Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

25
votes
3answers
3k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
1
vote
1answer
68 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
3
votes
5answers
2k views

How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?

Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a ...
15
votes
1answer
5k views

What is the difference between Serial Number and Thumbprint?

I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is. the MSDN says: Serial number A number that uniquely identifies the ...
1
vote
1answer
204 views

Android soft keyboard architecture

I am new to Android. I am trying to figure out how exactly a soft keyboard on an Android device works. What exactly is the 'behind the scenes' process that takes place so that the application is ...
2
votes
3answers
2k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
-1
votes
1answer
105 views

how malware is added to android app [closed]

I'm working on securing apps from malware attack in project. I just want to know how app is repackaged with malware. Because for reverse engg. we've apktool, dex2jar, Java decompiler. But how ...
5
votes
3answers
3k views

Strong encryption for base64 encoded public key in Android

I want to know how I can achieve strong encryption of a public key present in my Android application. It's Android's advice that To keep your public key safe from malicious users and hackers, do ...
2
votes
2answers
365 views

Android shared library integrity protection

Is there a way to somehow 'protect' a native shared library (.so) for the Android platform against binary changing? E.g. someone could overwrite a JMP instruction with a NOP after reverse engineering ...
10
votes
1answer
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
2
votes
2answers
386 views

Is it possible to get data out of running application from non-rooted phone

I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted. Use case: User opens ...
3
votes
2answers
881 views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
2
votes
3answers
12k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
2
votes
1answer
607 views

Google Cloud Messaging Spoof

I have few question on security of Google Cloud Messaging Service (GCM) Is it possible to spoof messages that GCM server sends to android clients? Does server pushes data in encrypted format? Data ...
4
votes
1answer
941 views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
3
votes
3answers
6k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
5
votes
1answer
2k views

Android / CyanogenMod encryption vs GNU/Linux

Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt. Here is what I understand: Encrypted LVM on GNU/Linux is an ...
17
votes
2answers
30k views

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations ...
3
votes
4answers
733 views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
11
votes
1answer
3k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
0
votes
2answers
5k views

Can wifi administrator see data transfer over android phone. precisely gmail app communication

sometimes I connect to wifi outside my home in office , restaurants and friends house. I want to know if wifi administrator can see the exact data my android phone communicates? I am only concerned ...
-3
votes
1answer
513 views

How to use phone's Wifi tethering to demonstrate security vulnerabilities on phones [closed]

I am teaching a course to highschool students about computers, and I wanted to do something different for tomorrow class. I was thinking to teach them about wifi security vulnerabilities through a ...
1
vote
1answer
4k views

Android apk malware

I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it. My question here is about the apk ...
1
vote
3answers
1k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
2
votes
1answer
261 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
3
votes
2answers
224 views

Suspicious phone browser activity

On a droid Razr M, I used chrome to log in to Gmail instead of the app. It asked to log in as me on a toast at the bottom of the browser, taking my credentials from somewhere on the phone I assume. ...
8
votes
1answer
4k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
3
votes
2answers
787 views

Best way to secure Wi-Fi Direct connection

I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data ...
3
votes
2answers
913 views

OS Fingerprinting for Android

Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
2
votes
2answers
379 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
5answers
3k views

Track lost Android phone, if the thief is using it to access internet

I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software. But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
2
votes
3answers
139 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
1
vote
1answer
133 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
7
votes
3answers
1k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
5
votes
2answers
177 views

How much should I care about the iOS/Android version when pentesting mobile app?

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application? I.e. if I test mobile application ...
4
votes
2answers
2k views

How to secure usb data storage of Android phones?

I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable? It's actually very easy to ...
5
votes
1answer
901 views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
5
votes
1answer
4k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
2
votes
1answer
524 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
0
votes
2answers
311 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
3
votes
2answers
894 views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
6
votes
1answer
578 views

Android and AES side channel attacks

I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
3
votes
1answer
123 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
2
votes
2answers
299 views

Studies on Android users' attitude to security

I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
4
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
5
votes
2answers
872 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
3
votes
5answers
8k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
4
votes
3answers
269 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?