Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

3
votes
2answers
160 views
+50

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
0
votes
1answer
56 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
6
votes
7answers
6k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
0
votes
0answers
49 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
5
votes
2answers
2k views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
9
votes
2answers
697 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
2
votes
3answers
55 views

Bypass app permissions

I'm annoyed and actually scared by all the permissions that I have to grant the applications that is running on my Android phone. Is there is a way to bypass them ? Let's say my microphone. My ...
0
votes
0answers
28 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
-1
votes
0answers
34 views

Popup ads in Android app [on hold]

I made an Android application and one of my user is complaining that he is seeing the pop-up ads with in my Android application. Could you help me how to track down what is causing this? As this is ...
0
votes
0answers
17 views

Is Android WLAN MAC Address vulnerable? [duplicate]

What can a person do if he/she has WLAN MAC Address of my Android Device? What can be done to save my personal information?
5
votes
2answers
74 views

Factory reset on a smartphone

On resetting a smartphone, the default factory image replaces the OS completely and restores it to known good settings. Is there any known way by which this default image can be compromised? On ...
3
votes
1answer
122 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
0
votes
0answers
26 views

Does anybody recognize the files below that are in my tablet and cell phone? [on hold]

I have few strange files in my tablet and cell phone that comes back no matter what kind of "cleaning" I have done Does anybody regognize these files? What could they be? ...
59
votes
4answers
5k views

How can common users defend against the StageFright vulnerability?

I was just informed of the StageFright vulnerability in Android devices. A specially crafted MMS message can gain access to data on the phone; so presumably it's a buffer overflow with subsequent ...
-5
votes
0answers
76 views

Hacked constantly and NEED HELP! (peace of mind is priceless) [closed]

I own a Samsung Galaxy S5 unlocked. I have had every problem you can imagine! I am not that computer savvy, as my boyfriend is! He has hacked my e-mails and as I dig deeper in to my phone and the ...
-1
votes
1answer
52 views

Security Operation Center and rooted Android device monitoring [closed]

I work for a research-oriented company as Security Operations Centre analyst. I was asked to define a procedure to be followed by level 1 analysts for monitoring users who are testing rooted Android ...
0
votes
0answers
36 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advert, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. This is ...
48
votes
2answers
8k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
-2
votes
0answers
57 views

implementing a secure client-server system

I am creating an Android app that communicates with a server. I need a safe way to transmit sensitive data so this is what I planed to do: Use ssl pinned to the app, so the app knows the server. Use ...
2
votes
1answer
326 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
2
votes
1answer
107 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
2
votes
3answers
761 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
5
votes
1answer
49 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
0
votes
1answer
51 views

Is it safe to check if device is subject to Stagefright bug? [closed]

Is it safe to check if device is subject to Stagefright bug, for example with: Stagefright Detector App forAndroid by Zimperium ? Is such (or similar test) sufficient? Is there available any 3rd ...
3
votes
1answer
267 views

How can I intercept XMPP traffic on Android? [closed]

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using ...
1
vote
2answers
43 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
-1
votes
0answers
13 views

How to run malloDroid script? [migrated]

I want to check SSL verification in my application. I downloaded on my santoku malloDroid.py and try use it (of course earlier I have read that script is an extansion of Androguard). I simply run ...
2
votes
1answer
606 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
7
votes
2answers
72 views

Why does Android use SELinux?

To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them ...
11
votes
2answers
888 views

Android built-in security for apps?

Whenever you go to Google's Play Store and install an app, a list of all the necessary access is shown and a confirmation to proceed with the installation is required. Let's imagine I would like to ...
1
vote
1answer
161 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
0
votes
0answers
4 views

Connecting Android to Windows VPN [migrated]

I have set up a VPN on my Windows 10 computer by going into Control Panel\Network and Internet\Network Connections and hitting Alt and then going to File > New Incoming Connection... and setting up ...
0
votes
3answers
277 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
-3
votes
0answers
43 views

Fake Access Point, Victim gets “Connection Refused” [closed]

I'm kinda having some problem with a Fake AP I have, it was working just fine but when I was trying a new script my dhcpd broke and I had to reinstall it and just out of the blue when every an android ...
3
votes
1answer
54 views

Can malware spread via bluetooth file transfer in Android?

I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ? If so, does it need ...
2
votes
1answer
228 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
11
votes
2answers
254 views

“Encrypt and wipe” procedure on Android Lollipop?

I know a lot of people are advocating an "encrypt and wipe" procedure for selling used Android phones. But according to the AOSP website, in Android 5.x Lollipop: Created fast encryption, which ...
2
votes
1answer
69 views

How to determine if it is safe to install apk files from alternative android app stores?

Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
1
vote
1answer
131 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
2answers
102 views

Difference between Art And Dalvik Security on android?

What is the different between ART And Dalvik security, cause Google using Art after Kitkat (4.4.2) ? Just for these two options? Refrence Ahead-of-Time (AOT) compilation, which improves speed ...
1
vote
3answers
75 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
2
votes
0answers
63 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
3
votes
2answers
83 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
2
votes
0answers
89 views

How does an android device/os prevent me from getting root?

I have never used an android phone and so hopefully this is not a bad question to ask. I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I ...
-2
votes
1answer
44 views

Attack on Androids Encryption called FROST

http://www.extremetech.com/computing/150536-how-to-bypass-an-android-smartphones-encryption-and-security-put-it-in-the-freezer I read this article about FROST and in the comments someone was stating ...
2
votes
0answers
36 views

Risks when connecting Public WLAN networks [closed]

I want to refer with my question directly to a question posted on the forum before. wifi topic I am running teamviewer on my android which is not rooted and i am not using a firewall on it. I guess ...
2
votes
1answer
62 views

Encryption of settings/credentials in mobile apps - what threats does this protect against?

I have been decompiling Android apps recently. In a sample of 37 apps, 12 of these use some form of custom encryption/obfuscation to store settings and credentials on the device. By necessity, the ...
1
vote
1answer
104 views

What should I do when I found a strange email on my phone?

Today I found a strange email (not sended, just a draft) on my android smartphone, and this is not good. The screen was on standby and when I pressed the on/off button to see the clock, I found a ...
1
vote
2answers
100 views

Could one fit a root application in sim card

In the third Mr.Robot episode a character inserted a Micro-SD card in a smartphone in order to root it and gain information, so I thought maybe someone could fit a root-kit on a Sim-card. Would that ...