Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

1
vote
1answer
32 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
0
votes
1answer
22 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [on hold]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
1
vote
1answer
23 views

Android Permissions and Explanations

I am doing some research on Android permissions and whether or not they could abuse data privacy. Does anyone have a good source on all updated Android permissions with a short explanation on what ...
0
votes
1answer
46 views

Are there additional security risks posed by rooting an Android device?

Once an Android device has been successfully rooted, are there any additional security risks created (besides telling SuperUser to trust a rogue root app)? For example, on a rooted Android device, ...
2
votes
1answer
22 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
1
vote
0answers
36 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
3
votes
1answer
57 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
1
vote
0answers
47 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted ...
1
vote
0answers
63 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
7
votes
2answers
76 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
0
votes
1answer
57 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
0
votes
1answer
38 views

Intercept Android's http/https traffic with shell access [closed]

Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept ...
1
vote
0answers
25 views

How can I view the Chrome padlock SSL certificate information in Chrome Mobile on Android? [migrated]

When I'm on my Desktop Chrome, I can click on the padlock icon in the address bar and see the information about my SSL connection, like the TLS version, the certificate strength, the authority that ...
39
votes
4answers
3k views

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...
1
vote
1answer
39 views

Downloading and updating the software via Playstore

I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question ...
0
votes
0answers
35 views

What can Android Antivirus apps really do? [duplicate]

I am studiying about android development and given the permission restriction between apps and isolation that the operating system itself imposes, I was wondering what can an antivirus app distributed ...
4
votes
1answer
61 views

Android app using FTP

I have done some android programming (self taught). I have started working on an app idea. The idea is pretty much that people with the app installed can post pictures/videos and text which can be ...
1
vote
0answers
41 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
2
votes
2answers
53 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
3answers
112 views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
2
votes
1answer
176 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
0
votes
0answers
158 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
1answer
45 views

Simple way to secure a webservice used by mobile clients

I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information ...
0
votes
1answer
55 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
1
vote
1answer
75 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
2
votes
1answer
84 views

How can I intercept XMPP traffic on Android?

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using ...
2
votes
0answers
31 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
-1
votes
1answer
114 views

Android phone (Kitkat) list A LOTS of CA under setting->security->Trusted credential,

My Android phone (Kitkat) list a LOTS of CA under setting->security->Trusted credential, does it mean that anyone who has accessed to anyone of those private keys of those CA(s) can monitor or do "Man ...
-1
votes
1answer
187 views

Use openssl key to decrypt file in android/java [closed]

I want to decrypt file encrypted in openssl in java. File is encrypted with private key using openssl and on java side i want to decrypt it using public key. The code: public void testRSA() throws ...
-1
votes
1answer
79 views

How to make a android phone anonymous off contract [closed]

How can I make my 2 year old phone not appear to be the same phone? I would like to make it into a WiFi browsing phone that cannot connect to the phone it used to be by it online footprint. Is ...
0
votes
2answers
150 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
2
votes
1answer
193 views

Arduino to Android secure bluetooth connection

I'm using an Arduino Uno and a nRF8001 board from Adafruit to connect to an Android phone over bluetooth. I will be using it to lock and unlock a lock and I need to make sure only verified devices are ...
2
votes
4answers
293 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
0
votes
2answers
96 views

how to encrypt a sensitive model on android and ios

I am writing a mobile app which uses a statistical model contained in binary files. I want to be able to distribute the app freely, but I don't want anyone to be able to use my model files, even on a ...
1
vote
0answers
75 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
0
votes
0answers
147 views

sending data from android client to database

I have created an android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID) the problem is I that i send the data from ...
0
votes
2answers
297 views

How to call webservice securely in Android

Hello I am working on an Android application in which I'm required to execute a few https web service calls. All my web-service URLs and Web API KEYs are in the code plus the IP address of the server. ...
0
votes
0answers
49 views

Silent security on android

I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background. I was wondering if is it possible to achieve tha same results on an ...
0
votes
2answers
130 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
0
votes
1answer
133 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
1
vote
0answers
239 views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
1
vote
2answers
254 views

How android WebView can be exploited and how to secure my app from WebView vulnerability?

I heard that WebView vulnerability is active in android versions before 4.2. I read that it is fixed by google in their newer updates from 4.2. What I want to know is a brief description of the ...
3
votes
2answers
227 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
0
votes
2answers
116 views

What are the possible exploits over a debuggable APK?

I have heard that an Android APK can be debugged if android:debuggable="true" is set. What are the possible threats in allowing an app to be debugged?
0
votes
1answer
60 views

LastPass Bootstrap on New Android Phone [closed]

I've been using LastPass to manage all my passwords, including the password for Google account. The thing is, on a new Android Phone, in order to sign in (for Gmail, Play store, etc), I need the ...
1
vote
1answer
168 views

Android encryption when phone is on

So I have android lollipop installed, which should be encrypted automatically with some startup password. My question is, what happens if the phone get stolen while its on, and the screen is locked? ...
1
vote
1answer
112 views

Secure voice app [closed]

When I look in the Google play store (android apps market), I see that there are a lot of apps to make secure phone calls. However, all the apps I have seen so far all seem to use data packets over ...
0
votes
1answer
63 views

How much security would I lose if I enabled “easy enter” pins on an android device?

There is an option on android devices to unlock when the correct pin/password is entered, but without the user explicitly pressing the "done" or "enter" button. How much security does this remove from ...
3
votes
3answers
1k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
2
votes
2answers
100 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...