Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

5
votes
1answer
120 views

How To Bypass SSL pinning In SPDY protocol?

I have been trying for almost a month to intercept the traffic of an android app the uses SSL pinning. I used Android-SSL-TrustKiller and SSLUnpinning but it did not work.I also decompiled the app and ...
4
votes
1answer
361 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
2
votes
1answer
47 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
2
votes
1answer
51 views

Android security document comparable to Apple's security document?

Is there an Android security document comparable to Apple's Security Document (PDF)? Does such a comprehensive document not apply because Android is only the OS and Apple makes the hardware and the ...
2
votes
1answer
43 views

Server side Client VPN management?

Is this possible, and how? Here's the scenario: (1) Public Web Server hosts basic content for general public. (2) Private server inside a VPN hosts special subscriber content and services. The two ...
2
votes
1answer
261 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
2
votes
1answer
799 views

Forensic analysis of Android SQLite DBs

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: fb.db If I use an hexadecimal editor to open those files, even when there is no SQLite record named c_user, ...
4
votes
0answers
70 views

Are Android Snapdragon Vulnerabilities a Real-World threat already?

The newly disclosed vulnerabilities CVE-2016-0819 and CVE-2016-0805 are based on vulnerable kernel or kernel-related code. These two vulnerabilities combined can lead to unintended root access. Did ...
3
votes
0answers
999 views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
2
votes
0answers
50 views

Attempting Android Stagefright on Virtual Software

Does anyone know how I can exploit an android vm using stagefright? I can't use the android AVK because it doesn't support MMS.
2
votes
0answers
103 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
2
votes
0answers
69 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
140 views

common crypto and bouncy castle, PBKDF2 generation

I am working on an iOS app and android app, for iOS I am using common crypto, and for android bouncy castle. I noticed that in android when I generate PBKDF2, if I use a salt or pass ...
1
vote
0answers
13 views

Charles Proxy: Genymotion with certificate pinning

Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
1
vote
0answers
21 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
1
vote
0answers
23 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
1
vote
0answers
18 views

Security implications of Android apps that require Accessibility access

Occasionally, an Android app will require access to Accessibility services. As an example, see App Hibernator. What are the security implications of allowing an app access to Android's Accessibility ...
1
vote
0answers
35 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
1
vote
0answers
37 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
1
vote
0answers
84 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
1
vote
0answers
65 views

What are the appropriate steps to take after installing a questionable Android app?

Situation: User installed an Android app from the Google Play Store. User's device is rooted, but that app does not have root privileges. XPrivacy reveals that the app is trying to make IPC ...
1
vote
0answers
28 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
1
vote
0answers
172 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
1
vote
0answers
539 views

CVE-2015-3864 - Android Stagefright - how Integer Overflow happens here?

I am trying to understand how "Integer Overflow" happens here and how it works. The vulnerability exists in the chunk of “tx3g”. Chunk_size is the unit which overflows the sum of size. That's to say, ...
1
vote
0answers
111 views

What is the point of signature file in signed JAR/ZIP files

The way JAR signatures (or ZIP for Android) are designed is that they have a manifest file, containing digest for each file in the archive. Then there is a "signature file" that contains digest of ...
1
vote
0answers
327 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted ...
1
vote
0answers
163 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
75 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
1
vote
0answers
986 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
167 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
0answers
55 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
1
vote
0answers
107 views

Does BlueBox “Fake ID” vulnerability break protectionLevel: “Signature”?

Referring to this vuln: http://bluebox.com/technical/android-fake-id-vulnerability/ and this permission: http://developer.android.com/guide/topics/manifest/permission-element.html "signature" ...
1
vote
0answers
149 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
1
vote
0answers
214 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
0
votes
0answers
17 views

Stagefright 2.0 - CVE-2015-3876 fix

Im currently studying Stagefright2.0 bugs. I'm wondering how the CVE-2015-3876 was fixed. I know it was caused by an integer overflow and the fix can be found here: ...
0
votes
0answers
32 views

Can I secure android device(root is an option) running Lollipop from public security holes like Stagefrigh?

I checked the device with VTS for Android and it got some publicly known security holes. Marshmallow is not an option. So is there any way to secure a device running Lollipop from Stagefright etc by ...
0
votes
0answers
76 views

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the ...
0
votes
0answers
2k views

Android vs iPhone encryption

I'm really curious to know what the technologies behind Android and iPhone are in regards to encryption. I know Android was supposed to go with encryption by default like iOS 8.0 and beyond and never ...
0
votes
0answers
128 views

Android Protection against Cellebrite UFED

I have been scavenging the Internet (meaning, primarily, XDA, Reddit, and security.stackexchange) for information on methods to keep Cellebrite UFED out of a phone. It is a mobile forensics tool that ...
0
votes
0answers
77 views

How does protection of code and applications work in Java?

I am not sure this kind of question is correct for this place, but I will ask as I can not find a better place to ask. I have started thinking about making money out of my own code and as such it is ...
0
votes
0answers
23 views

Is it possible to write an SEAndroid permission that enables only one app (subject) to access a device (object)?

We're interested in writing an SELinux policy for an Android build that enables a device (e.g. /dev/target) to be accessed by a single app and only that app. The app is a user-space app that's ...
0
votes
0answers
329 views

Tradeadexchange everywhere. On my mac, android and every browser

The tradeadexchange malware seems to have infected me in every possible way. It pops up new tabs whenever I am browsing on my Mac or Android devices, and also in any browser-Firefox/Chrome/.. ...
0
votes
0answers
55 views

Are Android Facebook OAuth tokens vulnerable to theft?

If I have access to someone's unlocked Android phone, is it possible to get hold of their OAuth token for Facebook and use it on another device?
0
votes
0answers
34 views

Encrypt links in android app

i just want to hide my server address links in my android app.During decompile my app,it is clearly showing the links.Even with the proguard enabled i cant able to hide links please suggest me some ...
0
votes
0answers
66 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
0
votes
0answers
62 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
0
votes
0answers
36 views

How to know which file is being sent in POST request by Android device?

I am using an Android Device. I make apps and generally use Burp Proxy to try to debug how my app's requests-response works. Recently I have noticed some anonymous request being sent by my device ...
0
votes
0answers
152 views

injecting javascript in webviews in Android

I am relatively new to mobile application security. Currently I am supposed to audit an android application which uses a webview to display some static FAQ page in an activity. The webview in ...
0
votes
0answers
70 views

Silent security on android

I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background. I was wondering if is it possible to achieve tha same results on an ...
-6
votes
0answers
100 views

Android default encryption settings

Does anyone know how to change the Android default encryption settings? I want to use AES256, SHA2-512, increase the iterations to 100k and increase the salt to 256bits. Can I use dmcrypt to change ...