Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

3
votes
2answers
140 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
3
votes
2answers
685 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
3
votes
1answer
163 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
3
votes
1answer
198 views

Recover file using Java RanNum Gen + Key

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
3
votes
1answer
667 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
3
votes
2answers
634 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
3
votes
1answer
164 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
3
votes
1answer
205 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
3
votes
1answer
93 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
2
votes
3answers
3k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
2
votes
3answers
16k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
2
votes
2answers
338 views

Studies on Android users' attitude to security

I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
2
votes
3answers
3k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
2
votes
1answer
870 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
2
votes
3answers
141 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
3answers
125 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
2
votes
4answers
345 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
2
votes
1answer
843 views

Possible to safely send money via Paypal on public wifi networks?

I will be away for 1 month and during that time period I will have Internet access only via public wifi networks. I tried finding on the net tutorial on how to safely access and handle paypal ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
2
votes
2answers
58 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
2
votes
1answer
73 views

Offline phone security

How secure is an offline android phone? Some background. I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone. Cold ...
2
votes
2answers
1k views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
2
votes
1answer
203 views

Android: Are locally-stored encryption keys readable by attacker who gained root access?

i have a question: i'm trying to understand a specific point in android encryption. All the encryption keys are software based and are stored locally on the machine, so correct me if i'm wrong but ...
2
votes
2answers
448 views

Android shared library integrity protection

Is there a way to somehow 'protect' a native shared library (.so) for the Android platform against binary changing? E.g. someone could overwrite a JMP instruction with a NOP after reverse engineering ...
2
votes
2answers
425 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
2
votes
3answers
1k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
2
votes
1answer
149 views

Do modern Android devices provide access to their Secure Elelement in some way?

I'd like to know if latest generation Android devices provide an application with access to their Secure Element in some way (other than by way of the NFC interface, which is #1 application of the ...
2
votes
1answer
1k views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
2
votes
1answer
141 views

Adding one's own Cryptography Implementaion in Android

Since Android allows for Java and Native implementation of Cryptography, I would like to know how to provide a particular implementation of cryptographic algorithms (say just RSA for example). What ...
2
votes
2answers
471 views

Is it possible to get data out of running application from non-rooted phone

I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted. Use case: User opens ...
2
votes
2answers
3k views

How to check an Android Application for SQL Injection or XSS bugs?

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs. I mean if its an application, where should i write the queries. If through ...
2
votes
1answer
115 views

MITM SSL connection

I read this article today about an SSL MITM. I am trying to understand this attack. This may be a naive question. My understanding is that the WebView sends a request to domain name, the server ...
2
votes
1answer
409 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
2
votes
1answer
575 views

Android, how do I prevent Confused Deputy Attacks?

In case that a malicious mobile app hasn't the appropriate permissions to e.g. download a file, it can invoke a browser to download sth. Concrete examples of such an attack are shown from page 27 to ...
2
votes
1answer
725 views

Google Cloud Messaging Spoof

I have few question on security of Google Cloud Messaging Service (GCM) Is it possible to spoof messages that GCM server sends to android clients? Does server pushes data in encrypted format? Data ...
2
votes
1answer
573 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
2
votes
1answer
3k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
2
votes
2answers
78 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
2
votes
5answers
500 views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
1
vote
1answer
6k views

How mobile app WiFiKill can cut off internet access to neighbor devices?

There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? ...
1
vote
2answers
99 views

Unexpected emails have been sent - do I need to wipe my Android?

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large. I opened my Gmail App and found 5 messages in the Sent Mail folder ...
1
vote
1answer
1k views

Is it possible to store an android apk in SIM card and install it from there?

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following. ...
1
vote
1answer
156 views

Why Google and smartphone manufacturers don't care about updates?

For Windows, Firefox/Chrome, Java, Flash critical updates are issued each couple weeks, and as far my understanding goes, it is REALLY bad not to install them ASAP. For my 3 year old Samsung ...
1
vote
1answer
125 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
1
vote
1answer
108 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...
1
vote
1answer
285 views

Detecting Malware in the android App [closed]

I've been given an APK file, and before re-distributing to the "market" I want to make sure the given android app does not contain the malware. How can I do that ? Business use case is similar like : ...
1
vote
3answers
1k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
1
vote
1answer
223 views

Privilege usage checks

What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android). Android grants app privileges ...