Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.
2
votes
1answer
434 views
Android Application penetration testing
Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
1
vote
1answer
159 views
Pre boot authentication for Android phones
is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
0
votes
0answers
28 views
How secure is the default Android locking mechanism? [duplicate]
Possible Duplicate:
Is Android’s Password Screen Lock Enough Data Theft Protection?
Is there a publicly known, reasonably easy¹ way to access data stored on a locked Android tablet (not on ...
1
vote
2answers
244 views
Is it legal to store/send user's device's IMEI/MEID? [closed]
I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.
Is it legal to store/send user's ...
3
votes
1answer
74 views
Application communication monitoring
I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from.
As far I have ...
0
votes
0answers
146 views
Android plankton [closed]
Have anybody experience with analysing of android malware ?
I have tried to understand the Plankton malware. Main difference between plankton and "ordinary" malware is that the "ordinary" malware ...
0
votes
0answers
55 views
How to create an app for mobile website [closed]
Im trying to make an app that will basically be able to be downloaded directly from my mobile website. I honestly want to just make something so users can download the app to their phone and when they ...
2
votes
2answers
191 views
Studies on Android users' attitude to security
I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
0
votes
0answers
96 views
Network Discovery of Android Devices [closed]
i wanna do a network discovery of android devices over LAN or VPN. Is there any available API for that?
AFAIK this comes under MDM(Mobile Device Management). But i am not sure if any of the available ...
2
votes
3answers
517 views
Can someone detect the URL an android app uses?
I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret?
I know that the IP address and the port number of that connection can be detected, but what ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
5
votes
2answers
303 views
How can I use nmap to distinguish between a normal linux machine and an android device?
According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
1
vote
3answers
881 views
Intercept data sent via bluetooth
I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth.
The new application I ...
3
votes
2answers
396 views
List of Top security risk/attack scenarios for android application
WHat are the possible security risk/attack scenarios for android application.
This is with regards to the OWASP top 10 Mobile Security threats discussed here:
...
3
votes
3answers
526 views
Android Pen Testing
I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.
I have set up a proxy and am able to intercept the traffic, however the POST method ...
2
votes
2answers
673 views
How do I protect my Gmail account when accessing it via an Android smartphone?
I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
5
votes
1answer
170 views
Android, how to protect in case of theft
What are some steps to take into account to protect an Android phone in case of theft?
Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
10
votes
3answers
548 views
Tools to help test the security of Android applications
What are some decent frameworks to test the security of Android applications?
With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
26
votes
7answers
30k views
Are there actually any advantages to Android full-disk encryption?
So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
1
vote
1answer
374 views
Fuzzing Android API
I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
2
votes
1answer
945 views
Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]
Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
4
votes
3answers
313 views
Android phone number from disk image
I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
0
votes
1answer
104 views
How to secure unprotected Telnet Server on Droid 3
I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
4
votes
1answer
191 views
How can I do a secure reinstallation on an android device?
I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the ...
0
votes
0answers
443 views
Good Android tablet for pentesting apps? [closed]
I'm looking into buying a new Android tablet for pentesting / security auditing apps. Currently I've been using Acer A500 Iconia, but it does not have support for mobile networking which for my ...
7
votes
1answer
968 views
How should I protect in-app Android payments when using a separate server?
I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for.
I have a simple application to view server-generated content. I want to allow the user ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
3
votes
2answers
1k views
How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
The problem statement is:
To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
2
votes
2answers
1k views
How to check an Android Application for SQL Injection or XSS bugs?
I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs.
I mean if its an application, where should i write the queries. If through ...
3
votes
3answers
5k views
Is Android's Password Screen Lock Enough Data Theft Protection?
With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
1
vote
1answer
141 views
Privilege usage checks
What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android).
Android grants app privileges ...
3
votes
1answer
137 views
Recover file using Java RanNum Gen + Key
EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
15
votes
1answer
822 views
Security implications of rooting your android phone
My android smart phone has fancy features that I can get if and only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone has me ...
10
votes
4answers
2k views
What risk does Carrier IQ pose, exactly?
There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out.
My questions: What exactly does Carrier ...
6
votes
5answers
2k views
Best practice to encrypt data in an Android application
I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
13
votes
5answers
2k views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
4
votes
1answer
436 views
Android for the Paranoid
In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
8
votes
3answers
2k views
Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?
I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
4
votes
4answers
535 views
Explaining security vs. performace to a non-tech superior
I was tasked to implement some sort of password-based encoding/decoding in an android app by my non-tech SO. He also showed me this list of android security providers. Naturally, He chose the one with ...
3
votes
1answer
368 views
Sip call Developing in android with secure data transfer
I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
12
votes
5answers
1k views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
3
votes
3answers
122 views
Best approach for making an app that connects to sensitive information
I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
7
votes
2answers
1k views
3DES vs DES for VPN connections
I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption.
Is it safe to use DES, am I going to get hacked if I ...
4
votes
3answers
6k views
Which type of encryption algorithms android supports, and which would be better?
I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports.
Regarding DES and AES (As wiki documentation) ...
1
vote
1answer
441 views
Android application level encryption cracking
We come across Android applications which use the custom encryption. When we proxy the Android phone or emulator, the proxy captures traffic which is unreadable.
Is there a known technique to read ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
4
votes
1answer
940 views
How can I store downloaded video securely to device's sd card?
I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.
So for this what can I do? I think about ...
3
votes
1answer
482 views
Which encryption algo should be best for an Android application [duplicate]
Possible Duplicate:
Which type of encryption algorithms android supports, and which would be better?
I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
