Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

2
votes
1answer
76 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
0
votes
1answer
22 views

how to debug for DNS changing Maleware on (linux/android)?

So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I ...
1
vote
1answer
70 views

What is a root method and how is it achieved?

I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding? I know it's high privileges, but how can that not be enabled through a regular ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
18
votes
3answers
608 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
0
votes
0answers
40 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
-4
votes
0answers
14 views

How do provide the android sandbox security to application? [on hold]

I want to know what is android sandbox security and how implement it in application? I want to provide the internal security to application so no other application can check the memory status and ...
0
votes
0answers
44 views

Is it possible to figure out a password to a router using an Android phone? [closed]

I have heard that there is programs which cracks the password on wifi for you. Would it be possible to do this using a smartphone?I am not asking for a recommendation for an app, just asking if it ...
0
votes
0answers
51 views

Comparison of security of PDFs on different platforms (web browser/adobe/android/iOS/mac) [closed]

There have been quite a few exploits of PDFs. Patches do claim to fix these exploits but what are the chances that PDFs are still widely used today as an exploit vector via zero-days? Of course, the ...
3
votes
1answer
78 views

How to block BYOD users from installing malicious versions of a common app?

How does Mobile Device Management tools (MDMs) identify mobile apps in order to allow to install only whitelisted applications? First I though some kind of hash but because the APK changes in the ...
0
votes
2answers
38 views

Does a malware in an android phone have permission to read/modify/delete data of all the apps?

If an android phone is infected with malware/virus, can it access all the apps with modify/delete/read permission? Isn't there any control by an app , say a bank app which can't allow to read data by ...
2
votes
2answers
68 views

Why is it so easy to pirate apps for Android, considering most have an internet connection and access to phone details? [duplicate]

It seems so easy to pirate apps for Android it's as if no one even cares. It's as easy as google searching for the apk and then installing it. Isn't this surprising as some apps cost money? Wouldn't ...
16
votes
4answers
30k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
3
votes
1answer
875 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
0
votes
1answer
38 views

What kind of damage does the HummingBad Android malware do when it fails to gain root access?

There is this Android virus out there called HummingBad, and it seems the first thing it tries to do is try to get root access. There are so many device models out there, and the rooting process is ...
0
votes
1answer
36 views

Is it possible to deny Permission access and other Settings using Screen Overlay in Android?

I was noticing an app that doesn't need Camera access ever having camera access and other spy capable permission. When I tried to change the permssion there was a overlay text box saying something ...
0
votes
0answers
15 views

Security mitigation vis policy between Android watch and Android smartphone TEE

We are an e-store company and we have native apps for Android and iOS smartphones. We are building a new app for Android/Apple watch and enable authentication between the watch app and native app on ...
0
votes
0answers
27 views

How exactly does the HummingBad Android malware gain root access?

I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put ...
1
vote
1answer
69 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
3
votes
1answer
60 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: Public Web Server hosts basic content for general public. Private server inside a VPN hosts special subscriber content and services. The two servers ...
7
votes
2answers
13k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
2
votes
1answer
300 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
0
votes
1answer
36 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
3
votes
1answer
56 views

Why does the ProtonMail Android app require Identity permissions?

The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require ...
4
votes
1answer
73 views

Android security document comparable to Apple's security document?

Is there an Android security document comparable to Apple's Security Document (PDF)? Does such a comprehensive document not apply because Android is only the OS and Apple makes the hardware and the ...
11
votes
2answers
2k views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
4
votes
1answer
59 views

Android apps: required permissions reported before installing are misleading

I've noticed several Android apps that advertise different permission requirements than they actually get after they are installed. I'm on Android 5.0.2. To be more specific: I locate an app ...
6
votes
1answer
132 views

What excactly is encrypted by “full disk encryption” on Android 5?

This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and ...
5
votes
1answer
438 views

How does an android device/os prevent me from getting root?

I have never used an android phone and so hopefully this is not a bad question to ask. I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I ...
0
votes
2answers
138 views

Can websites send WhatsApp messages without my permission through the WhatsApp API?

I want to know if it is possible for websites to send messages through my WhatsApp without my permission. I read about the WhatsApp API, but I haven't done much PHP so it did not make much sense to me....
1
vote
1answer
29 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
5
votes
1answer
410 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
3
votes
2answers
130 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore have ...
0
votes
1answer
56 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
5
votes
1answer
148 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
5
votes
1answer
166 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
5
votes
3answers
92 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
2
votes
1answer
84 views

Android N - Security Crypto Provider is deprecated

As mentioned in "android developer's blog" , http://android-developers.blogspot.in/2016/06/security-crypto-provider-deprecated-in.html , security Crypto provider is deprecated on Android N. And also ...
0
votes
1answer
56 views

Why doesn't Google uninstall or report, installed pirated apps? [closed]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
7
votes
1answer
55 views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
1
vote
0answers
32 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
2
votes
2answers
51 views

Disclosing used Libaries in App

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it ...
1
vote
1answer
166 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
31
votes
7answers
4k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
0
votes
0answers
66 views

Pop up in Facebook built-in browser

While I was visiting a page on a usual website with the built-in browser of the Android Facebook app, a pop-up just... poped-up, saying dumb stuff about my cellphone being full of viruses, etc. (Quite ...
1
vote
1answer
1k views

Is there a foolproof method to remove spyware from Android smartphone?

I am owning an Android smartphone. I learnt that factory reset may not remove spyware as it might have corrupted the image being installed by factory reset. Is there a foolproof method which ensures ...
0
votes
1answer
80 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
-1
votes
2answers
71 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
49
votes
6answers
10k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
-1
votes
1answer
35 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...