Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

2
votes
0answers
9 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
1
vote
3answers
111 views

Why not fix Android root exploit? [on hold]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
2
votes
0answers
35 views

Decrypting Bluetooth application data with the link key

I would like to read the application data exchanged between an Android device and a peripheral. I have managed to log the Bluetooth communication using HCI logger and open the corresponding .cap file ...
0
votes
1answer
13 views

Security risks for a simple network configuration screen in android [on hold]

I am building an Android App that pulls chart information from a server where the connection is specified on this view Ideally, the end user will put in a valid host and port resulting in business ...
-1
votes
0answers
31 views

How to penetrate into android phone which is on the same wifi network? Kali linux has one option for this is this true? [closed]

Through wifi router we can see all devices attached with that wifi including ip address if we know that ip address then how can we access that android phone remotely.
2
votes
1answer
39 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
1
vote
0answers
25 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
1answer
25 views

Looking for a Meterpreter binary for android

I tried meterpreter for android. The apk that is generated by metasploit by giving remote host ip & port and then run on target phone. I found it as a handy tool to access my phone remotely. I ...
0
votes
1answer
31 views

How to check if Android application is vulnerable to heartbleed

I Am trying to find if an android application is vulnerable to heartbleed vulnerability. I want to know how to check if the application is vulnerable to heartbleed by reversing the app file.
0
votes
1answer
56 views

Are deleted SMS still retrievable from Android-based phones? [closed]

I'm wondering whether deleted SMS on Android phones are retrievable? If so, how is this done? How can one avoid it?
-3
votes
1answer
19 views

JDK and security for a Windows machine [closed]

I'm hoping to learn to develop Android apps, but for the tutorial I'm learning I need Android Studio. Is installing the JDK a bad move from a security stance on a Windows 8 machine? Edit- The ...
1
vote
0answers
20 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
4
votes
0answers
63 views

Android wear, Tizen Encryption [closed]

Does Android Wear or Tizen for wearables offer hardware encryption? I have the Samsung Galaxy Gear S and I don't see an option, but was curious if it does it without any user intervention. I don't ...
0
votes
1answer
81 views

DDoS attacks targeting Android

I am currently studying some Android topics and I've been having difficulties finding answers regarding DDoS attacks. My question is: Are Android devices vulnerable to DDoS attacks or does Android ...
4
votes
1answer
41 views

Practical implications of 2014's android SOP vulnerability

For a project at university I have done research about all kinds of security issues, especially privacy-related ones, that have come up on mobile OS and applications over the last few years. One of ...
3
votes
2answers
84 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
2
votes
0answers
52 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
0
votes
0answers
17 views

How to know which file is being sent in POST request by Android device?

I am using an Android Device. I make apps and generally use Burp Proxy to try to debug how my app's requests-response works. Recently I have noticed some anonymous request being sent by my device ...
1
vote
3answers
47 views

Does sending image files in http in a secure application pose any risk? [duplicate]

I came across this scenario recently, where a mobile application used for banking is sending HTTP requests for GIF images and HTTPS requests for all other transactions. But the requests to the GIF ...
2
votes
2answers
66 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
0
votes
0answers
39 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
1
vote
1answer
61 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
-2
votes
1answer
109 views

Does My Neighbor Sniff My Mobile Data Through Wifi

i am using an Android phone which is connected to my home Wifi Device(Tp Link) DSL Connection. Can my neighbour hack my mobile and monitor my mobile traffic through software like WireShark, etc.?
0
votes
0answers
21 views

Root android apps to Tor [migrated]

I have an android and I can only use Tor through orbot to browse the Internet. Is there a way I can run all of my apps through Tor so that every app I use on my phone will be secured and untraceable?
0
votes
1answer
38 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
1answer
90 views

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your ...
-1
votes
3answers
72 views

How can I avoid buffer overflows when programming an Android app? [closed]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
1
vote
1answer
65 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
0
votes
1answer
68 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-1
votes
1answer
104 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
-1
votes
1answer
152 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
2answers
137 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
1
vote
1answer
83 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...
5
votes
2answers
353 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
2
votes
0answers
81 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
0
votes
2answers
53 views

Different between Art And Dalvik Security on android?

What is the different between ART And Dalvik security, cause Google using Art after Kitkat (4.4.2) ? just for these two Options? Refrence Ahead-of-Time (AOT) compilation, which improves speed ...
-1
votes
1answer
72 views

how to detect the URL an android app uses [duplicate]

i want to know how to detect the URL an android app uses. Is there any way or can we create any other android app to find the URL my app is using.
0
votes
1answer
68 views

If hackers know my android app license key , can they redirect the in app purchases of my app to their account?

I have published an android app with in app purchase. I failed to encrypt XOR my licence key. If hackers have my license key can they redirect my payments to their account or just they can by pass in ...
1
vote
1answer
79 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
2
votes
2answers
121 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
1
vote
1answer
84 views

Android email encryption [closed]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
2
votes
3answers
83 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
4
votes
2answers
102 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...
2
votes
0answers
241 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
3
votes
4answers
124 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
2
votes
0answers
48 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
10
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
6
votes
2answers
174 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
-1
votes
2answers
70 views

Why is my Wi-Fi constantly in use? [closed]

I have a nexus phone running android lollipop. Even if I'm not browsing the web or using the WiFi at all (and after sync of various components has completed) the WiFi up/down arrows still flash ...
4
votes
2answers
88 views

How much can I trust the “factory restore/reset” on a(n) (potentially compromised) android?

This question is a simple one: how much can you trust the "factory restore/reset" option on an android device? If the device has possibly been compromised, is it possible the "factory reset" will ...