer
56 views

Does using a non Nexus/Google Play Editon Android device have a higher security risk? [closed]

The fact that carriers deploy the latest security updates to Android devices much later than Google does to Google Play Edition and Nexus devices, should we avoid using those devices altogether?
1
vote
1answer
108 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...