Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

-1
votes
0answers
7 views

Knowledge base solution access

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
0
votes
0answers
32 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
0
votes
2answers
37 views

Does a malware in an android phone have permission to read/modify/delete data of all the apps?

If an android phone is infected with malware/virus, can it access all the apps with modify/delete/read permission? Isn't there any control by an app , say a bank app which can't allow to read data by ...
5
votes
2answers
315 views

Pokemon Go apk file contains malware

In some countries, the game isn't launched officially yet, but this is getting vastly popular as people are downloading from links containing Apk files. I suspect that it is possible that the file ...
5
votes
3answers
98 views

Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?

Latest edition of OWASP Top 10 for web application was in 2013 and for mobile applications, it is 2016. Why is it so? Can we say that the pattern in the web application vulnerabilities is settled? ...
3
votes
0answers
65 views

Is the iPhone vulnerable to the BadUSB malware?

Supposedly, the BadUSB malware can infect any USB device. But I find this hard to believe since I don't see why most USB devices would have reprogrammable firmware and I find it even harder to believe ...
1
vote
3answers
128 views

Can my phone be located (e.g. by emergency personnel) when I use a VPN?

I have actually been learning on my own just by reading about VPN and how to protect myself from Big Brother so to speak. I just happened to discover that if I turn off my location option on my cell ...
0
votes
0answers
28 views

Security code review Apple Swift - tools and documentation

I need to perform a security code review on a huge Swift application. I have done many mobile penetration tests before and some code review but never on iOS Swift Apps. I am primarily looking for ...
-1
votes
1answer
72 views

How risky is it to disclose your IMEI number? [duplicate]

What will happen if I have mistakenly given my Android phone IMEI number to my IT colleague at my work place? How risky is it? I have asked him to delete my IMEI number. How can I be sure that he is ...
0
votes
1answer
49 views

Employee privacy when using company iPhone on own Wi-Fi

If I use a company iPhone on my own home Wi-Fi, does the employer still have visibility on activity? If so, how much assuming there are no hidden keylogging programs.
0
votes
1answer
39 views

Remote Biometric Authentication using mobile phones

As Google endeavours to do away with passwords, biometrics authentication as a method of proving identity has gained popularity. Logging into a system using a fingerprint or other biometric data would ...
0
votes
2answers
119 views

Threatening text messages on my cell phone, 120 in one day but no phone number for sender, how do I get this info?

Threatening text messages on my cell phone, 120 in one day, but no phone number for the sender, how do I get this info? I think they were sent via home pc. What type of wording, code, etc. should I ...
2
votes
1answer
27 views

Storage of account password on keychain iOS to enable TouchID login

Currently in the middle of a rather long-winded process of deciding upon the use of TouchID within an application being developed due, to security concerns, and wondered if anyone had any advice? The ...
1
vote
2answers
93 views

Can masked passwords on iOS UIs be read?

If someone had physical access to my iPhone, could they see the stored passwords for my WiFi or email that are represented as black circles and not actually the password itself, e.g. under my mail ...
-1
votes
1answer
58 views

Secure PIN verification if HTTPS is decryptable by third party

I'm developing a system where mobile applications communicate with server through HTTPS. The communication consists of two phases: at first, app "registers" at server: among other stuff, user chooses ...
2
votes
2answers
107 views

Can an iPhone be hacked during a phone call?

If I called someone can they hack into my iPhone just by being on the phone with me and knowing my phone number? I was also transferred to another person during the phone call, if that would make a ...
3
votes
2answers
357 views

My friend was fired from her job. Overnight, on her personal phone all her work contacts mysteriously disappeared

As the title stated. My friend personal email is connected to her personal phone. She works on the iPad and her work iPad is connected to her work email. She never checked her personal email on her ...
1
vote
1answer
36 views

Is it possible to filter internet access on a mobile phone with a 3/4G connection with a proxy server?

If you were to put a pfSense Squid Proxy Server with Squid Guardian on a DMZ and then point a cellphone with a 3/4G connection at it for SSL and HTTP with a self-signed CA certificate installed on it; ...
5
votes
1answer
147 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
0
votes
0answers
30 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
4
votes
2answers
92 views

Difference between “Unknown” and “Hidden” Caller ID

I remember the times when I had an old Nokia phone as my main; there was some weird behaviour with Caller ID which was strange for me. When somebody with subscription to "Hide your number" service ...
-3
votes
2answers
78 views

How is two step authentication done in Europe without SMS?

