Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

1
vote
1answer
420 views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
2
votes
3answers
3k views

how can I tell if I'm under IMSI cell phone surveillance

I've recently had an encounter with the law, the details of which I won't disclose here since the case is still in court. They took my phone, naturally. I deactivated it as soon as I was released ...
2
votes
1answer
3k views

Can virus save to SIM Card?

(Before everything excuse me because of my English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that ...
2
votes
2answers
74 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
1
vote
2answers
68 views

Can a mobile operator assign traffic to every SIM card in their network?

When using 3G or 4G internet on my phone, is this running over the SIM card or is this similar to WLAN traffic? Can a mobile network provider assign my mobile internet traffic to my phone by either ...
1
vote
1answer
160 views

Difference between Kali Linux and Santoku Linux

I would like to know, before I will install Santoku, what are the differences between Kali Linux and Santoku Linux? I know that Santoku is dedicated to mobile security testing, but Kali has some tools ...
1
vote
0answers
93 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
1
vote
1answer
131 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
4
votes
2answers
440 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
-1
votes
1answer
265 views

What makes an Android application vulnerable to Cross-site scripting (XSS)?

Definition of XSS If you search the web, there are many different ways to define a cross site scripting attack. Simply put, XSS vulnerabilities occur when a malicious attacker is permitted to inject ...
4
votes
1answer
110 views

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your ...
0
votes
1answer
102 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-1
votes
1answer
167 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
0
votes
2answers
320 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
32
votes
4answers
6k views

Why is GSM still used?

GSMs vulnerabilities have been known a long time now. UMTS was supposed to fix those problems. Why is GSM still used?
5
votes
2answers
518 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
6
votes
1answer
593 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
0
votes
2answers
8k views

Why don't mobile operators blacklist stolen phones using their IMEI?

I've just read this piece of news that Android and Windows phones will get a 'killswitch', rendering them useless to potential thieves. However, since all devices have a unique identification number ...
1
vote
3answers
110 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
34
votes
5answers
19k views

What is preventing us from sniffing the mobile phone communication?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
1
vote
3answers
236 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
6
votes
5answers
4k views

Is there a reason to protect SIM with PIN?

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found. If phone would be losed then it will be harder to find an owner for people that ...
1
vote
0answers
53 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
2
votes
2answers
303 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, such as voting, bitcoin payment, or other specific-purpose usage, and I want to make ...
5
votes
1answer
62 views

Can a mobile phone be induced to fall back to 2G comms?

http://techcrunch.com/2015/02/25/gemalto-2/ So, a bunch of SIM card keys were most likely stolen, but Gemalto claims that this would only affect 2G networks. Supposing all that is true, it's still ...
3
votes
2answers
2k views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
3
votes
1answer
82 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
0
votes
2answers
150 views

Understanding Certificate Pinning [duplicate]

I am attempting to implement certificate pinning across a suite of mobile apps. I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
1
vote
1answer
155 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
11
votes
3answers
12k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
15
votes
3answers
716 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
0answers
56 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
38 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
1
vote
1answer
134 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
2
votes
0answers
51 views

What are the privacy and infosec risks with Apple Watches and Android Wear?

From what I can tell, I Apple Watch apps act like a remote control to a nearby iPhone using Bluetooth or BLE. Conversely Android watches have the ability to run full applications, and therefore ...
2
votes
0answers
71 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
1
vote
3answers
1k views

How to intercept and analyze mobile SSL application traffic?

What is the best way to analyze requests sent by a mobile application over SSL? The communication protocol is not necessarily HTTP/S so intercepting them with BURP/ZAP/Fiddler or any other HTTP proxy ...
2
votes
1answer
1k views

IP address, iphone, Snapchat

My child is being accused of doing some improper things via Snapchat, but he swears that he did not do anything, and he is the type of person who probably would not. The only thing the police are ...
3
votes
1answer
231 views

REST API stateless authentication using social login

I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows: The token(s) (access_token in ...
1
vote
0answers
62 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
0
votes
1answer
123 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [closed]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
14
votes
3answers
5k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
2
votes
1answer
47 views

Securing 2 factor data from apps that are co-located on the same device?

Several apps such as GMail, Coinbase, Yahoo and others require the use of the mobile device to gain access to the data within the app. For example Gmail requires TOTP in Google Authenticator ...
0
votes
1answer
61 views

how does mdm (mobile device management ) work in byod environment to control the camera?

what i want to know is how mdm (mobile device management ) works in byod environment to control the camera from clicking pictures of a printed document?is there a way other than to shut off the ...
11
votes
2answers
2k views

Caller ID Spoof and Text Spams – How do they work?

A lot of people will have at some point received a spam text offering some sort of help via a debt settlement order, or help claiming for an accident that they have never had. I’ve noticed these are ...
5
votes
3answers
939 views

3G Femtocell at home: can anybody connect, and is all traffic encrypted?

At our office we have bad reception for 3G. We bought a Femtocell device that provides a 3G connection for one specific mobile provider. This device is connected to our network via ethernet. I cannot ...
1
vote
2answers
110 views

How to secure Epson Beamer?

I work in a school and we have several Epson Beamers but some of our students have download an application for their mobile (with infra-red and WiFi connection) and they now have remote control and ...
0
votes
1answer
39 views

From a deployment and OPS perspective, should a S/MIME signing and encryption key have different expiration dates?

Assuming the client supports different keys, what is some rationale that should be considered for signing and encryption keys? The encryption key needs to be present on each device that is used to ...
1
vote
1answer
149 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...