Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

9
votes
1answer
72 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
4
votes
1answer
83 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
1
vote
4answers
215 views

Cell phone monitoring device

This Chinese company claim their device/sim card can track other cell phone locations, record phone calls and SMS. Is this possible without having access to the other phones first? What do you guys ...
4
votes
1answer
4k views

IP address, iphone, Snapchat

My child is being accused of doing some improper things via Snapchat, but he swears that he did not do anything, and he is the type of person who probably would not. The only thing the police are ...
5
votes
1answer
153 views

Hacking/Sniffing/recording GSM like Karsten Nohl

For a course at college, I wanted to reproduce the attack on GSM shown in this video by Karsten Nohl: https://www.youtube.com/watch?v=0hjn-BP8nro. From what I understand he used an USRP radio to ...
1
vote
1answer
41 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
15
votes
5answers
3k views

Tools to help test the security of Android applications [closed]

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
5
votes
2answers
271 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
5
votes
3answers
6k views

What is the risk of leaking IMEI / IMSI numbers over a network

Should I worry if a developer programmed an app to send IMEI / IMSI number of the phone where the app is installed back to him? What can an attacker do with such information?
12
votes
5answers
5k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
29
votes
5answers
18k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
1
vote
1answer
47 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
-2
votes
1answer
85 views

Possible phone tapping [closed]

Only when one of my contacts calls me (my son) when I pick up there is somebody else on the line, usually with a foreign accent. When I hang up and called my son, he confirms he made the call and ...
1
vote
2answers
365 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
3
votes
2answers
51 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
7
votes
0answers
319 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
1
vote
2answers
1k views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
4
votes
1answer
143 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
1
vote
1answer
66 views

Are there any potential complications with these secure baseband ideas?

So I have been working on some ideas for securing cell phones from baseband level exploits and I was wondering if there are any potential complications with these solutions such as practicality or ...
3
votes
1answer
62 views

How am I supposed to verify the origin of a sign-in page in a web view?

I just had to sign in into my google account in an iPhone app. It's a third party, that only uses the google account for authentication. The familiar google sign in page appeared in what is known as a ...
3
votes
2answers
165 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
3
votes
2answers
146 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
3
votes
2answers
142 views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
0
votes
1answer
32 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
4
votes
1answer
39 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
9
votes
2answers
121 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
1
vote
0answers
21 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
6
votes
2answers
82 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
1
vote
2answers
240 views

Security risk of connecting one mobile device to another mobile device's hotspot

Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions. The Android Phone will basically be tapping the data plan of the ...
-2
votes
1answer
51 views

Is my iPhone 6S Plus compromised? [closed]

Is it usual practice on an iPhone 6S Plus for the wifi and Bluetooth addresses to be identical except for the very last number? One ends in .44 and the other .45. I've also had a lot of weird things ...
0
votes
1answer
53 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
1
vote
0answers
51 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
0
votes
0answers
126 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
25 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
6
votes
4answers
552 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
8
votes
3answers
431 views

How do you find out if a phone is secretly sending private data to a remote server?

I read a recent article on a Chinese phone manufacturer on Wall Street Journal that says: The rumors had begun when a user posted online in mid-July that his RedMi Note smartphone was ...
0
votes
0answers
18 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
4
votes
0answers
69 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
9
votes
3answers
15k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
5
votes
1answer
278 views

Methods to defend against rogue (mobile clients)

I'm currently building a MVP (financial mobile app) and trying to understand the best ways to prevent rogue clients interacting with the server. When looking at the security of most mobile apps I can ...
2
votes
0answers
60 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
7
votes
1answer
87 views

Do cellphones periodically send a “hello” msg to nearby WiFi APs?

I recently stumbled on this site, offering cell phone detection solutions: http://www.libelium.com/products/meshlium/smartphone-detection/ Where they state that: Users have to do nothing to be ...
2
votes
1answer
76 views

The Walmart clerk takes pictures of my IMEI # and Phone numbers

I went to WalMart looking for a cover for my new LG-Stylo Smartphone. I asked a one of the workers where to find them and he said they don't have any. Come to find out he has the same phone so I start ...
2
votes
3answers
347 views

Is it possible to protect against rogue mobile base stations? [closed]

I just read the answer to this question Mobile numbers capture and transmit data and it sounds surprisingly simple for calls/SMS (and data?) to be intercepted by a fake base station. From what I ...
1
vote
0answers
41 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
5
votes
4answers
138 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
2answers
164 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
1
vote
2answers
118 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
6
votes
2answers
607 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
-4
votes
1answer
116 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...