Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.
1
vote
1answer
33 views
Starting point for Mobile Device Security particularly in a MDM setting?
I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
2
votes
5answers
187 views
How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?
Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a ...
3
votes
1answer
77 views
What is the difference between Serial and Thumbprint
I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is.
the MSDN says:
Serial number A number that uniquely identifies the ...
1
vote
1answer
64 views
Android soft keyboard architecture
I am new to Android. I am trying to figure out how exactly a soft keyboard on an Android device works. What exactly is the 'behind the scenes' process that takes place so that the application is ...
-4
votes
0answers
56 views
Trusteer Mobile Security SDK [closed]
I have been looking for some information on mobile security, especially about a specific solution provider by the name Trusteer.
In their small introductory article on mobile security they mention:
...
2
votes
3answers
221 views
How secure is wiping an encrypted Android device?
based on my previous knowledge, I know that the iPhone has hardware encryption implemented on recent models. When we issue the "Erase all contents and settings" command, the encryption keys are ...
2
votes
2answers
1k views
Android Apps accessing DNS settings?
I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
10
votes
3answers
3k views
Can Android phone running without SIM card be tracked (localized) by police?
I am running an Android phone without a SIM card. I am using it for web surfing.
Can the police localize my phone using the cell towers (BTS)?
In other words, I know Android phones emit radiations ...
7
votes
3answers
1k views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
-1
votes
1answer
68 views
how malware is added to android app [closed]
I'm working on securing apps from malware attack in project. I just want to know how app is repackaged with malware. Because for reverse engg. we've apktool, dex2jar, Java decompiler. But how ...
3
votes
3answers
213 views
Strong encryption for base64 encoded public key in Android
I want to know how I can achieve strong encryption of a public key present in my Android application.
It's Android's advice that
To keep your public key safe from malicious users and hackers, do ...
7
votes
1answer
289 views
How do anti-virus apps for Android work?
There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
3
votes
2answers
364 views
OS Fingerprinting for Android
Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
2
votes
2answers
94 views
Android shared library integrity protection
Is there a way to somehow 'protect' a native shared library (.so) for the Android platform against binary changing? E.g. someone could overwrite a JMP instruction with a NOP after reverse engineering ...
2
votes
2answers
101 views
Is it possible to get data out of running application from non-rooted phone
I'am writing some small security report about Android devices in general related to accessing information from RAM. Main condition is that device initially is non-rooted.
Use case: User opens ...
3
votes
2answers
205 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
1
vote
2answers
3k views
Recovering encrypted SD card after Android Factory Reset
I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card.
Phone did a factory resync and now data on SD card is still encrypted.
Is there a way ...
2
votes
5answers
4k views
Nexus 7 (Or any other good android tablets) For pen testing
I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
1
vote
3answers
548 views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
1
vote
1answer
201 views
Google Cloud Messaging Spoof
I have few question on security of Google Cloud Messaging Service (GCM)
Is it possible to spoof messages that GCM server sends to android
clients?
Does server pushes data in encrypted format?
Data ...
3
votes
1answer
206 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
5
votes
1answer
721 views
Android / CyanogenMod encryption vs GNU/Linux
Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt.
Here is what I understand: Encrypted LVM on GNU/Linux is an ...
1
vote
2answers
163 views
Strange android app âĤ possibly a mass malware?
I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
2answers
3k views
How mobile app WiFiKill can cut off internet access to neighbor devices?
There is a program for android- WifiKill which disables wifi internet access of some neighbor peers connected to the same wifi AP. How does this program work? ARP poisoning or some other techniques? ...
9
votes
1answer
431 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
0
votes
2answers
412 views
Can wifi administrator see data transfer over android phone. precisely gmail app communication
sometimes I connect to wifi outside my home in office , restaurants and friends house. I want to know if wifi administrator can see the exact data my android phone communicates?
I am only concerned ...
5
votes
2answers
130 views
How much should I care about the iOS/Android version when pentesting mobile app?
Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?
I.e. if I test mobile application ...
1
vote
1answer
426 views
Android apk malware
I was browsing some website last night and that website suddenly sent me an apk called 'browser_update_install.apk', DrWeb light detect it and was able to delete it.
My question here is about the apk ...
10
votes
5answers
2k views
Keyloggers on Smartphones?
I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
-3
votes
1answer
177 views
How to use phone's Wifi tethering to demonstrate security vulnerabilities on phones [closed]
I am teaching a course to highschool students about computers, and I wanted to do something different for tomorrow class. I was thinking to teach them about wifi security vulnerabilities through a ...
1
vote
3answers
245 views
Sending secure information from app with ssl
I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
4
votes
3answers
209 views
Are there any known botnets targetting smartphones?
Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled?
What are they used for?
7
votes
1answer
997 views
Android Device Encryption
I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
2
votes
1answer
148 views
Data remanence on mobile devices
The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD.
Given ...
4
votes
2answers
373 views
How to secure usb data storage of Android phones?
I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable?
It's actually very easy to ...
3
votes
2answers
117 views
Suspicious phone browser activity
On a droid Razr M, I used chrome to log in to Gmail instead of the app. It asked to log in as me on a toast at the bottom of the browser, taking my credentials from somewhere on the phone I assume. ...
2
votes
2answers
268 views
Best way to secure Wi-Fi Direct connection
I have setup WiFi Direct connection between two Android devices by using Wi-Fi Protected Setup (WPS) "push button" for authentication.I also want to secure the connection itself by securing the data ...
2
votes
2answers
226 views
Test Android Secure Encrypted Traffic
For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
4answers
1k views
Track lost Android phone, if the thief is using it to access internet
I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software.
But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
1
vote
3answers
112 views
Is possible to know if increased marketshare means more viruses?
I'm having an argument with other developers about why more "viruses" exist (including all forms of external attacks, exploits, etc) in Android vs iOS. Like with Windows vs *nix, the main idea is that ...
1
vote
1answer
103 views
how to protect from Network scanner on android?
How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot.
My question is:
which scanners they use?
how can i detect such scanners?
Can i protect ...
12
votes
3answers
259 views
Android security without updates
I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
6
votes
1answer
290 views
Android and AES side channel attacks
I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
2
votes
1answer
279 views
Are Web Views in android secure?
"Web Views" are views that display some online content, usually a webpage within an android app.
Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
-1
votes
2answers
734 views
Is there a linux laptop equivalent to dsploit for android? [closed]
Is there a linux laptop equivalent to dsploit for android?
I am particulary refering to it's MITM functionality.
5
votes
1answer
245 views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
4
votes
1answer
820 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
0
votes
0answers
97 views
Which software is used to perform security tests on Android apps? [closed]
I want to replicate the security tests that researchers perform on Android applications (game, business, ...) for a homework project.
Can you help me with some documentation? or help me with some ...
2
votes
1answer
434 views
Android Application penetration testing
Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
1
vote
1answer
157 views
Pre boot authentication for Android phones
is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
