Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

0
votes
3answers
76 views

Locating a stolen device

Yesterday my friends Samsung Galaxy S3 was stolen. We have found the perpetrator but cannot yet prove anything. He is uploading photos to social media via the phone. Is there any chance to download ...
0
votes
1answer
52 views

Shared Memory expolit in smartphone OS

Today there is news about smartphone OS (Android, Windows and iOS) security hole using which some researchers have found a way to literally read all user activity from mobile screen. This is one of ...
2
votes
1answer
43 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
6
votes
4answers
387 views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
2
votes
5answers
141 views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
1
vote
1answer
99 views

Can virus save to SIM Card?

(Before everything excuse me because of me English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that ...
2
votes
1answer
109 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
0
votes
2answers
32 views

Entering payment information in Android Apps

I'm concerned how android apps that integrate payment processing deal with secure financial information.When purchasing through these apps the apps show the Webpage of the bank asking for credentials. ...
0
votes
1answer
27 views

Charge only in Android

In older versions of Android, when connected via USB the default behaviour was "Charge Only". This allowed the device to charge via USB without exposing its file system to the device providing power, ...
0
votes
1answer
58 views

How to stop gmail spam after connecting to public wifi without VPN on Android?

About two weeks ago, I had to reply to an urgent email (gmail) on my Android phone with the Gmail app. Unfortunately, my VPN client refused to work that day (Private Internet Access Android Client), ...
5
votes
1answer
46 views

To what extent can Google access data in the standard Android storage locations without restriction?

Android docs lists a number of places to store data here. To what extent can Google access data in these places assuming the developer does not want them to have it? In other words, if I save a ...
-1
votes
2answers
90 views

Why no one makes a message application like whatsapp using RSA keys?

I'm really new and I may sound like a noob so please forgive me. Since gnupg is avaible for android, why does no one makes an app that encrypts every message using a rsa key and just swap the keys ...
1
vote
0answers
54 views

Does BlueBox “Fake ID” vulnerability break protectionLevel: “Signature”?

Referring to this vuln: http://bluebox.com/technical/android-fake-id-vulnerability/ and this permission: http://developer.android.com/guide/topics/manifest/permission-element.html "signature" ...
4
votes
0answers
135 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
3
votes
1answer
707 views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
7
votes
2answers
314 views

Is there a way to notify me when my Android phone connects to an unencrypted GSM network?

As far as I know when a phone connects to a GSM (2G or 3G) network, the connection is encrypted. When I get in range of let's say an IMSI Catcher, I imagine this connection will not be encrypted in ...
0
votes
2answers
319 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
5
votes
2answers
398 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
0
votes
1answer
45 views

What is the strategy used by the itunes store and Google Play to protect and securely install applications on eligible devices?

The requirements for a system like itunes store or google play are as follows; identify and authenticate the user determine if the user has paid for a given app if s/he has, securely transmit the ...
2
votes
3answers
123 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
0
votes
3answers
694 views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
1
vote
2answers
110 views

Storing SSH private keys on an Android device

(I'm not sure if this better belongs on unix.se or android.se, but since it's primarily security-related, I'm asking it here) I use my Android device to access servers for quick on-the-go ...
0
votes
1answer
145 views

copy protection (or licensing) mechanism for an android app

I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through ...
2
votes
3answers
177 views

(Android) hacking server by a simple socket

I have written an Android game. Now, I want to connect the marks of the players. The code below is the client side program, which send their names, countries and marks to the server. Basically, I use ...
3
votes
1answer
145 views

Is Google API Key a sensitive information that needs to be protected?

I'm making use of google API for location (in Android, iOS apps).. Can the key be hardcoded? Or should it be protected? If It's sensitive, why is it sensitive and how can attackers exploit this?
0
votes
1answer
82 views

Memory dumping Android

I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or ...
0
votes
0answers
59 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
2
votes
3answers
13k views

Recovering encrypted SD card after Android Factory Reset

I was using Active Sync on my Android Galaxy S2 and as a result it enforced encryption of the phone and SD card. Phone did a factory resync and now data on SD card is still encrypted. Is there a way ...
4
votes
1answer
1k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is ...
0
votes
1answer
64 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
-3
votes
1answer
47 views

Does using a non Nexus/Google Play Editon Android device have a higher security risk? [closed]

The fact that carriers deploy the latest security updates to Android devices much later than Google does to Google Play Edition and Nexus devices, should we avoid using those devices altogether?
1
vote
1answer
83 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...
1
vote
1answer
48 views

Where do I get “Mercury” by MWR InfoSecurity? [closed]

Mercury is a really great tool for android pen-testing as well as android forensics. However, they stopped its development and now I get redirected to some product called drozer. Does anyone know ...
0
votes
2answers
159 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
2
votes
4answers
296 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
4
votes
3answers
107 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
0
votes
2answers
358 views

“A third party is capable of monitoring your network activity” with client certificates?

I installed the CAcert root certificates on my Android device (not rooted), so that I could visit websites with server CAcert certificates without getting the "certificate not trusted" warning. But ...
0
votes
0answers
215 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
13
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
1
vote
0answers
63 views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps? [closed]

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
1
vote
1answer
84 views

Obfuscation and Mobile App

Recently, I stumbled with this topic in my mind for few days. I understand that obfuscation is not the best protection against reverse engineering. I wonder if there is another method that make it ...
0
votes
1answer
97 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...
4
votes
1answer
78 views

Decline any custom ssl certificate in a mobile application

Consider the following scenario. Eve creates an access point in a public place. Alice connects to the AP via mobile phone and starts browsing the Web. Eve redirects Alice to a registration page and ...
2
votes
1answer
1k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
2
votes
1answer
105 views

MITM SSL connection

I read this article today about an SSL MITM. I am trying to understand this attack. This may be a naive question. My understanding is that the WebView sends a request to domain name, the server ...
9
votes
8answers
6k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
6
votes
1answer
427 views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
1
vote
1answer
111 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
0
votes
1answer
698 views

What happens if you run out of password attempts?

In Samsung Knox, you have 20 password attempts. However, it is never explained what happens if you run out of attempts. Does it delete your Knox data, do you need to enter the recovery PIN or is it ...