Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

9
votes
2answers
708 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
0
votes
0answers
27 views

Does anybody recognize the files below that are in my tablet and cell phone? [closed]

I have few strange files in my tablet and cell phone that comes back no matter what kind of "cleaning" I have done Does anybody regognize these files? What could they be? ...
1
vote
0answers
26 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
1
vote
1answer
61 views

Does the carrier network autheticates itself to the SIM card?

From my understanding this is how SIM authentication works: When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network Operator network finds the Ki(128 ...
3
votes
2answers
191 views
+50

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
2
votes
1answer
39 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
1
vote
4answers
95 views

Cell phone monitoring device

This Chinese company claim their device/sim card can track other cell phone locations, record phone calls and SMS. Is this possible without having access to the other phones first? What do you guys ...
2
votes
1answer
87 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
0
votes
0answers
50 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
25
votes
3answers
4k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
2
votes
1answer
64 views

Two factor authentication: SMS/TOTP, but what if you only use your phone

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either ...
5
votes
1answer
229 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
1
vote
1answer
161 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
2
votes
1answer
84 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
2
votes
1answer
46 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
-3
votes
2answers
72 views

Can your phone be traced without your SIM card for Android? [duplicate]

I'm just wondering I'm not a criminal but a friend is also wondering and Idk.
4
votes
2answers
86 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
2
votes
3answers
163 views

How to protect against rogue Base Stations? [closed]

I just read the answer to the question here and it sounds surprisingly simple for calls/SMS (and data?) to be intercepted by a fake base station. From what I understand, if you were to walk past ...
-1
votes
2answers
70 views

Can the payer of my cell bill listen to my calls? [closed]

I am not an IT person so I'd need a simply-worded answer. I'm considering getting a smart phone, and someone else would be paying the bill, someone I don't necessarily trust. I'd like to know: would ...
1
vote
1answer
50 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
2
votes
1answer
79 views

Is it possible for someone else to add a photo to text messages I am sending? [closed]

Is it possible for someone else to intercept a text message I am sending and add a photo to that message? I recently answered a text message I received from a friend and half way through typing out ...
1
vote
1answer
42 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
5
votes
1answer
1k views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
0
votes
0answers
50 views

Alternative to ECC for mobile security

I asked a question a couple of months back, which led me to ECC. The following question is in continuation: Current Setup: I've two devices A and B which need to interact with each other securely ...
0
votes
0answers
31 views

SSO implementation in a mobile application

We are currently in the process of implementing SSO for one of our enterprise client in our mobile application. To make it more user friendly we were considering the idea of adding a new endpoint to ...
1
vote
1answer
404 views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
3
votes
2answers
201 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
2
votes
2answers
73 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
1
vote
2answers
68 views

Can a mobile operator assign traffic to every SIM card in their network?

When using 3G or 4G internet on my phone, is this running over the SIM card or is this similar to WLAN traffic? Can a mobile network provider assign my mobile internet traffic to my phone by either ...
1
vote
1answer
158 views

Difference between Kali Linux and Santoku Linux

I would like to know, before I will install Santoku, what are the differences between Kali Linux and Santoku Linux? I know that Santoku is dedicated to mobile security testing, but Kali has some tools ...
1
vote
0answers
92 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
1
vote
1answer
127 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
0
votes
1answer
58 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
4
votes
1answer
107 views

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your ...
1
vote
1answer
85 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
0
votes
1answer
101 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-1
votes
1answer
166 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
-1
votes
1answer
265 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
0
votes
2answers
312 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
5
votes
2answers
517 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
1
vote
0answers
53 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
5
votes
1answer
62 views

Can a mobile phone be induced to fall back to 2G comms?

http://techcrunch.com/2015/02/25/gemalto-2/ So, a bunch of SIM card keys were most likely stolen, but Gemalto claims that this would only affect 2G networks. Supposing all that is true, it's still ...
1
vote
3answers
110 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
3
votes
1answer
82 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
1
vote
3answers
145 views

Sniffer attack on mobile [on hold]

I have Nokia lumia 625. And a guy hacked it using sniffer. That's how much I know about it. He has access to all my online texts(eg. Whatsapp, messenger etc) . and also to offline carrier text ...
0
votes
2answers
150 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
3
votes
4answers
177 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
2
votes
0answers
56 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
38 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
2
votes
0answers
51 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...