Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

0
votes
2answers
70 views

Bluetooth attack against Android phone - could be successful?

Couple of days ago I attended a political demonstration. Amateur mistake, I know but I left my Bluetooth set to discoverable. I have a LG G2 running Android 5.0. Once during the demonstration I saw ...
1
vote
0answers
65 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC ...
1
vote
2answers
163 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
1answer
183 views

How to protect against the new malware Mazar Bot?

Mazar Bot is new Android malware that spreads via SMS. Its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the ...
5
votes
2answers
254 views

SSL: Android may not verify hostname, defining cipher suites

I'm developing an Android App which sends some HTTPS requests to our own Webserver (Linux, Nginx, SSL zertificate from "Let's Encrypt"). The requests worked fine on my test devices (Android 4.2.2 ...
-2
votes
1answer
109 views

Whats the most secure way to send user data from client to server? [closed]

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer. On the android app there is two buttons, sign in with facebook and sign in with ...
0
votes
0answers
2k views

Android vs iPhone encryption

I'm really curious to know what the technologies behind Android and iPhone are in regards to encryption. I know Android was supposed to go with encryption by default like iOS 8.0 and beyond and never ...
2
votes
3answers
103 views

Detecting code removal reverse engineering

I'm writing some native code in Android. Although it's tough to reverse engineer native codes as compared to Java, still this is possible. I'd want a condition wherein if someone removes or comments ...
1
vote
3answers
79 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by : 1. Making sure users access all files from the server 2.Local disks are denied access(forced to work only on network drives) ...
10
votes
1answer
181 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
4
votes
1answer
130 views

Is it unsafe to restore backed up data from Google servers?

I have an Android smartphone that I don't trust. It has an old version of Android and has been vulnerable to Stagefright and a host of a hundred other vulnerabilities for months. Although there is no ...
1
vote
1answer
89 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
1
vote
1answer
297 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
6
votes
3answers
953 views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
0
votes
0answers
128 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
2
votes
1answer
110 views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
0
votes
1answer
91 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
1
vote
1answer
36 views

Given certain parameters, are there any risks with Android's USB Debugging?

Assuming: You control access to an Android device You never connect that Android device to a malware-infected system via a USB cable Are there any risks with keeping USB Debugging always enabled ...
0
votes
0answers
16 views

Should I trust on Airpush and give IMEI? [duplicate]

For opting-out from air-push adds on android I can request to Airpush. Visit the relevant post: Is this red star icon malware? How to get rid of it? Is there a reliable way to detect the app ...
3
votes
2answers
119 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
5
votes
2answers
108 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
6
votes
2answers
199 views

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet ...
3
votes
0answers
51 views

Is it possible to perform encrypted telephonic calls in Android? [closed]

When I say that I need to perform encrypted telephonic calls to another person then please understand that I do not want an encrypted VoIP call which is routed over the internet. What I want to ...
3
votes
2answers
307 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
1
vote
0answers
28 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
0answers
77 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
0
votes
0answers
23 views

Is it possible to write an SEAndroid permission that enables only one app (subject) to access a device (object)?

We're interested in writing an SELinux policy for an Android build that enables a device (e.g. /dev/target) to be accessed by a single app and only that app. The app is a user-space app that's ...
3
votes
3answers
251 views

Can a virus spread between two Android devices logged into the same Google account?

It seems like I have a virus on my android tablet. I have had my tablet for 2.5 years (virus problems for almost 5 months). I am thinking about buying a new phone (Android) in the near future (I ...
6
votes
1answer
406 views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...
2
votes
2answers
613 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
2
votes
1answer
140 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
9
votes
2answers
176 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
0
votes
2answers
76 views

Using VPN on Android, Necessity of Rooting

I have just gotten a new phone and would like to protect my privacy better than I have in the past. I have read about rooting and then installing OrWall, OrBot, and OrWeb. If I understood correctly, ...
7
votes
1answer
229 views

Directory traversal sample code

I'm studying 'Directory traversal' attack in Android applications using this link I understand the concept behind the vulnerability that the input needs to be sanitized properly before opening any ...
2
votes
0answers
50 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
2
votes
1answer
78 views

Is it possible to extract and re-use the API of a mobile banking app [closed]

I am aware of the basic techniques used to reverse engineer and extract meaningful information in order to re-use an applications API. I am not fully adept with the advanced techniques however. Is ...
3
votes
1answer
45 views

What was the first version of Android to use OpenSSL (and what version was it)? What was used prior?

Android 1.6 source is the earliest I can find that references openssl (i.e., has OPENSSL_VERSION[_TEXT] defined The script I ran to get these versions was: $ git clone ...
2
votes
1answer
45 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
2
votes
1answer
58 views

Isolate Android system when connected to wifi

Is there any built-in feature or application that isolates the system when it's connected to a wlan, so that just a determined app has access to the net? For example, let's say that you want to ...
3
votes
1answer
59 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
2
votes
1answer
82 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
0
votes
1answer
89 views

Can an iOS/android app encrypt data without the user entering a password?

I found an iOS app that claims to save all user data only encrypted. But the app never asks me for a password. Is it even possible that the app encrypts the data in a useful way? I do need see what ...
3
votes
2answers
71 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
0
votes
3answers
99 views

Can the user of an app see what's in the https packets?

If I exchange https packets between a server and an Android client, is it easy for the user of the client to get whatever is in the encrypted traffic? Should I consider all such traffic unsafe if the ...
0
votes
0answers
329 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
1
vote
1answer
120 views

android apk and suid binary

Is it correct for me to assume that, there is no way to make an Android app (APK) to run in root privilege by itself (without an external "su" native executable), even when it is using NDK native ...
1
vote
0answers
172 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
3
votes
2answers
1k views

How can I prevent `am` from starting my activity?

I have an Android app and it has 3 activities; A, G and B. When the app starts users see Activity A. If user wants to navigate to activity B, app starts activity G and asks for a password. If the ...
1
vote
3answers
153 views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...