Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

0
votes
2answers
53 views

Different between Art And Dalvik Security on android?

What is the different between ART And Dalvik security, cause Google using Art after Kitkat (4.4.2) ? just for these two Options? Refrence Ahead-of-Time (AOT) compilation, which improves speed ...
-1
votes
1answer
75 views

how to detect the URL an android app uses [duplicate]

i want to know how to detect the URL an android app uses. Is there any way or can we create any other android app to find the URL my app is using.
5
votes
3answers
3k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
2
votes
1answer
7k views

How mobile app WiFiKill can cut off internet access to neighbor devices?

There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? ...
1
vote
1answer
79 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
2
votes
2answers
122 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
1
vote
1answer
85 views

Android email encryption [closed]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
1
vote
1answer
495 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
4
votes
2answers
102 views

Should other processes be running while an iPhone or Android is generating a cryptographically random number?

I need to generate a cryptographically secure random number on iOS and Android. I could use a software approach or leverage the built in OS API for this. In each case, is it better to generate a ...
2
votes
3answers
85 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
11
votes
3answers
11k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
6
votes
7answers
5k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
2
votes
0answers
48 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
10
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
-1
votes
2answers
70 views

Why is my Wi-Fi constantly in use? [closed]

I have a nexus phone running android lollipop. Even if I'm not browsing the web or using the WiFi at all (and after sync of various components has completed) the WiFi up/down arrows still flash ...
0
votes
1answer
80 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [closed]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
0
votes
3answers
1k views

Is it possible to install spyware in password protected android phone?

I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
1
vote
1answer
35 views

Android Permissions and Explanations

I am doing some research on Android permissions and whether or not they could abuse data privacy. Does anyone have a good source on all updated Android permissions with a short explanation on what ...
0
votes
1answer
88 views

Are there additional security risks posed by rooting an Android device?

Once an Android device has been successfully rooted, are there any additional security risks created (besides telling SuperUser to trust a rogue root app)? For example, on a rooted Android device, ...
2
votes
1answer
49 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
1
vote
0answers
117 views

How secure is Jitsi VoIP/IM Android app? [closed]

I was looking for a FOSS end-to-end encrypted alternatives to Skype and came over Jitsi. It looks all nice and seems to work really well (at least clients on Linux and Android). Even cross-messaging ...
1
vote
2answers
579 views

How android WebView can be exploited and how to secure my app from WebView vulnerability?

I heard that WebView vulnerability is active in android versions before 4.2. I read that it is fixed by google in their newer updates from 4.2. What I want to know is a brief description of the ...
3
votes
1answer
85 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
1
vote
0answers
106 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
7
votes
2answers
124 views

Does Android have sufficient app sandboxing?

In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions. Now I would like to ask a related, but different question: Is ...
1
vote
0answers
129 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted ...
2
votes
4answers
602 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
0
votes
1answer
91 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
2
votes
2answers
89 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
0
votes
1answer
59 views

Intercept Android's http/https traffic with shell access [closed]

Assuming you have a shell access on a rooted Android device. Let's say the shell was given upon an exploitation, eg. Android Webview vulnerability. The question is what is the best way to intercept ...
4
votes
2answers
305 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
39
votes
4answers
4k views

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...
1
vote
1answer
58 views

Downloading and updating the software via Playstore

I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question ...
0
votes
0answers
37 views

What can Android Antivirus apps really do? [duplicate]

I am studiying about android development and given the permission restriction between apps and isolation that the operating system itself imposes, I was wondering what can an antivirus app distributed ...
4
votes
1answer
80 views

Android app using FTP

I have done some android programming (self taught). I have started working on an app idea. The idea is pretty much that people with the app installed can post pictures/videos and text which can be ...
2
votes
1answer
2k views

Is it possible to store an android apk in SIM card and install it from there?

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following. ...
1
vote
0answers
52 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
3
votes
3answers
999 views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
2
votes
1answer
549 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
0
votes
0answers
392 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
1answer
95 views

Simple way to secure a webservice used by mobile clients

I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information ...
2
votes
1answer
141 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
6
votes
3answers
3k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
0
votes
1answer
76 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
1
vote
1answer
102 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
14
votes
3answers
7k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
3
votes
1answer
194 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
4
votes
2answers
2k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
1
vote
3answers
8k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...