Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

3
votes
1answer
83 views
+50

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
0
votes
0answers
31 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
5
votes
1answer
1k views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
1
vote
3answers
146 views

Sniffer attack on mobile [on hold]

I have Nokia lumia 625. And a guy hacked it using sniffer. That's how much I know about it. He has access to all my online texts(eg. Whatsapp, messenger etc) . and also to offline carrier text ...
3
votes
2answers
193 views
+50

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
1
vote
1answer
59 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
28
votes
3answers
6k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
0
votes
1answer
98 views

Default Encryption - A Panacea or Placebo

I wrote this on LinkedIn - Discrete Discretion My first question is: Is it accurate to say that default encryption is a placebo? Will default encryption only make end-users think they are secure ...
9
votes
2answers
708 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
1
vote
1answer
50 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
0
votes
0answers
28 views

Does anybody recognize the files below that are in my tablet and cell phone? [closed]

I have few strange files in my tablet and cell phone that comes back no matter what kind of "cleaning" I have done Does anybody regognize these files? What could they be? ...
1
vote
0answers
27 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
1
vote
1answer
61 views

Does the carrier network autheticates itself to the SIM card?

From my understanding this is how SIM authentication works: When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network Operator network finds the Ki(128 ...
4
votes
3answers
3k views

Can my phone be hacked just by being called?

I recently found a site, Cell-Spy-Stealth.com, that claims to sell spyware which can be targeted on a phone by simply making a call to it: "It will work even if you get the voice mail, or if the ...
2
votes
1answer
41 views

How to test image upload vulnerability in a mobile application?

I am administering a mobile application with many users. Users can upload their own .jpg images. I cannot know at this moment if image inputs on the application I am administrating are sanitized or ...
2
votes
1answer
84 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
2
votes
1answer
64 views

Why would my SSO information be cached on my iphone?

I develop a lot of internal applications/websites for my work using our standard SSO. It uses SAML2 and has a few different levels of security available. We have vendor who is using it for one of ...
1
vote
4answers
95 views

Cell phone monitoring device

This Chinese company claim their device/sim card can track other cell phone locations, record phone calls and SMS. Is this possible without having access to the other phones first? What do you guys ...
7
votes
3answers
272 views

How do you find out if a phone is secretly sending private data to a remote server?

I read a recent article on a Chinese phone manufacturer on Wall Street Journal that says: The rumors had begun when a user posted online in mid-July that his RedMi Note smartphone was ...
2
votes
1answer
88 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
2
votes
1answer
123 views

Reading encrypted data before sent to remote server

I'm developing a mobile app (Android only for now) to provide a disposable e-mail service to users. Users will be given temporary e-mail addresses so they can receive and read e-mails for a certain ...
3
votes
1answer
181 views

Methods to defend against rogue (mobile clients)

I'm currently building a MVP (financial mobile app) and trying to understand the best ways to prevent rogue clients interacting with the server. When looking at the security of most mobile apps I can ...
1
vote
1answer
162 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
0
votes
0answers
50 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
2
votes
1answer
515 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
3
votes
0answers
228 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
0
votes
3answers
280 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
25
votes
3answers
4k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
3
votes
1answer
2k views

How do you erase a Blackberry without having direct access to the server?

I have a Blackberry with no access to the BIS or BES server that managed it. How does one erase and reset the device to defaults?
4
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
1answer
65 views

Two factor authentication: SMS/TOTP, but what if you only use your phone

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either ...
5
votes
1answer
229 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
62
votes
7answers
18k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
4
votes
2answers
87 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
2
votes
1answer
46 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
-3
votes
2answers
72 views

Can your phone be traced without your SIM card for Android? [duplicate]

I'm just wondering I'm not a criminal but a friend is also wondering and Idk.
2
votes
3answers
163 views

How to protect against rogue Base Stations? [closed]

I just read the answer to the question here and it sounds surprisingly simple for calls/SMS (and data?) to be intercepted by a fake base station. From what I understand, if you were to walk past ...
10
votes
1answer
7k views

Mobile numbers capture and transmit data

will it be possible to build a low cost hardware/software device which can capture mobile numbers within a specified radius and then use that information to transmit an sms to those numbers? From what ...
-1
votes
2answers
70 views

Can the payer of my cell bill listen to my calls? [closed]

I am not an IT person so I'd need a simply-worded answer. I'm considering getting a smart phone, and someone else would be paying the bill, someone I don't necessarily trust. I'd like to know: would ...
14
votes
2answers
51k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
5
votes
2answers
186 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
2
votes
1answer
79 views

Is it possible for someone else to add a photo to text messages I am sending? [closed]

Is it possible for someone else to intercept a text message I am sending and add a photo to that message? I recently answered a text message I received from a friend and half way through typing out ...
1
vote
1answer
85 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
6
votes
2answers
236 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
1
vote
1answer
42 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
3
votes
4answers
177 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
0
votes
0answers
50 views

Alternative to ECC for mobile security

I asked a question a couple of months back, which led me to ECC. The following question is in continuation: Current Setup: I've two devices A and B which need to interact with each other securely ...
0
votes
0answers
31 views

SSO implementation in a mobile application

We are currently in the process of implementing SSO for one of our enterprise client in our mobile application. To make it more user friendly we were considering the idea of adding a new endpoint to ...
3
votes
2answers
203 views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
1
vote
1answer
410 views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...