Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

5
votes
1answer
143 views

What do malware authors using android root exploits go after?

I know there has been a lot of discussion on rooting on the internet and even on stack exchange. What I want to ask here is not how rooting works - assuming the root exploit as a black box, what ...
3
votes
1answer
33 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone ...
2
votes
1answer
35 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
3
votes
1answer
55 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
2
votes
1answer
50 views

Isolate Android system when connected to wifi

Is there any built-in feature or application that isolates the system when it's connected to a wlan, so that just a determined app has access to the net? For example, let's say that you want to ...
2
votes
1answer
48 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
2
votes
2answers
53 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
0
votes
1answer
57 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...
0
votes
3answers
96 views

Can the user of an app see what's in the https packets?

If I exchange https packets between a server and an Android client, is it easy for the user of the client to get whatever is in the encrypted traffic? Should I consider all such traffic unsafe if the ...
7
votes
3answers
7k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
5
votes
1answer
240 views

How does an android device/os prevent me from getting root?

I have never used an android phone and so hopefully this is not a bad question to ask. I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I ...
2
votes
1answer
94 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
0
votes
0answers
184 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
1
vote
3answers
108 views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...
1
vote
1answer
54 views

android apk and suid binary

Is it correct for me to assume that, there is no way to make an Android app (APK) to run in root privilege by itself (without an external "su" native executable), even when it is using NDK native ...
1
vote
0answers
75 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
0
votes
2answers
270 views

Virus (or Trojan) in Android

Definition of virus is (from Wikipedia): A computer virus is a malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data ...
3
votes
2answers
1k views

How can I prevent `am` from starting my activity?

I have an Android app and it has 3 activities; A, G and B. When the app starts users see Activity A. If user wants to navigate to activity B, app starts activity G and asks for a password. If the ...
0
votes
3answers
89 views

What footprint iOS or Android App leaves? and how to change it

I've read some place that each phone and/or sim leaves some kind of footprints when it uses a social app (Google, Instagram etc.). I would like to stay anonymous or at least blend in with the crowd. ...
8
votes
2answers
152 views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
3
votes
1answer
58 views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
3
votes
1answer
121 views

Android ransomware difficulties [closed]

My phone is a Samsung Galaxy S2. I have somehow gotten some ransomware that is displaying device information, including my name and recent contacts' data. The ransomware starts basically right away, ...
2
votes
2answers
137 views

Encryption of Google's Android apps

Does Google use network encryption on it's Android apps like Gmail, Drive, Google Play, Docs, and others when doing authentication/data transfer? What type of encryption is it? Is it secure? I have ...
5
votes
2answers
128 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
1
vote
2answers
70 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
5
votes
2answers
221 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
3
votes
3answers
624 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
0
votes
3answers
133 views

If I connect to a website using a cellular network, and change the sim card and connect again with the same phone, will they find its the same phone?

I read on a blog that when you connect to a website with your phone they track the model number id of the device, or something like it. I don't remember what its called. Even if you change your sim ...
-1
votes
1answer
125 views

WhatsApp Forensic Analysis [closed]

I was wondering if anyone is aware of any conferences that cover WhatsApp security on android or something similar. My project requires me to look for three conference papers and justify why they are ...
1
vote
4answers
442 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era [closed]

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
4
votes
4answers
806 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
2
votes
1answer
51 views

Unknown sources, root, and the Android security conundrum [closed]

This question has 2 aspects, both are related and equally important from a security standpoint: The "Allow installations from unknown sources" option under Security settings. Most other mobile ...
2
votes
0answers
83 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
2
votes
1answer
607 views

msfvenom payload problem

This is for educational purposes only! I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command msfvenom -p android/shell/reverse_tcp ...
10
votes
2answers
566 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
2
votes
1answer
154 views

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Okay, I'll just begin with the question and then elaborate a bit below. It is: Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a ...
8
votes
4answers
5k views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
2
votes
1answer
52 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
0
votes
1answer
79 views

Certificate pinning in android apps

I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate ...
2
votes
2answers
97 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
1
vote
0answers
73 views

Home Surveillance System working with power blackouts and password-protected software for uploading pictures the cloud [closed]

I need a home surveillance system which has the following characteristics: I need to place a camera facing the entrance door of my home. I need to be able to log into the camera using a password, ...
5
votes
1answer
88 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
2
votes
1answer
102 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
4
votes
1answer
120 views

Way to keep Google from knowing the SIM card I am using on Android

We see that the the details of the Telecom operator along with other details are available to Google for the SIM card that we are using on an Android Phone. Is there any way that can be applied or ...
0
votes
2answers
17k views

Can wifi administrator see data transfer over android phone. precisely gmail app communication

sometimes I connect to wifi outside my home in office , restaurants and friends house. I want to know if wifi administrator can see the exact data my android phone communicates? I am only concerned ...
7
votes
4answers
983 views

Securely erase personal data from android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
4
votes
1answer
103 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...
1
vote
1answer
2k views

Can you generate Diffie-Hellman parameters quickly [closed]

I am working on an android project for school and I am supposed to do a DHKE(Diffie Hellman Key Exchange). Everything works well, the problem is that it takes a lot of time (really a lot) to generate ...
3
votes
3answers
90 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
2
votes
1answer
89 views

Can an Android malware install a SSL/TLS certificate into non-root devices?

Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices? I think that this is a very ...