Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

1
vote
0answers
104 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
3
votes
2answers
204 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
0
votes
1answer
554 views

Is there a fool-proof method to remove spyware from android smartphone?

I am owning an android smartphone. I learnt that factory reset may not remove spyware as it might have corrupted the image being installed by factory reset. Is there a fool-proof method which ensures ...
0
votes
2answers
816 views

Is it possible to install spyware in password protected android phone?

I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?
5
votes
6answers
2k views

Can smartphone spyware work even if there is no data connection?

I am using android phone. Is it possible for spywares to transmit data even when I dont have any internet plan/connection ? Can it use some other way , say , cellular network etc ? EDIT1: SMS and ...
1
vote
1answer
727 views

Is it possible to store an android apk in SIM card and install it from there?

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following. ...
5
votes
2answers
389 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
1
vote
0answers
288 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
6
votes
2answers
1k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
1
vote
0answers
153 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
2
votes
1answer
745 views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
7
votes
2answers
297 views

Is there a way to notify me when my Android phone connects to an unencrypted GSM network?

As far as I know when a phone connects to a GSM (2G or 3G) network, the connection is encrypted. When I get in range of let's say an IMSI Catcher, I imagine this connection will not be encrypted in ...
1
vote
1answer
608 views

Securing REST API for mobile use with OAuth

I'm a complete noob about security, so please, forgive me if I say something wrong. I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones ...
1
vote
1answer
116 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
3
votes
1answer
191 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
2
votes
3answers
459 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
0
votes
1answer
168 views

Have there been any instances of malware in custom ROMs for Android?

Have there been any instances of malware or spyware packaged in custom ROMs, for example a malicious email app pre-installed that records your server IMAP username and password and forwards it to a ...
2
votes
1answer
406 views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...
8
votes
3answers
4k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
0
votes
1answer
145 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
2
votes
1answer
179 views

Android: Are locally-stored encryption keys readable by attacker who gained root access?

i have a question: i'm trying to understand a specific point in android encryption. All the encryption keys are software based and are stored locally on the machine, so correct me if i'm wrong but ...
-1
votes
3answers
3k views

Does rooting an Android Phone make it Vulnerable? [closed]

If android os in a device is rooted , will it be safe to use it in public networks where possibilities of attacks is more.
1
vote
0answers
217 views

Configure Asterisk for lan with SRTP enabled SipDroid

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
-1
votes
2answers
178 views

Android OS Security [closed]

I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
-2
votes
5answers
533 views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
0
votes
1answer
2k views

Show another number when calling mobile phone [duplicate]

Nowadays I heard that some cheaters make mobile calls to steal banking & other private information.They show private numbers like 911 to their victims. Is it possible show different number to ...
3
votes
1answer
489 views

Is it really true that Google knows most of the worlds wifi passwords

Computer World is reporting that Android devices phoning home have given Google a database with almost every wifi password in the world to it. Is this groundless hysteria, or a genuine concern? If ...
5
votes
2answers
386 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
10
votes
4answers
1k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
1
vote
1answer
458 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
2
votes
4answers
282 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
3
votes
2answers
454 views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
1
vote
0answers
83 views

Adding one's own Cryptography Implementaion in Android

Since Android is allows for Java and Native implementation of Cryptography, I would like to know if we have to provide for a particular implementation of cryptographic algorithms(say just RSA for ...
0
votes
1answer
83 views

How does Look Out Secuirty and Anti-Virus determine if an app is harmeful?

For Android Lookout can scan an app before it is installed, and I think it scans a new app the first time it runs too. It displays the message "this app is safe" and I'm wondering, how does it ...
0
votes
1answer
124 views

Credential (et al) storage on Android - And general application credential storage inquiry [closed]

Please read before assuming this should go in another forum (like an android forum) - this is a Security question. Here is the scenario: Developing an health care based android application that has ...
11
votes
1answer
151 views

Android Device Support Lifecycles

A key consideration for most computer platforms is the availability of security patches for vulnerabilities which inevitably arise with them. Are there any available resources which provide ...
3
votes
2answers
3k views

How to sniff Bluetooth traffic using Android?

I have two Arduinos using Bluetooth to communicate one with another. Is it possible to sniff the Bluetooth conversation between the two devices? An Android solution would be great, I heard of hcidump ...
3
votes
2answers
2k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
0
votes
2answers
744 views

Writing Android Exploits [closed]

I want to learn how to detect and write exploits for the Android OS. I am a bit familiar with Linux and have some knowledge in scripting in ruby and python. I had learnt how to write Exploits for ...
1
vote
1answer
147 views

Why Google and smartphone manufacturers don't care about updates?

For Windows, Firefox/Chrome, Java, Flash critical updates are issued each couple weeks, and as far my understanding goes, it is REALLY bad not to install them ASAP. For my 3 year old Samsung ...
4
votes
1answer
779 views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
9
votes
2answers
150 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
4
votes
2answers
650 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
7
votes
1answer
31k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
2
votes
1answer
649 views

Possible to safely send money via Paypal on public wifi networks?

I will be away for 1 month and during that time period I will have Internet access only via public wifi networks. I tried finding on the net tutorial on how to safely access and handle paypal ...
4
votes
2answers
1k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
2
votes
1answer
773 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
-2
votes
1answer
670 views

Android Encryption and USB Access

I'm investigating device encryption for my Android, but what is the impact on internal storage and external SD? Also, if the device is used as a flash drive or livedisk (DriveDroid), will I run into ...
9
votes
1answer
1k views

How to properly delete all data from cell phones?

Lately I've been thinking to get rid of some old smartphones; among them an Android device and a Blackberry. Not selling or recycling them is the ideal solution, however, I still would like to know ...
25
votes
3answers
3k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...