Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

3
votes
2answers
1k views

Best way to secure Wi-Fi Direct connection

I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data ...
3
votes
3answers
708 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
3
votes
2answers
417 views

How secure is the private storage of a mobile app

Are there any know security flaws/hacks to gain access to the private storage(file system or SQLite database) of Android and iOS applications? What measures do Google and Apple take to "prevent" ...
3
votes
2answers
6k views

How to sniff Bluetooth traffic using Android?

I have two Arduinos using Bluetooth to communicate one with another. Is it possible to sniff the Bluetooth conversation between the two devices? An Android solution would be great, I heard of hcidump ...
3
votes
2answers
5k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
3
votes
1answer
100 views

Offline phone security

How secure is an offline android phone? Some background. I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone. Cold ...
3
votes
1answer
129 views

How does Android's security model differ from UNIX's?

In UNIX's security model, you log in as a user, and then every process you start can access everything that belongs to your user account - that is, the trust is based on the user account, not on the ...
3
votes
3answers
423 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
3
votes
1answer
198 views

Do modern Android devices provide access to their Secure Elelement in some way?

I'd like to know if latest generation Android devices provide an application with access to their Secure Element in some way (other than by way of the NFC interface, which is #1 application of the ...
3
votes
2answers
271 views

Suspicious phone browser activity

On a droid Razr M, I used chrome to log in to Gmail instead of the app. It asked to log in as me on a toast at the bottom of the browser, taking my credentials from somewhere on the phone I assume. ...
3
votes
2answers
150 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
3
votes
2answers
758 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
3
votes
1answer
69 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...
3
votes
1answer
198 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
3
votes
1answer
202 views

Recover file using Java RanNum Gen + Key

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
3
votes
1answer
742 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
3
votes
1answer
65 views

How much can I trust the “factory restore/reset” on a(n) (potentially compromised) android?

This question is a simple one: how much can you trust the "factory restore/reset" option on an android device? If the device has possibly been compromised, is it possible the "factory reset" will ...
3
votes
2answers
1k views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
3
votes
1answer
166 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
3
votes
1answer
221 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
3
votes
1answer
41 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
3
votes
0answers
37 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
3
votes
2answers
244 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
2
votes
3answers
3k views

How secure is wiping an encrypted Android device?

based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
2
votes
2answers
369 views

Studies on Android users' attitude to security

I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
2
votes
1answer
1k views

Is it possible to store an android apk in SIM card and install it from there?

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following. ...
2
votes
3answers
20k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
2
votes
4answers
398 views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps. Thanks!
2
votes
3answers
4k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
2
votes
1answer
954 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
2
votes
3answers
144 views

Is possible to know if increased marketshare means more viruses?

I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
2
votes
3answers
159 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
2
votes
4answers
397 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
2
votes
1answer
1k views

Possible to safely send money via Paypal on public wifi networks?

I will be away for 1 month and during that time period I will have Internet access only via public wifi networks. I tried finding on the net tutorial on how to safely access and handle paypal ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
2
votes
3answers
58 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
2
votes
3answers
216 views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
2
votes
2answers
103 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
2
votes
1answer
115 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
2
votes
2answers
2k views

Is there any useful Android app for security assessments? [closed]

I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the ...
2
votes
1answer
224 views

Android: Are locally-stored encryption keys readable by attacker who gained root access?

i have a question: i'm trying to understand a specific point in android encryption. All the encryption keys are software based and are stored locally on the machine, so correct me if i'm wrong but ...
2
votes
2answers
522 views

Android shared library integrity protection

Is there a way to somehow 'protect' a native shared library (.so) for the Android platform against binary changing? E.g. someone could overwrite a JMP instruction with a NOP after reverse engineering ...
2
votes
2answers
513 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
2
votes
2answers
58 views

Determining safety of Android APK executable that requires root

On my request, a developer gave me a new version of his Android app to test. The app requires root permissions. I do not know the developer personally. I have no specific reasons to trust or ...
2
votes
2answers
185 views

What are methods to protecting an android phone from law enforcement

From what I hear, android uses the standard linux dm-crypt for encryption. Obviously you should have: A pin/password for your phone That pin/password should at least be 8 characters The question ...
2
votes
3answers
3k views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
2
votes
1answer
1k views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
2
votes
1answer
225 views

Adding one's own Cryptography Implementaion in Android

Since Android allows for Java and Native implementation of Cryptography, I would like to know how to provide a particular implementation of cryptographic algorithms (say just RSA for example). What ...
2
votes
2answers
531 views

Is it possible to get data out of running application from non-rooted phone

I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted. Use case: User opens ...