Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

-3
votes
0answers
24 views

How to perform penetration testing on android app? [duplicate]

I have an Apk file. I need to perform penetration testing on that app. Which are the tools required and how to perform? Please help me out here. It's very critical to me. I have already performed pen ...
1
vote
1answer
101 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
3
votes
1answer
49 views

Is it unsafe to restore backed up data from Google servers?

I have an Android smartphone that I don't trust. It has an old version of Android and has been vulnerable to Stagefright and a host of a hundred other vulnerabilities for months. Although there is no ...
15
votes
5answers
3k views

Tools to help test the security of Android applications [closed]

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
-1
votes
0answers
19 views

CSploit/Zanti - MITM takes 4 minutes - is it normal? [on hold]

Working on a school project for network security and I wanted to demonstrate a MITM attack from my mobile Android device. I currently have been working with Csploit and Zanti2 on a roooted Ellipsis 7. ...
60
votes
4answers
6k views

How can common users defend against the StageFright vulnerability?

I was just informed of the StageFright vulnerability in Android devices. A specially crafted MMS message can gain access to data on the phone; so presumably it's a buffer overflow with subsequent ...
1
vote
1answer
43 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
1
vote
1answer
266 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
6
votes
3answers
762 views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
4
votes
1answer
310 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
0
votes
0answers
19 views

Attack on Android phones [closed]

In the Metasploit attack on Android, the exploit requires the victim to install a malicious app which they have to open. The app then creates an open session which helps us to sniff data. My question ...
0
votes
0answers
22 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
2
votes
1answer
79 views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
5
votes
2answers
84 views

Security implications of android rooting

I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed. My question is double: ...
0
votes
1answer
55 views

How to prevent hotlinking on binary content served through PHP?

I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading. I therefore ...
0
votes
2answers
981 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
1
vote
1answer
25 views

Given certain parameters, are there any risks with Android's USB Debugging?

Assuming: You control access to an Android device You never connect that Android device to a malware-infected system via a USB cable Are there any risks with keeping USB Debugging always enabled ...
3
votes
2answers
142 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
0
votes
0answers
16 views

Should I trust on Airpush and give IMEI? [duplicate]

For opting-out from air-push adds on android I can request to Airpush. Visit the relevant post: Is this red star icon malware? How to get rid of it? Is there a reliable way to detect the app ...
3
votes
2answers
143 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
2answers
100 views

Secure Android app development [closed]

I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data. What security precautions should be ...
9
votes
2answers
119 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
2
votes
1answer
731 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
0
votes
1answer
47 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
4
votes
1answer
62 views

How to effectively detect a rooted device on Android?

Nowadays for detecting a rooted device, some applications perform static checks such as for example the case of GoogleWallet ...
3
votes
0answers
38 views

Is it possible to perform encrypted telephonic calls in Android? [closed]

When I say that I need to perform encrypted telephonic calls to another person then please understand that I do not want an encrypted VoIP call which is routed over the internet. What I want to ...
2
votes
1answer
32 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: (1) Public Web Server hosts basic content for general public. (2) Private server inside a VPN hosts special subscriber content and services. The two ...
4
votes
3answers
2k views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
1
vote
0answers
18 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
0
votes
0answers
48 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
5
votes
2answers
136 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
0
votes
0answers
5 views

Can SEAndroid policies be updated for an existing OS build? [migrated]

Can a policy be added to SEAndroid for an existing build? Or can policies only be set at OS build time?
0
votes
0answers
22 views

Is there any Netcat like application available in Android OS by default, like most of the Linux systems? [migrated]

In most Linux systems Netcat is installed by default. Is any Netcat-like application installed by default in Android OS?
0
votes
0answers
16 views

Is it possible to write an SEAndroid permission that enables only one app (subject) to access a device (object)?

We're interested in writing an SELinux policy for an Android build that enables a device (e.g. /dev/target) to be accessed by a single app and only that app. The app is a user-space app that's ...
3
votes
3answers
82 views

Can a virus spread between two Android devices logged into the same Google account?

It seems like I have a virus on my android tablet. I have had my tablet for 2.5 years (virus problems for almost 5 months). I am thinking about buying a new phone (Android) in the near future (I ...
9
votes
3answers
15k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
7
votes
1answer
200 views

Directory traversal sample code

I'm studying 'Directory traversal' attack in Android applications using this link I understand the concept behind the vulnerability that the input needs to be sanitized properly before opening any ...
6
votes
1answer
155 views

Is rooting an Android phone to install an anti-virus firewall worth it?

Some Android anti-virus offer a firewall like Avast or Comodo anti-virus but you need to have a root access to use them. However rooting an Adroid phone is often presented as a security risk. So: ...
2
votes
0answers
60 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
2answers
252 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
5
votes
1answer
157 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
3
votes
2answers
160 views

Is android's FDE secure from offline attacks?

Android provides FDE, but it uses lockscreen pin, which is (at least in my case) fairly weak (like a 4-digit PIN). Does it mean that my FDE could be easily broken by offline attack? Or maybe master ...
1
vote
0answers
40 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
13
votes
4answers
1k views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
0
votes
2answers
52 views

Using VPN on Android, Necessity of Rooting

I have just gotten a new phone and would like to protect my privacy better than I have in the past. I have read about rooting and then installing OrWall, OrBot, and OrWeb. If I understood correctly, ...
8
votes
3answers
8k views

Memory dumping Android

I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or ...
3
votes
2answers
631 views

Sending data from Android client to database

I have created an Android app which sends data to a web service. Right now the user sends his test results (test id, test name, test time, and user ID). The problem is that I send the data from the ...
33
votes
2answers
25k views

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
2
votes
0answers
38 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
2
votes
1answer
71 views

Is it possible to extract and re-use the API of a mobile banking app [closed]

I am aware of the basic techniques used to reverse engineer and extract meaningful information in order to re-use an applications API. I am not fully adept with the advanced techniques however. Is ...