Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

1
vote
1answer
28 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
2
votes
2answers
55 views

How secure is a MD5 hash of an 128bit key

Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key. How secure is that? MD5 is known to have collisions, but I guess we can assume with an ...
1
vote
1answer
66 views

encryption of Google's android apps

Does Google use encryption on it's Android apps like Gmail, drive, Google Play, docs, others in authentication and transit? What the type of encryption is it? Is it secure? I have tried searching ...
1
vote
1answer
68 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
0
votes
1answer
333 views

copy protection (or licensing) mechanism for an android app

I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through ...
5
votes
3answers
1k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
3
votes
1answer
93 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
11
votes
2answers
479 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
1
vote
1answer
363 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
2
votes
1answer
73 views

Offline phone security

How secure is an offline android phone? Some background. I want to use an app called Bither on android, which allows me to create a cold wallet on 1 phone and a hot wallet on another phone. Cold ...
-1
votes
0answers
36 views

secure communications on mobile platforms [migrated]

What means are there to securely message your friends on mobile devices? Specifically if you and your friends use different operating systems like android and iOS. Are there ways to have group ...
0
votes
1answer
37 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
3
votes
1answer
64 views

How does Android's security model differ from UNIX's?

In UNIX's security model, you log in as a user, and then every process you start can access everything that belongs to your user account - that is, the trust is based on the user account, not on the ...
1
vote
1answer
84 views

What are methods to protecting an android phone from law enforcement

From what I hear, android uses the standard linux dm-crypt for encryption. Obviously you should have: A pin/password for your phone That pin/password should at least be 8 characters The question ...
1
vote
2answers
172 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
0
votes
1answer
41 views

Rooted android cached password

Assume you could exploit a vulnerability on an old Android 2.2, the questions are: 1- Is there anyway you could see stored passwords on that operating system, specially Facebook password. 2- Can you ...
3
votes
5answers
2k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
9
votes
1answer
4k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
3
votes
2answers
140 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
2
votes
2answers
74 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
6
votes
1answer
716 views

Competitor app blocks our app, need a way to bypass their check [closed]

We have a taxi app which has been quite successful in Europe. But recently one of our competitors has started checking if our app is installed and if it is, theirs won't run until the user uninstalls ...
0
votes
2answers
154 views

Fake phone call

I have a problem, getting call from known numbers and when he lifts it, no one is speaking from other side! Well, the awkward part is, the call is from known numbers only, but if I ask the person ...
-4
votes
2answers
96 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
6
votes
2answers
814 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
1
vote
1answer
324 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
7
votes
2answers
2k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
4
votes
5answers
9k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
-4
votes
5answers
909 views

Google Calendar has events that I didn't create and it's not shared

This has been rewritten because at first I thought this may be an accident but now it’s clear there’s a security compromise. In my Google Calendar I noticed an event that occurred each day from ...
2
votes
1answer
140 views

Adding one's own Cryptography Implementaion in Android

Since Android allows for Java and Native implementation of Cryptography, I would like to know how to provide a particular implementation of cryptographic algorithms (say just RSA for example). What ...
11
votes
3answers
6k views

Shellshock Bash bug on mobile systems

Does the bug in Bash affect Android or iOS mobile systems?
1
vote
2answers
99 views

Unexpected emails have been sent - do I need to wipe my Android?

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large. I opened my Gmail App and found 5 messages in the Sent Mail folder ...
0
votes
1answer
86 views

Virus (or Trojan) in Android

Definition of virus is (from Wikipedia): A computer virus is a malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data ...
1
vote
0answers
21 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
7
votes
1answer
2k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
0
votes
1answer
262 views

Is it possible to hack an Android App or an Android device without being root? [closed]

Simple question, as the title said. I wondering if in an ideal world where rooting Android devices is not feasible mobile pen testing would be still possible or not. Most of the sensitive folders ...
3
votes
2answers
616 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
10
votes
2answers
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
9
votes
4answers
9k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
21
votes
2answers
1k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
2
votes
3answers
125 views

Why are apps signed?

From the Android website: Android requires that all apps be digitally signed with a certificate before they can be installed. The signature ensures that only the original developer can publish ...
8
votes
2answers
1k views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
1
vote
1answer
55 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
1
vote
1answer
45 views

Charge only in Android

In older versions of Android, when connected via USB the default behaviour was "Charge Only". This allowed the device to charge via USB without exposing its file system to the device providing power, ...
5
votes
1answer
3k views

Android / CyanogenMod encryption vs GNU/Linux

Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt. Here is what I understand: Encrypted LVM on GNU/Linux is an ...
0
votes
1answer
82 views

Secure communication End-to-end with android and Server

I´m building a enterprise application and I need to create a secure communication between android and a server. What is the most secure way to do End-to-End communication? Should I use HTTPS or VPN? ...
0
votes
3answers
85 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
0
votes
1answer
87 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
6
votes
4answers
1k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
2
votes
5answers
454 views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...