Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

51
votes
7answers
68k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
25
votes
3answers
3k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
21
votes
2answers
1k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
17
votes
2answers
35k views

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations ...
17
votes
1answer
7k views

What is the difference between Serial Number and Thumbprint?

I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is. the MSDN says: Serial number A number that uniquely identifies the ...
14
votes
4answers
3k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
14
votes
5answers
2k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
14
votes
3answers
402 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
13
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
11
votes
3answers
6k views

Shellshock Bash bug on mobile systems

Does the bug in Bash affect Android or iOS mobile systems?
11
votes
4answers
2k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
11
votes
1answer
3k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
11
votes
1answer
158 views

Android Device Support Lifecycles

A key consideration for most computer platforms is the availability of security patches for vulnerabilities which inevitably arise with them. Are there any available resources which provide ...
10
votes
3answers
3k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
10
votes
3answers
4k views

Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?

I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
10
votes
2answers
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
10
votes
1answer
103 views

Why does Android mix phone state with phone identity?

The "Phone State" permission on Android is widely requested by many apps. The explanation often given by the developer is that the app needs it in order to determine when you're on the phone, to stop ...
10
votes
1answer
265 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
9
votes
8answers
6k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
9
votes
4answers
9k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
9
votes
1answer
38k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
9
votes
4answers
5k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
9
votes
1answer
2k views

How to properly delete all data from cell phones?

Lately I've been thinking to get rid of some old smartphones; among them an Android device and a Blackberry. Not selling or recycling them is the ideal solution, however, I still would like to know ...
9
votes
2answers
151 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
8
votes
2answers
2k views

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down ...
8
votes
2answers
1k views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
8
votes
2answers
2k views

3DES vs DES for VPN connections

I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption. Is it safe to use DES, am I going to get hacked if I ...
8
votes
1answer
3k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
8
votes
1answer
1k views

How should I protect in-app Android payments when using a separate server?

I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for. I have a simple application to view server-generated content. I want to allow the user ...
8
votes
3answers
6k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
8
votes
1answer
4k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
7
votes
5answers
4k views

Best practice to encrypt data in an Android application

I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
7
votes
3answers
1k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
7
votes
1answer
1k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
7
votes
2answers
375 views

Is there a way to notify me when my Android phone connects to an unencrypted GSM network?

As far as I know when a phone connects to a GSM (2G or 3G) network, the connection is encrypted. When I get in range of let's say an IMSI Catcher, I imagine this connection will not be encrypted in ...
7
votes
2answers
2k views

How do I protect my Gmail account when accessing it via an Android smartphone?

I have a Gmail account that I also access via an Android smartphone. The mail account could be used to reset passwords for other online accounts, so I want to tighten up the security around this ...
6
votes
3answers
3k views

Strong encryption for base64 encoded public key in Android

I want to know how I can achieve strong encryption of a public key present in my Android application. It's Android's advice that To keep your public key safe from malicious users and hackers, do ...
6
votes
1answer
1k views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
6
votes
2answers
2k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
6
votes
4answers
653 views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
6
votes
1answer
641 views

Android and AES side channel attacks

I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
6
votes
2answers
641 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
5
votes
6answers
2k views

Can smartphone spyware work even if there is no data connection?

I am using android phone. Is it possible for spywares to transmit data even when I dont have any internet plan/connection ? Can it use some other way , say , cellular network etc ? EDIT1: SMS and ...
5
votes
2answers
182 views

How much should I care about the iOS/Android version when pentesting mobile app?

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application? I.e. if I test mobile application ...
5
votes
1answer
4k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
5
votes
3answers
10k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
5
votes
2answers
449 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...