Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
1answer
87 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
0
votes
0answers
26 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
4
votes
2answers
83 views

Difference between “Unknown” and “Hidden” Caller ID

I remember the times when I had an old Nokia phone as my main; there was some weird behaviour with Caller ID which was strange for me. When somebody with subscription to "Hide your number" service ...
-3
votes
2answers
71 views

How is two step authentication done in Europe without SMS?

I've heard that SMS use in Europe isn't even close to how much it's used in the US. How do they do two step authentication when a user forgets their password? Is it as simple as just using a robocall ...
0
votes
1answer
29 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
28
votes
2answers
3k views

Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

While testing a recent adtech integration I noticed something I can't explain. The iPhone uses two IP addresses. Seemingly one for HTTP and one for HTTPS. To further confuse things it only happens ...
2
votes
0answers
58 views

Is it possible to overwrite a phone through physical means?

I am currently doing some research into the Apple vs FBI controversy. During my research, I found a Edward Snowden comment that claimed that the government can actually override a phone's data, ...
-4
votes
0answers
30 views

Lost Phone Without Sim Card [closed]

Is there any way my lost phone can be found without a sim card or any internet points connected as my phone has undoubtedly ran out of battery?
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
-2
votes
1answer
87 views

Can my employer see my activity over their WiFi if I'm using the Tumblr app? [duplicate]

I have a great relationship with my employer and I don't think anyone is spying on me and I don't care if they read my email. But if I'm logged into their WiFi and I'm using the Tumblr app on my ...
2
votes
2answers
56 views

Suspicious SMS about activated phone service

Not long ago I had heard that someone from my family had an suspicious situation with SMS service. What happened was this person receive message like Service 'Play music on calls' have been enabled. ...
1
vote
1answer
63 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
-3
votes
0answers
64 views

How to check when SD card was removed from phone?

I just picked up my phone from a mobile repair service without my SD card. They did not only destroyed my mobile's display but also removed my SD card! I just want to know if there is any way to ...
1
vote
1answer
57 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
0
votes
0answers
15 views

Which bytes in an OTA Command Package are encrypted with the KIc by 3DES CBC?

I have an un-ciphered OTA message in clear and I am trying to cipher it so it becomes secure data. The cryptographic checksum is already generated as part of the un-ciphered OTA message. I have the ...
-1
votes
1answer
28 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
32 views

What are some good ways to test our back-end application? [closed]

We are just a few weeks to launch our mobile application for a few costumers to validate and test. This application is directly bounded to our server, which runs a back-end RESTful application. What ...
0
votes
1answer
55 views

Telegram messages in group are seen immediately [closed]

We have a small friends group using Telegram Messenger without any bot attached to group. When we send message in this group it is always seen (double checked) immediately even at midnight and hours ...
0
votes
2answers
75 views

Will blacklisting a stolen iPhone prevent the thiefs from getting access to my data?

My iPhone was stolen. I have AT&T. I did a factory reset, but believe my phone was turned off because I never got confirmation that the phone was erased. If the person who stole the phone took out ...
4
votes
1answer
41 views

What kind of information gets shared while pairing a device using Bluetooth? [duplicate]

I am using LGKp500 phone. My software version is KP500AT_V10h. Its a simple touch phone. It's not a smartphone. Now can anyone tell me, when Im pairing my phone with another phone using bluetooth (...
0
votes
1answer
31 views

What things can the other person see about my phone when I pair it using bluetooth?

I need to know some correct information about bluetooth pairing technology. What are the things which becomes visible to the person about my phone when I'm using bluetooth from my phone and pairing it ...
0
votes
1answer
41 views

What are attack vectors for attacking tethering smartphones?

Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+...
3
votes
0answers
28 views

In mobile, can “Early Media” be sent from the phone?

Early Media, aka in-band information, is sent from the network to the calling phone in some circumstances, to provide alternative tones or extra information about the status of the call. In GSM this ...
0
votes
1answer
32 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
1
vote
0answers
33 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
1
vote
0answers
36 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
-1
votes
1answer
108 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update 02/21/...
1
vote
0answers
66 views

Why is Telegram much more popular than Signal, which is, according to everything I've read, more secure? [closed]

I'm disregarding apps such as WhatsApp and Viber, because I assume majority of their users aren't particularly concerned about privacy, so it's not surprising they have more users. But how is it ...
206
votes
15answers
10k views

Tracing the location of a mobile IP from an email

I'm a TV scriptwriter - and not hugely tech-savvy, so please bear with me... If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know ...
1
vote
1answer
52 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
5
votes
2answers
105 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
45 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
1
vote
1answer
25 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
0
votes
1answer
81 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
3
votes
1answer
76 views

Security of cellular-connected devices

The EFF Secure Messaging Scorecard lists a number of apps that meet all of its security criteria. So assuming that end-to-end encryption is accessible for the majority of people in countries in which ...
0
votes
1answer
89 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
0answers
29 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
0
votes
0answers
75 views

For multiple clients it's better symmetric or assymetric encryption?

I'm a newbie in the encryption world so I'm here for asking which is the best solution between Symmetric and Asymmetric encryption. In our use cases, we have multiple clients that must be ...
4
votes
2answers
96 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
1answer
93 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
0
votes
0answers
35 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
5
votes
1answer
545 views

Can mobile network operators read WhatsApp metadata?

After turning on end-to-end encryption for WhatsApp is it possible for the network operators to read the metadata of the messages being exchanged? I see here (in Transport security) that metadata ...
21
votes
1answer
3k views

How does end to end encryption work with whatsapp web?

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?
0
votes
2answers
58 views

Best way to keep cell day to day phone calls private - is VOIP better?

This question is about preventing eavesdropping by hackers, thieves, or other smart people collecting information for shady purposes. Is it better to buy a smartphone and install a VOIP service on it ...
1
vote
1answer
60 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
1
vote
4answers
122 views

How sensitive are mobile telephone numbers?

A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is stalking you with hiding caller ID find out which provider gave out the number but not ...
6
votes
1answer
3k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
2
votes
1answer
82 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
-2
votes
1answer
82 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...