Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

6
votes
1answer
56 views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
-7
votes
0answers
17 views

banking app testing information [on hold]

How to test banking android app for OWASP 10 SEQURITY RISK? PLEASE GIVE ME TOOL NAME ON WHICH EXAT RESULT WE CAN GET? AND GIVE ANDROID APP FOR DEEP TESTING? HOW TO PERFORM TESTING OF ANY BANKING ...
0
votes
0answers
23 views

How to mitigate attacks on mobile phone via mobile network, i.e. imsi catchers and other methods to take into account [on hold]

I have AIMSICD installed on my unrooted Galaxy Grand Prime running 5.1.1. I don't connect it to my home router, which I'm assuming as a matter of course has been compromised, or wifi hotspots. I never ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
1
vote
2answers
58 views

How to protect against request intercepting and parameter-tampering? [duplicate]

My problem is that I made an app and I am making PHP Requests. I just realized that you can sniff everything on Android with "Packet Capture". How can I make my app more secure? I thought about ...
5
votes
1answer
120 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
1
vote
0answers
13 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
-7
votes
0answers
63 views

How to stop someone from hacking me [on hold]

I know who is at fault but I don't want for her to get in trouble unless it won't stop after this last attempt to remedy the situation. I have the ip address before she started using apps to disguise ...
2
votes
1answer
47 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
2
votes
1answer
258 views

Can malware spread via bluetooth file transfer in Android?

I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ? If so, does it need ...
1
vote
1answer
89 views

Android Malware Dataset

I am working on a project to identify the author of the malicious apk. To test my results I need dataset of malicious apks along with their authors. Currently I am working on a dataset which is very ...
3
votes
2answers
307 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
1
vote
1answer
37 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
6
votes
2answers
200 views

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet ...
1
vote
0answers
21 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
0
votes
0answers
8 views

Is It Possible To Trace Java API Calls In Android ART Using Frida Framework? [migrated]

I can trace JNI APIs very easily using this code Interceptor.attach(Module.findExportByName("lib.so" , "somefunction"), { onEnter: function(args) { args[1] = ptr(0); ...
2
votes
1answer
799 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
0
votes
0answers
18 views

Stagefright 2.0 - CVE-2015-3876 fix

Im currently studying Stagefright2.0 bugs. I'm wondering how the CVE-2015-3876 was fixed. I know it was caused by an integer overflow and the fix can be found here: ...
1
vote
0answers
23 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
4
votes
1answer
83 views

Wasn't WhatsApp messages already encrypted?

According to this article, which was written in 2014, WhatsApp had partnered with Open Whisper System to make its (text based) messages encrypted. So what's the big change now that Whatsapp's ...
3
votes
3answers
90 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
2
votes
1answer
43 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: (1) Public Web Server hosts basic content for general public. (2) Private server inside a VPN hosts special subscriber content and services. The two ...
1
vote
0answers
18 views

Security implications of Android apps that require Accessibility access

Occasionally, an Android app will require access to Accessibility services. As an example, see App Hibernator. What are the security implications of allowing an app access to Android's Accessibility ...
1
vote
0answers
37 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
6
votes
1answer
51 views

Can play store applications be tampered with by Google?

Can play store applications be tampered with by Google? I understand that other apps are "unsigned" so you need to have applications from unknown sources turned on. However, Google Apps are "signed" ...
52
votes
2answers
12k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
1
vote
0answers
35 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
2
votes
1answer
261 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
3
votes
3answers
41 views

Is attacking a password manager on android with root access a plausible concern?

There is a password manager app for Android that I'm considering using, that reads a database format for a popular desktop password manager. There is one part of this app that is giving me pause; I've ...
0
votes
1answer
42 views

Java / Android Client-Server application. Digital certificates and CAs

I'm currently developing an application for Android that will allow users to back up their data on a server, which I am also developing in Java. I've pretty much completed the development of the ...
1
vote
1answer
169 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
0
votes
0answers
3 views

Android UID 0 Process Time_Wait for 103.235.16.156 [migrated]

I ran my netstat App and found a UID 0 process connection to 103.235.16.156. Looks like it's coming from Hong Kong. I'm running CM 12.1-20150909 for HTC M8, so it is a custom ROM with root. I'm ...
2
votes
1answer
51 views

Android security document comparable to Apple's security document?

Is there an Android security document comparable to Apple's Security Document (PDF)? Does such a comprehensive document not apply because Android is only the OS and Apple makes the hardware and the ...
6
votes
3answers
126 views

Android full disk encryption

I am using Android 4.4.4. There is an option called phone storage encryption. From what I have read the crypto is secure. However, I read this article which said Google is able to reset passwords: ...
0
votes
2answers
80 views

Can Chrome browser history be seen on work wifi, even if not re-loaded?

I use the work wifi daily but am always conscious of using work related sites. However Android tends to keep most apps running in the browser so my windows(tabs) are never essentially closed down. ...
4
votes
2answers
50 views

How to check and trust call encryption software

There are lots of software for mobile operating systems providing end-to-end encryption. What is the best way to decide which one is trustworthy if their source is not revealed? Reverse engineering ...
-6
votes
0answers
100 views

Android default encryption settings

Does anyone know how to change the Android default encryption settings? I want to use AES256, SHA2-512, increase the iterations to 100k and increase the salt to 256bits. Can I use dmcrypt to change ...
3
votes
1answer
414 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
4
votes
1answer
362 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
0
votes
1answer
942 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
3
votes
2answers
79 views

Is signing android apk file with SHA1 digest secure enough?

Google command line example for signing apk files: $ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name source: ...
1
vote
1answer
37 views

Writing payload into android device listening for adb debug messages

On msfconsole, if I type info exploit/android/adb/adb_server_exec I got on description part the following: Writes and spawns a native payload on an android device that is listening for adb ...
2
votes
2answers
194 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
6
votes
7answers
4k views

Can smartphone spyware work even if there is no data connection?

I am using an Android phone. Is it possible for spyware to transmit data even when I don't have any internet plan/connection? Can it use some other way, say, cellular network etc.? EDIT1: SMS and ...
-1
votes
1answer
56 views

Is it reckless to use an Android app to login to a server with SSH?

There is a very similar question here. Recently I came across an Android app that facilitates SSH and requires no permissions. Specifically, "Telnet / SSH Simple Client" by Advanced Planning Corp.. ...
6
votes
1answer
103 views

Triangulate a mac adress

Last Sunday my iMac was stolen by a burglar. On Monday it showed up on 'find my mac'. Good police work and a lot of luck ended up in me retrieving my device that was on a location more than 50 meter ...
0
votes
0answers
19 views

Selling Android phone [duplicate]

I am selling my phone with Android and I am looking for a way how to ERASE everything without a chance for recovery (without hammering :D). I came across several articles that states we should encrypt ...
-2
votes
1answer
59 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
1
vote
2answers
85 views

encrypting data while in memory

What is the best way to protect sensitive text input and store it in memory until form submission is complete and then clear it out shortly thereafter? I'm looking to protect sensitive information ...
4
votes
0answers
71 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...