Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
3
votes
4answers
209 views
Strange android app … possibly a mass malware?
I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
17
votes
3answers
734 views
Why do a lot of Android apps (like Linkedin) require many unrelated privileges?
I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data.
Why does any ...
-1
votes
1answer
69 views
Security evaluation of Vasco's Digipass Mobile SDK for OTP?
Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices?
I am currently performing a full security evaluation of the solution ...
2
votes
1answer
63 views
What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?
I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
-4
votes
2answers
64 views
Can a windows phone be traced without a SIM and battery [closed]
I lost my lumia 800 mobile two days back. If the sim and battery is removed can it be traced with the IMEI number by the cops if I lodge a complain? Or can the location be traced if a new sim is used ...
52
votes
7answers
2k views
Touch Screen Password Guessing by Fingerprint Trace
After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII.
The way she figured this out was by simply ...
1
vote
1answer
34 views
Starting point for Mobile Device Security particularly in a MDM setting?
I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
2
votes
2answers
228 views
Do telecom operators listen to every phone calls
I usually don't answer unknown numbers. Few days back i got couple of calls from unknown numbers and i didn't answer it. That evening i had contacted one of my lady friend and the next day i got a ...
22
votes
5answers
4k views
What is preventing us from sniffing the mobile phone communcation?
I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
-4
votes
0answers
57 views
Trusteer Mobile Security SDK [closed]
I have been looking for some information on mobile security, especially about a specific solution provider by the name Trusteer.
In their small introductory article on mobile security they mention:
...
3
votes
1answer
56 views
Is access to the caller API in mobile phones a real security threat?
From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
2
votes
2answers
1k views
Android Apps accessing DNS settings?
I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
-2
votes
3answers
53 views
Do Mobile Device Management solutions provide a mechanism for an internal website to know what kind of device is connecting? [closed]
Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile ...
14
votes
2answers
236 views
Mitigating the loss of a mobile phone used for second-factor login
Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
7
votes
3answers
1k views
Does a working JTAG diagnostics port on Android phone add unnecessary risk?
Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
...
3
votes
3answers
198 views
Security concerns with malicious NFC tags?
I was reading this article from Life Hacker, How to Automate Your Phone for Every Room in the House with NFC Tags. The idea is to place NFC tags around your house, car, etc. so that you phone will ...
13
votes
3answers
435 views
What prevents people getting charged over NFC in crowded places?
I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
10
votes
2answers
256 views
Ingress collects a lot of data - what impact could this have on my privacy or security?
The Augmented Reality game from Google, Ingress, has players travel to specific GPS locations to destroy and rebuild virtual targets, link locations, and team up with other players in order to carry ...
2
votes
1answer
147 views
Does Verizon Wireless LTE network have intrusion prevention capabilities?
Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM.
EDIT for clarity: I ...
3
votes
1answer
83 views
Distributing API Keys to Mobile Apps
I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
9
votes
1answer
166 views
List of methods in iOS that have been deprecated for security reasons?
Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck.
Going through all the deprecated methods and ...
8
votes
1answer
300 views
How do anti-virus apps for Android work?
There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
11
votes
6answers
6k views
How can I identify my phone call is being tracked or tapped?
When I read about mobile call tracing, the hackers/security experts track and record mobile phone calls somehow.
Is it possible for us to identify that our call is tracked by someone or heard by ...
-4
votes
3answers
161 views
Cellphone where I don't have to worry about location tracking [duplicate]
I'd like to use a cellphone, but I don't want to have my location tracked. Richard Stallman told once that there was a cellphone without GPS. If I can find a phone without a GPS, would that ensure I ...
2
votes
1answer
242 views
Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?
Our company policy is requires the local encryption of data for all email (in case the device is stolen)
Does the Windows Surface (either version) support local encryption?
Is the local device ...
2
votes
1answer
88 views
Would introducing client certificates for a mobile app improve security?
I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
11
votes
3answers
1k views
How are mobile telephony networks like LTE and HSPA encrypted?
How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
3
votes
2answers
94 views
Authorising use of apps from a public store with no back end service
I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
8
votes
2answers
524 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
0
votes
0answers
68 views
Are there any SmartCards with NFC or Bluetooth technology? [closed]
I'm looking for a Smartcard that has integrated NFC communication, (or any other contact based transfer).
Does this technology exist, and must I rely on non-integrated solutions?
6
votes
1answer
80 views
What hardware do I need to monitor mobile traffic?
What kind of hardware would I need to monitor data sent between a mobile handset and a base-station?
15
votes
2answers
4k views
Can A Powered Down Cell Phone be Turned On Remotely?
I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
17
votes
5answers
13k views
How to trace a (mobile) phone?
Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless ...
4
votes
2answers
241 views
Evernote hacked - precautions?
On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software.
...
1
vote
1answer
74 views
How effective is Activesync Certificate revocation using CRL or OCSP
We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords.
One way to remedy an account lockout issue is to issue and deploy certificates ...
3
votes
2answers
176 views
When cellphone providers give “unlimited social networking”, how do they identify the traffic?
Some providers will give unlimited traffic for things like Facebook, Twitter, LinkedIn and even YouTube in some rare cases on smartphones. I'm wondering if there's any documented way they identify ...
13
votes
4answers
575 views
What measures should be taken when losing an iPad
When losing a tablet that has been used to access email accounts , beside changing the passwords, is there anything more can be done?
What are the most common problems that might occur if the iPad ...
1
vote
5answers
547 views
making an iPhone/Android app which sends a user password to my server, how to secure?
I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login.
I don't have SSL on my website, but it's just a reviews website and ...
5
votes
3answers
347 views
Does any tablet support remote attestation?
Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
3
votes
1answer
349 views
Should I install an antivirus on my mobile phone?
Is it advisable to install an antivirus for a mobile? I have recently purchased Note 2. Not too sure of how heavy application usage would I indulge into. But I would like to know if for safety ...
1
vote
3answers
577 views
Encrypt data within mobile app and send to web service
I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service?
Basically I will ...
2
votes
2answers
236 views
What are the best practices for maintaining privacy on a non-jailbroken iOS device?
iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
0
votes
1answer
69 views
Mobile Broadband, e-Fraud & Anonymity Against My Website [closed]
I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore.
What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain ...
1
vote
3answers
107 views
Requirements for a smartphone anti-theft App
I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
5
votes
6answers
4k views
Blocking insecure iPhones from accessing ActiveSync
Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In ...
2
votes
5answers
131 views
Safer way to access paypal, Mobile or Pc?
I often find it difficult to chose if it is safer (in any context) to log in to my paypal, or other similar banking accounts using my Nokia or my PC.
Maybe, I am assuming the fact, that since I do ...
7
votes
3answers
357 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
5
votes
2answers
133 views
How much should I care about the iOS/Android version when pentesting mobile app?
Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application?
I.e. if I test mobile application ...
4
votes
4answers
344 views
Received a Kindle from a stranger, what are the risks?
While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
10
votes
5answers
2k views
Keyloggers on Smartphones?
I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
