Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

1
vote
0answers
165 views

Encrypted chat using any smartphone. Is it legal? [closed]

Here's my case. We have written app for Android smartphones which allows users to exchange secured cipher messages. For key-exchange we're using elliptic curve 112 bits, for messaging we're using DES ...
2
votes
1answer
1k views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
7
votes
2answers
402 views

Is there a way to notify me when my Android phone connects to an unencrypted GSM network?

As far as I know when a phone connects to a GSM (2G or 3G) network, the connection is encrypted. When I get in range of let's say an IMSI Catcher, I imagine this connection will not be encrypted in ...
1
vote
1answer
735 views

Securing REST API for mobile use with OAuth

I'm a complete noob about security, so please, forgive me if I say something wrong. I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones ...
1
vote
1answer
123 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
3
votes
1answer
205 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
3
votes
3answers
582 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
0
votes
1answer
198 views

Have there been any instances of malware in custom ROMs for Android?

Have there been any instances of malware or spyware packaged in custom ROMs, for example a malicious email app pre-installed that records your server IMAP username and password and forwards it to a ...
2
votes
1answer
574 views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...
8
votes
3answers
7k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
0
votes
1answer
171 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
2
votes
1answer
203 views

Android: Are locally-stored encryption keys readable by attacker who gained root access?

i have a question: i'm trying to understand a specific point in android encryption. All the encryption keys are software based and are stored locally on the machine, so correct me if i'm wrong but ...
0
votes
3answers
4k views

Does rooting an Android Phone make it Vulnerable? [closed]

If android os in a device is rooted , will it be safe to use it in public networks where possibilities of attacks is more.
1
vote
0answers
252 views

Configure Asterisk for lan with SRTP enabled SipDroid

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
-1
votes
2answers
183 views

Android OS Security [closed]

I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most ...
-4
votes
5answers
912 views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
0
votes
1answer
3k views

Show another number when calling mobile phone [duplicate]

Nowadays I heard that some cheaters make mobile calls to steal banking & other private information.They show private numbers like 911 to their victims. Is it possible show different number to ...
3
votes
1answer
557 views

Is it really true that Google knows most of the worlds wifi passwords

Computer World is reporting that Android devices phoning home have given Google a database with almost every wifi password in the world to it. Is this groundless hysteria, or a genuine concern? If ...
5
votes
2answers
486 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
12
votes
4answers
2k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
1
vote
1answer
617 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
2
votes
4answers
345 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
3
votes
2answers
586 views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
1answer
141 views

Adding one's own Cryptography Implementaion in Android

Since Android allows for Java and Native implementation of Cryptography, I would like to know how to provide a particular implementation of cryptographic algorithms (say just RSA for example). What ...
0
votes
1answer
89 views

How does Look Out Secuirty and Anti-Virus determine if an app is harmeful?

For Android Lookout can scan an app before it is installed, and I think it scans a new app the first time it runs too. It displays the message "this app is safe" and I'm wondering, how does it ...
-1
votes
1answer
145 views

Credential (et al) storage on Android - And general application credential storage inquiry [closed]

Please read before assuming this should go in another forum (like an android forum) - this is a Security question. Here is the scenario: Developing an health care based android application that has ...
11
votes
1answer
163 views

Android Device Support Lifecycles

A key consideration for most computer platforms is the availability of security patches for vulnerabilities which inevitably arise with them. Are there any available resources which provide ...
3
votes
2answers
4k views

How to sniff Bluetooth traffic using Android?

I have two Arduinos using Bluetooth to communicate one with another. Is it possible to sniff the Bluetooth conversation between the two devices? An Android solution would be great, I heard of hcidump ...
3
votes
2answers
3k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
0
votes
2answers
879 views

Writing Android Exploits [closed]

I want to learn how to detect and write exploits for the Android OS. I am a bit familiar with Linux and have some knowledge in scripting in ruby and python. I had learnt how to write Exploits for ...
1
vote
1answer
156 views

Why Google and smartphone manufacturers don't care about updates?

For Windows, Firefox/Chrome, Java, Flash critical updates are issued each couple weeks, and as far my understanding goes, it is REALLY bad not to install them ASAP. For my 3 year old Samsung ...
4
votes
1answer
959 views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
9
votes
2answers
151 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
4
votes
2answers
700 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
9
votes
1answer
41k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
2
votes
1answer
841 views

Possible to safely send money via Paypal on public wifi networks?

I will be away for 1 month and during that time period I will have Internet access only via public wifi networks. I tried finding on the net tutorial on how to safely access and handle paypal ...
4
votes
2answers
1k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
2
votes
1answer
869 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
-2
votes
1answer
814 views

Android Encryption and USB Access

I'm investigating device encryption for my Android, but what is the impact on internal storage and external SD? Also, if the device is used as a flash drive or livedisk (DriveDroid), will I run into ...
9
votes
1answer
2k views

How to properly delete all data from cell phones?

Lately I've been thinking to get rid of some old smartphones; among them an Android device and a Blackberry. Not selling or recycling them is the ideal solution, however, I still would like to know ...
25
votes
3answers
3k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
1
vote
1answer
70 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
3
votes
5answers
3k views

How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?

Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a ...
17
votes
1answer
8k views

What is the difference between Serial Number and Thumbprint?

I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is. the MSDN says: Serial number A number that uniquely identifies the ...
1
vote
1answer
221 views

Android soft keyboard architecture

I am new to Android. I am trying to figure out how exactly a soft keyboard on an Android device works. What exactly is the 'behind the scenes' process that takes place so that the application is ...
2
votes
3answers
3k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
-1
votes
1answer
112 views

how malware is added to android app [closed]

I'm working on securing apps from malware attack in project. I just want to know how app is repackaged with malware. Because for reverse engg. we've apktool, dex2jar, Java decompiler. But how ...
6
votes
3answers
4k views

Strong encryption for base64 encoded public key in Android

I want to know how I can achieve strong encryption of a public key present in my Android application. It's Android's advice that To keep your public key safe from malicious users and hackers, do ...
2
votes
2answers
448 views

Android shared library integrity protection

Is there a way to somehow 'protect' a native shared library (.so) for the Android platform against binary changing? E.g. someone could overwrite a JMP instruction with a NOP after reverse engineering ...
10
votes
2answers
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...