I've heard that SMS use in Europe isn't even close to how much it's used in the US. How do they do two step authentication when a user forgets their password? Is it as simple as just using a robocall ...
0
votes
1answer
49 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
28
votes
2answers
3k views

Why do web sites show my iPhone using different IP addresses for HTTP and HTTPS (cellular only)?

While testing a recent adtech integration I noticed something I can't explain. The iPhone uses two IP addresses. Seemingly one for HTTP and one for HTTPS. To further confuse things it only happens ...
2
votes
0answers
59 views

Is it possible to overwrite a phone through physical means?

I am currently doing some research into the Apple vs FBI controversy. During my research, I found a Edward Snowden comment that claimed that the government can actually override a phone's data, ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
-2
votes
1answer
137 views

Can my employer see my activity over their WiFi if I'm using the Tumblr app? [duplicate]

I have a great relationship with my employer and I don't think anyone is spying on me and I don't care if they read my email. But if I'm logged into their WiFi and I'm using the Tumblr app on my ...
2
votes
2answers
60 views

Suspicious SMS about activated phone service

Not long ago I had heard that someone from my family had an suspicious situation with SMS service. What happened was this person receive message like Service 'Play music on calls' have been enabled. ...
1
vote
1answer
69 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
1
vote
1answer
59 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
0
votes
0answers
16 views

Which bytes in an OTA Command Package are encrypted with the KIc by 3DES CBC?

I have an un-ciphered OTA message in clear and I am trying to cipher it so it becomes secure data. The cryptographic checksum is already generated as part of the un-ciphered OTA message. I have the ...
-1
votes
1answer
35 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
32 views

What are some good ways to test our back-end application? [closed]

We are just a few weeks to launch our mobile application for a few costumers to validate and test. This application is directly bounded to our server, which runs a back-end RESTful application. What ...
0
votes
1answer
64 views

Telegram messages in group are seen immediately [closed]

We have a small friends group using Telegram Messenger without any bot attached to group. When we send message in this group it is always seen (double checked) immediately even at midnight and hours ...
0
votes
2answers
82 views

Will blacklisting a stolen iPhone prevent the thiefs from getting access to my data?

My iPhone was stolen. I have AT&T. I did a factory reset, but believe my phone was turned off because I never got confirmation that the phone was erased. If the person who stole the phone took out ...
4
votes
1answer
50 views

What kind of information gets shared while pairing a device using Bluetooth? [duplicate]

I am using LGKp500 phone. My software version is KP500AT_V10h. Its a simple touch phone. It's not a smartphone. Now can anyone tell me, when Im pairing my phone with another phone using bluetooth (...
1
vote
1answer
70 views

What things can the other person see about my phone when I pair it using bluetooth?

I need to know some correct information about bluetooth pairing technology. What are the things which becomes visible to the person about my phone when I'm using bluetooth from my phone and pairing it ...
0
votes
1answer
47 views

What are attack vectors for attacking tethering smartphones?

Are there any attack vectors for attacking tethered wireless networks (mobile hotspot), other than for normal wireless networks? Assuming the tethered wirless network uses state-of-the-art encryption+...
3
votes
0answers
31 views

In mobile, can “Early Media” be sent from the phone?

Early Media, aka in-band information, is sent from the network to the calling phone in some circumstances, to provide alternative tones or extra information about the status of the call. In GSM this ...
0
votes
1answer
36 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
1
vote
0answers
38 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
1
vote
0answers
37 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
-1
votes
1answer
142 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update 02/21/...
1
vote
0answers
73 views

Why is Telegram much more popular than Signal, which is, according to everything I've read, more secure? [closed]

I'm disregarding apps such as WhatsApp and Viber, because I assume majority of their users aren't particularly concerned about privacy, so it's not surprising they have more users. But how is it ...
206
votes
15answers
10k views

Tracing the location of a mobile IP from an email

I'm a TV scriptwriter - and not hugely tech-savvy, so please bear with me... If the police have an email, sent by a suspect over a 3G or 4G network, could they use the IP address (since they know ...
1
vote
1answer
58 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
5
votes
2answers
114 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
48 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...