Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

0
votes
0answers
19 views

Selling Android phone [duplicate]

I am selling my phone with Android and I am looking for a way how to ERASE everything without a chance for recovery (without hammering :D). I came across several articles that states we should encrypt ...
7
votes
1answer
111 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
-2
votes
1answer
65 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
1
vote
2answers
88 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
3
votes
1answer
60 views

Can the Android Snapdragon Vulnerabilities be used to root a phone permanently?

Would it be possible to use the discovered vulnerabilities (CVE-2016-0819 and CVE-2016-0805) to root a phone permanently without any dataloss and install applications like SuperSU?
4
votes
0answers
74 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
0
votes
1answer
31 views

Is it safe to use an Android Server Monitoring App, to login to a server with SSH?

Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are: Is it safe to give access to an ...
3
votes
1answer
117 views

Strange SMS received on Android phone. Is this an exploit? Should I be concerned?

I am using an Android phone. I received an SMS from an unknown number today which had the following content: #Gege%wghatdanaipop%^ *%95bornioke:&67; ///Hackmaster&67;-&67" ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
4
votes
2answers
86 views

Disabling android application debug mode as a security practice

There's a security practice which says you should not publish your android application with debug mode enabled. While an attacker can use apktool to decompile your application, enable the debug flag ...
1
vote
2answers
105 views

Does Java/Dalvik's Java Native Interface JNI make Android prone to better attacks?

Java has a feature named Java Native Interface (JNI), which allows to call native machine code function from inside the Java's bytecode. This feature allows effectively running machine native code ...
0
votes
0answers
32 views

Can I secure android device(root is an option) running Lollipop from public security holes like Stagefrigh?

I checked the device with VTS for Android and it got some publicly known security holes. Marshmallow is not an option. So is there any way to secure a device running Lollipop from Stagefright etc by ...
4
votes
1answer
77 views

Android auto complete and passwords

I have an Android phone and when I enter a password in a password field (bank application or other), the auto complete system proposes to complete the password. I expected password not to be saved by ...
1
vote
2answers
69 views

How to protect my email and social media accounts?

Someone been hacking my account. It seems the person is expert hacker. I have had changed my password multiple times. They seems to know personal details of my life and things on my gmail and facebook ...
0
votes
0answers
98 views

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the ...
1
vote
2answers
145 views

Money stolen via Android malware Port 4000 remote anything exploit

As background, my business bank account was compromised. The compromise also involved call forwarding of a smartphone. So they got bank credentials and cell phone credentials. I initially suspected ...
3
votes
1answer
55 views

Information Security on a lost android phone

Recently, my android mobile phone was lost/stolen. I had logged into several applications such as Facebook, Paytm, etc. Thus, there are chances that my personal/ transaction details might be leaked. ...
0
votes
1answer
130 views

Android devices are unable to connect to Rogue Acces point created using Airbase-ng

I have created a rogue access point using airbase-ng, but I can't connect to it using my android phones (note II, S4), when I tap on the access point all I get is: Obtaining IP address...', than ...
0
votes
2answers
96 views

Can Chrome browser history be seen on work wifi, even if not re-loaded?

I use the work wifi daily but am always conscious of using work related sites. However Android tends to keep most apps running in the browser so my windows(tabs) are never essentially closed down. ...
1
vote
0answers
96 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
0
votes
2answers
80 views

Bluetooth attack against Android phone - could be successful?

Couple of days ago I attended a political demonstration. Amateur mistake, I know but I left my Bluetooth set to discoverable. I have a LG G2 running Android 5.0. Once during the demonstration I saw ...
1
vote
0answers
72 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC ...
1
vote
2answers
182 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
1answer
192 views

How to protect against the new malware Mazar Bot?

Mazar Bot is new Android malware that spreads via SMS. Its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the ...
5
votes
2answers
322 views

SSL: Android may not verify hostname, defining cipher suites

I'm developing an Android App which sends some HTTPS requests to our own Webserver (Linux, Nginx, SSL zertificate from "Let's Encrypt"). The requests worked fine on my test devices (Android 4.2.2 ...
-2
votes
1answer
110 views

Whats the most secure way to send user data from client to server? [closed]

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer. On the android app there is two buttons, sign in with facebook and sign in with ...
0
votes
0answers
2k views

Android vs iPhone encryption

I'm really curious to know what the technologies behind Android and iPhone are in regards to encryption. I know Android was supposed to go with encryption by default like iOS 8.0 and beyond and never ...
2
votes
3answers
104 views

Detecting code removal reverse engineering

I'm writing some native code in Android. Although it's tough to reverse engineer native codes as compared to Java, still this is possible. I'd want a condition wherein if someone removes or comments ...
2
votes
2answers
124 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by: Making sure users access all files from the server Local disks are denied access (forced to work only on network drives) ...
11
votes
1answer
221 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
4
votes
1answer
132 views

Is it unsafe to restore backed up data from Google servers?

I have an Android smartphone that I don't trust. It has an old version of Android and has been vulnerable to Stagefright and a host of a hundred other vulnerabilities for months. Although there is no ...
1
vote
1answer
95 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
1
vote
1answer
300 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
6
votes
3answers
1k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
0answers
144 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
2
votes
1answer
125 views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
0
votes
1answer
99 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
1
vote
1answer
40 views

Given certain parameters, are there any risks with Android's USB Debugging?

Assuming: You control access to an Android device You never connect that Android device to a malware-infected system via a USB cable Are there any risks with keeping USB Debugging always enabled ...
0
votes
0answers
16 views

Should I trust on Airpush and give IMEI? [duplicate]

For opting-out from air-push adds on android I can request to Airpush. Visit the relevant post: Is this red star icon malware? How to get rid of it? Is there a reliable way to detect the app ...
3
votes
2answers
136 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
5
votes
2answers
115 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
6
votes
2answers
319 views

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet ...
3
votes
0answers
51 views

Is it possible to perform encrypted telephonic calls in Android? [closed]

When I say that I need to perform encrypted telephonic calls to another person then please understand that I do not want an encrypted VoIP call which is routed over the internet. What I want to ...
3
votes
2answers
327 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
1
vote
0answers
31 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
0answers
83 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
0
votes
0answers
24 views

Is it possible to write an SEAndroid permission that enables only one app (subject) to access a device (object)?

We're interested in writing an SELinux policy for an Android build that enables a device (e.g. /dev/target) to be accessed by a single app and only that app. The app is a user-space app that's ...
3
votes
3answers
364 views

Can a virus spread between two Android devices logged into the same Google account?

It seems like I have a virus on my android tablet. I have had my tablet for 2.5 years (virus problems for almost 5 months). I am thinking about buying a new phone (Android) in the near future (I ...
7
votes
1answer
655 views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...