Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.
26
votes
7answers
30k views
Are there actually any advantages to Android full-disk encryption?
So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
18
votes
3answers
783 views
Why do a lot of Android apps (like Linkedin) require many unrelated privileges?
I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data.
Why does any ...
15
votes
1answer
822 views
Security implications of rooting your android phone
My android smart phone has fancy features that I can get if and only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone has me ...
13
votes
5answers
2k views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
12
votes
5answers
1k views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
12
votes
3answers
262 views
Android security without updates
I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
11
votes
2answers
4k views
Can Android phone running without SIM card be tracked (localized) by police?
I am running an Android phone without a SIM card. I am using it for web surfing.
Can the police localize my phone using the cell towers (BTS)?
In other words, I know Android phones emit radiations ...
10
votes
4answers
2k views
What risk does Carrier IQ pose, exactly?
There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out.
My questions: What exactly does Carrier ...
10
votes
3answers
548 views
Tools to help test the security of Android applications
What are some decent frameworks to test the security of Android applications?
With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
10
votes
5answers
2k views
Keyloggers on Smartphones?
I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
9
votes
1answer
446 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
8
votes
3answers
2k views
Do my Android apps use TLS or other encryption when connected to public Wifi? How can I tell?
I have an Android phone. When it's connected only to my carrier's 3G network I imagine it's reasonably secure against eavesdropping (although not invulnerable). However, at times due to lack of ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
8
votes
1answer
301 views
How do anti-virus apps for Android work?
There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
7
votes
3answers
1k views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
7
votes
2answers
1k views
3DES vs DES for VPN connections
I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption.
Is it safe to use DES, am I going to get hacked if I ...
7
votes
1answer
1k views
How to select /dev/random or dev/urandom in the code in Android?
When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
7
votes
1answer
968 views
How should I protect in-app Android payments when using a separate server?
I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for.
I have a simple application to view server-generated content. I want to allow the user ...
7
votes
1answer
1k views
Android Device Encryption
I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
6
votes
5answers
2k views
Best practice to encrypt data in an Android application
I'm writing an application which recovers statistical data about a user. I'm still pondering about what would be the best way to encrypt the data. I haven't got any experience with mobile ...
6
votes
1answer
293 views
Android and AES side channel attacks
I am working on a project that will involve symmetric AES 128 bit encrypted communication between an Android application and a bluetooth device. Are there any public AES libraries available for ...
5
votes
2answers
133 views
How much should I care about the iOS/Android version when pentesting mobile app?
Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?
I.e. if I test mobile application ...
5
votes
2answers
303 views
How can I use nmap to distinguish between a normal linux machine and an android device?
According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
1answer
170 views
Android, how to protect in case of theft
What are some steps to take into account to protect an Android phone in case of theft?
Smartphones are everywhere now, before the market was dominated by Blackberry and Windows Mobile. These days ...
5
votes
1answer
250 views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
5
votes
1answer
745 views
Android / CyanogenMod encryption vs GNU/Linux
Hi I am trying to understand how encrypting an Android based phone works compared to a GNU/Linux host which relies on LUKS dm-crypt.
Here is what I understand: Encrypted LVM on GNU/Linux is an ...
4
votes
4answers
1k views
Track lost Android phone, if the thief is using it to access internet
I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software.
But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
4
votes
4answers
535 views
Explaining security vs. performace to a non-tech superior
I was tasked to implement some sort of password-based encoding/decoding in an android app by my non-tech SO. He also showed me this list of android security providers. Naturally, He chose the one with ...
4
votes
3answers
209 views
Are there any known botnets targetting smartphones?
Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled?
What are they used for?
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
4
votes
3answers
6k views
Which type of encryption algorithms android supports, and which would be better?
I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports.
Regarding DES and AES (As wiki documentation) ...
4
votes
1answer
836 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
4
votes
3answers
313 views
Android phone number from disk image
I'm trying to work out what the current phone number is for an Android device based solely off a disk image. I've looked in the mmssms.db and the contacts2.db but neither seem to store the details of ...
4
votes
1answer
191 views
How can I do a secure reinstallation on an android device?
I want to reinstall the rom on my android device. I like to assume that the system is infected when I do a reinstallation of any device, so if it was really infected and I haven't noticed, I'm on the ...
4
votes
2answers
384 views
How to secure usb data storage of Android phones?
I just found out that if I connect my phone to a laptop with a cable, the password becomes completely USELESS. So how can I protect the data in my phone from a usb cable?
It's actually very easy to ...
4
votes
1answer
436 views
Android for the Paranoid
In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
4
votes
1answer
940 views
How can I store downloaded video securely to device's sd card?
I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.
So for this what can I do? I think about ...
3
votes
3answers
223 views
Strong encryption for base64 encoded public key in Android
I want to know how I can achieve strong encryption of a public key present in my Android application.
It's Android's advice that
To keep your public key safe from malicious users and hackers, do ...
3
votes
2answers
209 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
1answer
215 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
3
votes
3answers
5k views
Is Android's Password Screen Lock Enough Data Theft Protection?
With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
3
votes
4answers
213 views
Strange android app … possibly a mass malware?
I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
3
votes
2answers
372 views
OS Fingerprinting for Android
Are traditional OS-fingerprinting techniques effective in identifying Android smartphones (OS version) on a network. From my research I found most Android network mappers can be only run from Android ...
3
votes
2answers
1k views
How to supply OpenSSL generated Private & Public Keys to iOS & Android apps?
The problem statement is:
To supply clients on a network with individual Private & Public keys generated on a Server over the wire(over a HTTPS connection after they are registered). The clients ...
3
votes
3answers
122 views
Best approach for making an app that connects to sensitive information
I'm gonna be writing an app that connects to a server with sensitive information and one of the main requirements is that only my app will be able to make the connection. There is no user supplied ...
3
votes
1answer
78 views
What is the difference between Serial and Thumbprint
I have problems to understand what the difference between the Serial Number of a certificate and its SHA1 Hash is.
the MSDN says:
Serial number A number that uniquely identifies the ...
3
votes
3answers
526 views
Android Pen Testing
I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.
I have set up a proxy and am able to intercept the traffic, however the POST method ...
3
votes
1answer
482 views
Which encryption algo should be best for an Android application [duplicate]
Possible Duplicate:
Which type of encryption algorithms android supports, and which would be better?
I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
