2
votes
1answer
119 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
0
votes
0answers
20 views

What SSL/TLS ciphers do each version of Android support? [duplicate]

What ciphers do each Android device support? Update: More specific not SSL or TLS versions but the actual ciphers such as ECDHE-ECDSA-AES128-GCM-SHA256, etc. Android 2.3? Android 3.x? Android ...
0
votes
2answers
120 views

Can a rogue app hijack an ssl session of another app on the same phone?

We've been discussing a possible attack vector where a rogue app with root rights could hijack the legit ssl session of anther local app and transmit its own data over it without the server being able ...
0
votes
1answer
77 views

why credentials are not shown in mitmproxy?

my question is that why I can not see some credentials in mitmproxy while the application connecting to, uses ssl connection? I actually installed the mitmproxy server on my PC and have set up my ...
3
votes
1answer
68 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
0
votes
1answer
180 views

Sniff HTTP(S) from PPTP VPN server

I've setup an PPTP VPN server on my Debian 7 server. I'm using this VPN in combination with my Android phone to ensure a secure connection. However, i'm getting curious of what my phone is sending ...
4
votes
1answer
275 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
2
votes
3answers
334 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
4
votes
1answer
623 views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
1
vote
3answers
878 views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
3
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
6
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
9
votes
3answers
3k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
3
votes
3answers
165 views

Best approach for making an app that connects to sensitive information

I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...