Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

1
vote
0answers
23 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
0
votes
1answer
441 views

Is it possible to hack an Android App or an Android device without being root? [closed]

Simple question, as the title said. I wondering if in an ideal world where rooting Android devices is not feasible mobile pen testing would be still possible or not. Most of the sensitive folders ...
3
votes
2answers
734 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
10
votes
2answers
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
9
votes
4answers
9k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
21
votes
2answers
1k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
2
votes
3answers
132 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
8
votes
2answers
2k views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
1
vote
1answer
56 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
1
vote
1answer
45 views

Charge only in Android

In older versions of Android, when connected via USB the default behaviour was "Charge Only". This allowed the device to charge via USB without exposing its file system to the device providing power, ...
5
votes
1answer
3k views

Android / CyanogenMod encryption vs GNU/Linux

Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt. Here is what I understand: Encrypted LVM on GNU/Linux is an ...
0
votes
1answer
98 views

Secure communication End-to-end with android and Server

I´m building a enterprise application and I need to create a secure communication between android and a server. What is the most secure way to do End-to-End communication? Should I use HTTPS or VPN? ...
0
votes
3answers
88 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
0
votes
1answer
94 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
6
votes
4answers
2k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
2
votes
5answers
738 views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
1
vote
1answer
757 views

Can virus save to SIM Card?

(Before everything excuse me because of me English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that ...
0
votes
1answer
154 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
5
votes
1answer
66 views

To what extent can Google access data in the standard Android storage locations without restriction?

Android docs lists a number of places to store data here. To what extent can Google access data in these places assuming the developer does not want them to have it? In other words, if I save a ...
-1
votes
2answers
176 views

Why no one makes a message application like whatsapp using RSA keys?

I'm really new and I may sound like a noob so please forgive me. Since gnupg is avaible for android, why does no one makes an app that encrypts every message using a rsa key and just swap the keys ...
1
vote
0answers
71 views

Does BlueBox “Fake ID” vulnerability break protectionLevel: “Signature”?

Referring to this vuln: http://bluebox.com/technical/android-fake-id-vulnerability/ and this permission: http://developer.android.com/guide/topics/manifest/permission-element.html "signature" ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
7
votes
2answers
435 views

Is there a way to notify me when my Android phone connects to an unencrypted GSM network?

As far as I know when a phone connects to a GSM (2G or 3G) network, the connection is encrypted. When I get in range of let's say an IMSI Catcher, I imagine this connection will not be encrypted in ...
0
votes
2answers
355 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
5
votes
2answers
413 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
0
votes
1answer
61 views

What is the strategy used by the itunes store and Google Play to protect and securely install applications on eligible devices?

The requirements for a system like itunes store or google play are as follows; identify and authenticate the user determine if the user has paid for a given app if s/he has, securely transmit the ...
3
votes
3answers
273 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
0
votes
3answers
3k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
1
vote
2answers
296 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
2
votes
3answers
2k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
3
votes
1answer
172 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
0
votes
1answer
1k views

Memory dumping Android

I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or ...
0
votes
0answers
82 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
2
votes
3answers
16k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
5
votes
1answer
4k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
0
votes
1answer
92 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
-2
votes
1answer
57 views

Does using a non Nexus/Google Play Editon Android device have a higher security risk? [closed]

The fact that carriers deploy the latest security updates to Android devices much later than Google does to Google Play Edition and Nexus devices, should we avoid using those devices altogether?
1
vote
1answer
109 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...
1
vote
1answer
79 views

Where do I get “Mercury” by MWR InfoSecurity? [closed]

Mercury is a really great tool for android pen-testing as well as android forensics. However, they stopped its development and now I get redirected to some product called drozer. Does anyone know ...
0
votes
2answers
370 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
2
votes
4answers
356 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
4
votes
3answers
141 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
0
votes
2answers
694 views

“A third party is capable of monitoring your network activity” with client certificates?

I installed the CAcert root certificates on my Android device (not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" warning. But ...
0
votes
0answers
396 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
13
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
1
vote
0answers
87 views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps? [closed]

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
1
vote
1answer
133 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
0
votes
1answer
118 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...