Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

1
vote
1answer
15 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
5
votes
1answer
402 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
3
votes
2answers
122 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
0
votes
1answer
43 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
4
votes
1answer
124 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
5
votes
1answer
158 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
2
votes
1answer
62 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
5
votes
3answers
74 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
2
votes
1answer
41 views

Android N - Security Crypto Provider is deprecated

As mentioned in "android developer's blog" , http://android-developers.blogspot.in/2016/06/security-crypto-provider-deprecated-in.html , security Crypto provider is deprecated on Android N. And also ...
0
votes
1answer
47 views

Why doesn't Google uninstall or report, installed pirated apps? [closed]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
7
votes
1answer
38 views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
1
vote
0answers
18 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
2
votes
2answers
48 views

Disclosing used Libaries in App

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it ...
1
vote
1answer
151 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
31
votes
7answers
4k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
1
vote
1answer
59 views

What is a root method and how is it achieved?

I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding? I know it's high privileges, but how can that not be enabled through a regular ...
0
votes
0answers
9 views

Using both a firewall and vpn on android [migrated]

Is there a way to use both a firewall and a vpn app on android. I have tried allowing the vpn through the firewall but one invaraibly goes off when I start the other. Is there some way around this -- ...
0
votes
0answers
60 views

Pop up in Facebook built-in browser

While I was visiting a page on a usual website with the built-in browser of the Android Facebook app, a pop-up just... poped-up, saying dumb stuff about my cellphone being full of viruses, etc. (Quite ...
1
vote
1answer
1k views

Is there a foolproof method to remove spyware from Android smartphone?

I am owning an Android smartphone. I learnt that factory reset may not remove spyware as it might have corrupted the image being installed by factory reset. Is there a foolproof method which ensures ...
0
votes
1answer
75 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
3
votes
1answer
860 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
-3
votes
0answers
13 views

How to identify fake call log entries in the Android call log database? [migrated]

Is there a way to discriminate between real call events and fake call log entries (made using some app) from the call log database in Android?
1
vote
1answer
63 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
0
votes
1answer
24 views

Is it possible to deny Permission access and other Settings using Screen Overlay in Android?

I was noticing an app that doesn't need Camera access ever having camera access and other spy capable permission. When I tried to change the permssion there was a overlay text box saying something ...
-1
votes
2answers
54 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
2
votes
1answer
56 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: Public Web Server hosts basic content for general public. Private server inside a VPN hosts special subscriber content and services. The two servers ...
49
votes
6answers
10k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
1
vote
0answers
26 views

Does Rabbitmq support Elliptic Curve Encryption? [migrated]

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
-1
votes
1answer
31 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...
2
votes
3answers
32 views

Prompt for PIN when installing Android Apps?

is there a way to disable app installations until you provide a certain PIN? I have the following scenario in mind: I'm a heavy Google Photos and Google Drive user, but only from my Windows computer ...
0
votes
1answer
51 views

Encrypt links in android app

I want to hide the links to my server address in my Android app. When my app is decompiled, the links are clearly showing. Even with the proguard enabled I am not able to hide links. How can I ...
42
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
3
votes
3answers
203 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
0
votes
0answers
24 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0
votes
1answer
32 views

Do android apps have signatures like Window executables?

Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs. If this would be the case, are they self signed? Are the play store apps signed by Google in ...
2
votes
1answer
286 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
0
votes
0answers
107 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
3
votes
3answers
163 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
2
votes
1answer
66 views

Android security document comparable to Apple's security document?

Is there an Android security document comparable to Apple's Security Document (PDF)? Does such a comprehensive document not apply because Android is only the OS and Apple makes the hardware and the ...
6
votes
2answers
100 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
0
votes
2answers
98 views

Smartphone 2FA has been broken?

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is ...
4
votes
1answer
108 views

What excactly is encrypted by “full disk encryption” on Android 5?

This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and ...
2
votes
2answers
4k views

How to determine if it is safe to install apk files from alternative android app stores?

Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
1
vote
0answers
78 views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
0
votes
1answer
32 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
0
votes
1answer
46 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
1
vote
1answer
53 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
6
votes
2answers
262 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
2
votes
0answers
24 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...