Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

2
votes
1answer
536 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
0
votes
2answers
319 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
3
votes
2answers
960 views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
6
votes
1answer
600 views

Android and AES side channel attacks

I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
3
votes
1answer
126 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
2
votes
2answers
308 views

Studies on Android users' attitude to security

I'm a final year BSc. student of Computer Security & Forensics at the University of Bedfordshire (UK). I'm investigating perceptions of security on Android platforms, and how to educate users of ...
4
votes
3answers
2k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
5
votes
2answers
932 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
3
votes
5answers
8k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
4
votes
3answers
272 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
5
votes
1answer
254 views

Android, how to protect in case of theft

What are some steps to take into account to protect an Android phone in case of theft? Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
13
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
2
votes
1answer
2k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
6
votes
2answers
2k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
0
votes
1answer
140 views

How to secure unprotected Telnet Server on Droid 3

I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
1
vote
1answer
818 views

Fuzzing Android API

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
4
votes
3answers
385 views

Android phone number from disk image

I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
4
votes
1answer
211 views

How can I do a secure reinstallation on an android device?

I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the ...
4
votes
2answers
3k views

How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?

The problem statement is: To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
3
votes
2answers
618 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
2
votes
2answers
3k views

How to check an Android Application for SQL Injection or XSS bugs?

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs. I mean if its an application, where should i write the queries. If through ...
7
votes
3answers
8k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
8
votes
1answer
2k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
1
vote
1answer
209 views

Privilege usage checks

What does it mean that "the permission system does not include checks for transitive privilege usage" (quote from a paper on Privilege Escalation Attacks on Android). Android grants app privileges ...
1
vote
1answer
5k views

How mobile app WiFiKill can cut off internet access to neighbor devices?

There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? ...
3
votes
1answer
190 views

Recover file using Java RanNum Gen + Key

EDIT: Here is some more background. I am basically trying to reproduce this the method outlined here I have been able to hit everything up until the paragraph regarding the decrypting of the data file ...
2
votes
3answers
3k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
7
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
9
votes
8answers
6k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
3
votes
3answers
645 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
49
votes
7answers
63k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
10
votes
3answers
4k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
4
votes
4answers
894 views

Explaining security vs. performace to a non-tech superior

I was tasked to implement some sort of password-based encoding/decoding in an android app by my non-tech SO. He also showed me this list of android security providers. Naturally, He chose the one with ...
10
votes
3answers
3k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
3
votes
1answer
619 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
4
votes
1answer
537 views

Android for the Paranoid

In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
3
votes
3answers
188 views

Best approach for making an app that connects to sensitive information

I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
14
votes
4answers
3k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
21
votes
1answer
1k views

Security implications of rooting your android phone

My android smart phone has fancy features that I can get if and only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone has me ...
13
votes
3answers
341 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
1
vote
1answer
529 views

Android application level encryption cracking

We come across Android applications which use the custom encryption. When we proxy the Android phone or emulator, the proxy captures traffic which is unreadable. Is there a known technique to read ...
4
votes
1answer
1k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
4
votes
1answer
783 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
5
votes
3answers
10k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
14
votes
5answers
2k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...