Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

2
votes
1answer
246 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
3
votes
2answers
197 views

Suspicious phone browser activity

On a droid Razr M, I used chrome to log in to Gmail instead of the app. It asked to log in as me on a toast at the bottom of the browser, taking my credentials from somewhere on the phone I assume. ...
8
votes
1answer
3k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
2
votes
2answers
642 views

Best way to secure Wi-Fi Direct connection

I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data ...
3
votes
2answers
801 views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
2
votes
2answers
355 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
5answers
3k views

Track lost Android phone, if the thief is using it to access internet

I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software. But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
2
votes
3answers
139 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
1
vote
1answer
127 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
5
votes
3answers
869 views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
5
votes
2answers
164 views

How much should I care about the iOS/Android version when pentesting mobile app?

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application? I.e. if I test mobile application ...
4
votes
2answers
1k views

How to secure usb data storage of Android phones?

I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable? It's actually very easy to ...
4
votes
1answer
771 views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
4
votes
1answer
3k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
2
votes
1answer
489 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
1
vote
1answer
265 views

Pre boot authentication for Android phones

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
3
votes
2answers
747 views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
6
votes
1answer
520 views

Android and AES side channel attacks

I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
3
votes
1answer
114 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
2
votes
2answers
282 views

Studies on Android users' attitude to security

I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
3
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
5
votes
2answers
743 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
3
votes
5answers
7k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
4
votes
3answers
254 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
5
votes
1answer
242 views

Android, how to protect in case of theft

What are some steps to take into account to protect an Android phone in case of theft? Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
12
votes
3answers
1k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
2
votes
1answer
2k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
5
votes
2answers
1k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
0
votes
1answer
136 views

How to secure unprotected Telnet Server on Droid 3

I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
1
vote
1answer
686 views

Fuzzing Android API

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
4
votes
3answers
363 views

Android phone number from disk image

I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
4
votes
1answer
206 views

How can I do a secure reinstallation on an android device?

I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the ...
4
votes
2answers
2k views

How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?

The problem statement is: To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
3
votes
2answers
549 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
2
votes
2answers
2k views

How to check an Android Application for SQL Injection or XSS bugs?

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs. I mean if its an application, where should i write the queries. If through ...
6
votes
3answers
7k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
8
votes
1answer
2k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
1
vote
1answer
190 views

Privilege usage checks

What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android). Android grants app privileges ...
1
vote
1answer
4k views

How mobile app WiFiKill can cut off internet access to neighbor devices?

There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? ...
3
votes
1answer
182 views

Recover file using Java RanNum Gen + Key

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
2
votes
3answers
2k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
6
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
9
votes
8answers
5k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
3
votes
3answers
617 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
43
votes
7answers
54k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
9
votes
3answers
3k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
4
votes
4answers
736 views

Explaining security vs. performace to a non-tech superior

I was tasked to implement some sort of password-based encoding/decoding in an android app by my non-tech SO. He also showed me this list of android security providers. Naturally, He chose the one with ...
10
votes
3answers
3k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...