Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

8
votes
1answer
45 views

How does a refresh token help?

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
1
vote
1answer
40 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
1answer
47 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
0
votes
0answers
24 views

Samsung Knox Security Posture [closed]

I would like to understand pros and cons of the Samsung Knox platform. In detail, I would like to know if there is any flow, any shortcoming, or any weakness in the security posture of both the ...
0
votes
0answers
53 views

Is my mobile phone tapped, or what's causing this…? [closed]

I have the following very strange behavior with my cell phone (provider is US T-Mobile). When anyone calls me and leaves a message on my voicemail my phone will automatically and promptly call my ...
-2
votes
1answer
85 views

Possible phone tapping [closed]

Only when one of my contacts calls me (my son) when I pick up there is somebody else on the line, usually with a foreign accent. When I hang up and called my son, he confirms he made the call and ...
3
votes
2answers
51 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
4
votes
1answer
39 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
32 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
1
vote
0answers
21 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
-2
votes
1answer
50 views

Is my iPhone 6S Plus compromised? [closed]

Is it usual practice on an iPhone 6S Plus for the wifi and Bluetooth addresses to be identical except for the very last number? One ends in .44 and the other .45. I've also had a lot of weird things ...
0
votes
1answer
51 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
118 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
24 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
6
votes
2answers
81 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
3
votes
2answers
160 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
0
votes
0answers
18 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
4
votes
0answers
68 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
7
votes
1answer
86 views

Do cellphones periodically send a “hello” msg to nearby WiFi APs?

I recently stumbled on this site, offering cell phone detection solutions: http://www.libelium.com/products/meshlium/smartphone-detection/ Where they state that: Users have to do nothing to be ...
2
votes
1answer
76 views

The Walmart clerk takes pictures of my IMEI # and Phone numbers

I went to WalMart looking for a cover for my new LG-Stylo Smartphone. I asked a one of the workers where to find them and he said they don't have any. Come to find out he has the same phone so I start ...
1
vote
0answers
41 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
9
votes
2answers
119 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
5
votes
4answers
138 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
2answers
164 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
-4
votes
1answer
114 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...
0
votes
1answer
71 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
4
votes
2answers
133 views

Passwordless website authentication scheme

I have a userbase which really isn't all that inclined to create a secure password for a website. They're also almost entirely on mobile devices, so I would like to try something a little different ...
3
votes
0answers
75 views

Can a mobile phone be reliably “nuked from orbit”? [duplicate]

Similar to how a rootkit affects PCs, and how mobile phones have special OEM software on them.... Is it possible to reset a suspect phone to it's OEM/patched state, and have high confidence that ...
2
votes
1answer
35 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
1
vote
0answers
51 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
51 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
2
votes
2answers
54 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
1
vote
1answer
66 views

Are there any potential complications with these secure baseband ideas?

So I have been working on some ideas for securing cell phones from baseband level exploits and I was wondering if there are any potential complications with these solutions such as practicality or ...
0
votes
1answer
449 views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
1
vote
0answers
32 views

TLS in slow/unstable mobile/wireless networks [closed]

We have this rather old VPN tunnel software that is running in various wireless/mobile networks (from 2G mobile and upwards). It is currently running WTLS, as this software is from the old days when ...
2
votes
1answer
460 views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
2answers
70 views

Two-factor authentication methods: password + SMS/voice message vs. password + app-generated code?

I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone ...
3
votes
3answers
73 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
1
vote
2answers
55 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
5
votes
1answer
152 views

Hacking/Sniffing/recording GSM like Karsten Nohl

For a course at college, I wanted to reproduce the attack on GSM shown in this video by Karsten Nohl: https://www.youtube.com/watch?v=0hjn-BP8nro. From what I understand he used an USRP radio to ...
1
vote
2answers
41 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
5
votes
3answers
144 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
-1
votes
2answers
105 views

Someone received a text from my iphone. I don't even have the number the text was sent to [closed]

My son said two of his friends received a text from my phone, showing my phone number. I don't have these boys phone numbers in my phone or know their names. How did this happen?
3
votes
2answers
142 views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
4
votes
1answer
81 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
2
votes
0answers
60 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
4
votes
0answers
78 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
2
votes
1answer
93 views

How is Smurf Toolkit possible? [closed]

We've probably all heard about the Smurf Toolkit by now. It's the GCHQ's way of tapping phones revealed by Edward Snowden. So supposedly they can take over your phone (even power it off/on!) by simply ...
2
votes
1answer
102 views

Privacy issues when mobile app has access to phone number and contacts

It seems that when it comes to mobile apps convenience defeats security - always. In particular all messaging/communication apps seem to require to have access to your contacts on the phone and your ...
1
vote
0answers
52 views

Can a Tsunami early warning turn “on” remotely some cell phones in Japan?

In Japan, some televisions and radios seem to be capable of getting out of sleep mode if a tsunami warning is issued. If tsunami warnings are issued, the Emergency Warning Broadcast system ...