Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

6
votes
2answers
118 views
+50

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
0
votes
2answers
183 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
3
votes
1answer
46 views

Does changing my password after OAuth login in mobile app help reduce risk?

When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and ...
2
votes
1answer
161 views

How can I intercept XMPP traffic on Android?

I have been learning about security testing on Android apps, and to intercept traffic I was using Burp Suite. I know it works perfectly for HTTP/HTTPS traffic, but most of the messenger apps are using ...
1
vote
1answer
76 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
1
vote
1answer
101 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
1
vote
1answer
528 views

Forensic analysis of Android sqlite db's

In an extraction of com.facebook.katana/Database db files (fb.db and webview.db), I get: [fb.db] If I use an hexadecimal editor to open those files, even when there is no sqlite record named c_user, ...
0
votes
1answer
41 views

If hackers know my android app license key , can they redirect the in app purchases of my app to their account?

I have published an android app with in app purchase. I failed to encrypt XOR my licence key. If hackers have my license key can they redirect my payments to their account or just they can by pass in ...
0
votes
1answer
166 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
-1
votes
1answer
9 views

Overflows and Android?

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...
-1
votes
1answer
158 views

Android phone (Kitkat) list A LOTS of CA under setting->security->Trusted credential,

My Android phone (Kitkat) list a LOTS of CA under setting->security->Trusted credential, does it mean that anyone who has accessed to anyone of those private keys of those CA(s) can monitor or do "Man ...
2
votes
0answers
41 views

Exploitation of Reflected XSS on Android App

I am trying to do a security evaluation of an android application. I came across a situation where one of the activities of the app displays certain form fields in a webview. This form is very ...
1
vote
0answers
10 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
1
vote
0answers
140 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
1
vote
0answers
35 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
1
vote
0answers
96 views

VPN Server + Anonymity + Adblock for mobile Devices

In order to improve private security and anonymity while browsing the web on my mobile devices I wanted to tunnel all traffic to my own server via VPN and use a proxy software to filter unwanted ...
1
vote
0answers
82 views

Android app downgrading TLS protocol to SSL 3.0

I performed vulnerability testing of some Android mobile applications I helped develop and I noticed some odd behavior. The applications used the default Android 5.0.2 cipher suite list that includes ...
1
vote
0answers
49 views

Android 5 encryption

There's been lots of talk about the allegedly improved encryption in Android 5. Some questions about this: What is the maximum length for passphrases? (i.e. is it still limited to 16 characters?) ...
1
vote
0answers
86 views

Force TLS on mobile app

i'm developing a mobile application for iOS and Android. On this app i'm asking resources on a secure server through ajax. Server's developers asked me to force the call in order that we use TLS ...
1
vote
0answers
444 views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
1
vote
0answers
33 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
1
vote
0answers
79 views

Does BlueBox “Fake ID” vulnerability break protectionLevel: “Signature”?

Referring to this vuln: http://bluebox.com/technical/android-fake-id-vulnerability/ and this permission: http://developer.android.com/guide/topics/manifest/permission-element.html "signature" ...
1
vote
0answers
108 views

Is a android app signing certificate unique?

The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on ...
1
vote
0answers
152 views

Implementation of different BCrypt versions

I'm fairly new to encryption, and I am investigating the different kind of encryptions. I want to encrypt passwords in a secure way. I discussed this with my colleague, and he said that BCrypt is the ...
1
vote
0answers
332 views

Configure Asterisk for lan with SRTP enabled SipDroid

I want to have a secured call over internet between two android phones. I have found SipDroid which is an open source SIP client for Android. And also I have followed this to install Asterisk, Dahdi ...
0
votes
0answers
17 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
0
votes
0answers
43 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
0answers
26 views

What other methods can be utilized to carry out DoS attacks within Android?

So far I have discovered 2 methods of carrying DoS attacks within Android: The first being, inputting unexpected test data as function parameters e.g. : if a function was expecting a positive ...
0
votes
0answers
290 views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
0
votes
0answers
201 views

sending data from android client to database

I have created an android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID) the problem is I that i send the data from ...
0
votes
0answers
53 views

Silent security on android

I saw a DEFCON talk about owning back a stolen PC/Mac, with a SSHd daemon and a dynamic-ip service installed,running in background. I was wondering if is it possible to achieve tha same results on an ...