Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
2
votes
1answer
606 views
Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments
I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
1
vote
1answer
45 views
How to verify data from localStorage on a server
This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit.
On my mobile app, I am ...
3
votes
4answers
202 views
User-to-user encryption in addition to SSL for mobile phones?
I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption).
There are ...
1
vote
1answer
81 views
Would it be possible to extract user agent strings from 3G/4G Data
At a location where 3G/4G Data is prohibited, would it be practically possible to extract user agent strings from 3G/4G Data and compared to a list of known mobile browsers, assuming that the correct ...
1
vote
2answers
110 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
4
votes
4answers
1k views
Track lost Android phone, if the thief is using it to access internet
I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software.
But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
4
votes
4answers
484 views
Top Mobile Device Security Concerns? [closed]
What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
12
votes
3answers
259 views
Android security without updates
I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
17
votes
2answers
411 views
Security threats of wireless charging?
It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
-1
votes
1answer
108 views
Unable to browse with my office Wireless network i am connected [closed]
I am unable to connect to the internet. I am behind a company router that requires authentication, and although I had provided it I am unable to connect out to the internet.
Everyone is able to ...
1
vote
3answers
152 views
How this kind of mechanism considered as vulnerability?
From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html
Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
1
vote
2answers
88 views
Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?
Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination.
If we disable the account prior to wiping the device (or the device receiving the wipe ...
0
votes
0answers
57 views
Mobile phone backs up data online. Is it secure? [closed]
Some mobile phone providers offer to back up phone contact details or even more data online.
Example app solution that backs up mobile phone data is mozy. Is this secure to use mobile online backup ...
5
votes
1answer
243 views
Same-origin policy for file: URLs in Android browser?
When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
4
votes
1answer
816 views
Encrypting data for Android mobile app
I am creating a mobile app for Android. This is my first mobile app by the way.
I have decided to store data used in my app in a SQLite database in the target Android device.
The data I am storing ...
1
vote
3answers
428 views
Self sign SSL certificate for my mobile app?
My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
6
votes
6answers
3k views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
4
votes
3answers
149 views
Does GOOD Dynamics Proxy comply with EU data legislation?
My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
4
votes
1answer
89 views
Is there such thing as a smart phone with auto-forget password feature?
Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
0
votes
0answers
96 views
Which software is used to perform security tests on Android apps? [closed]
I want to replicate the security tests that researchers perform on Android applications (game, business, ...) for a homework project.
Can you help me with some documentation? or help me with some ...
5
votes
1answer
341 views
Spoofing USSD messages
I'm looking into USSD messages for a project I'm currently working upon and hoping someone can shed some light into spoofing.
Firstly, I know it should be possible if you have the relevant ...
1
vote
1answer
155 views
Pre boot authentication for Android phones
is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
1
vote
2answers
233 views
Is it legal to store/send user's device's IMEI/MEID? [closed]
I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.
Is it legal to store/send user's ...
6
votes
3answers
276 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
3
votes
1answer
74 views
Application communication monitoring
I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from.
As far I have ...
0
votes
0answers
54 views
How to create an app for mobile website [closed]
Im trying to make an app that will basically be able to be downloaded directly from my mobile website. I honestly want to just make something so users can download the app to their phone and when they ...
3
votes
2answers
164 views
Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?
I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
3
votes
1answer
147 views
Payment security on Android App
I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.
I know there are many payment services available. One of ...
6
votes
3answers
635 views
Are there any established mobile security frameworks or secure coding guidelines available?
I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5.
If there are no ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
3
votes
3answers
277 views
Can malware on my computer infect my phone?
Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this?
Relevance: Some banks use two-factor ...
3
votes
3answers
286 views
What are the security implications of phone based keyless entry systems?
I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious ...
13
votes
4answers
934 views
Security risks of scanning an unknown QR code
What are the security risks of scanning a QR code from an untrusted source?
If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
5
votes
4answers
2k views
How to harden an iPhone/Android app so its tough to reverse-engineer it?
These are the following objectives I have in mind:
Make the app hard to crack, as the binary will hold some secret tokens.
If it still can be cracked, is there any way the app can tell someone or ...
6
votes
4answers
2k views
How effective is iPhone 3GS and 4 encryption?
My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device.
In that context how effective is iPhone 3GS and 4 encryption?
3
votes
2answers
2k views
How to make an iPhone app HIPAA compliant?
How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions.
Will using a SSL connection give us the ...
0
votes
1answer
373 views
Iphone App Pen Test Guidance [closed]
I'm going to be studying pentesting iPhone apps. I'm a beginner in this area, and would like some guidance on the prerequisites of pen testing an iphone app, the details of the Mac machine that I'd ...
7
votes
5answers
817 views
Best practices for securing an iPhone
As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic.
There is already a question on protecting ...
4
votes
2answers
2k views
iPhone full disk encryption and theft protection?
Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses?
How can I protect my valuable data, such as email, when my iPhone gets stolen?
10
votes
8answers
477 views
iPhone Tracking debacle - risks and countermeasures
For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
2
votes
2answers
757 views
Guidelines for secure iPhone application development
Are there any security guidelines for development and assessment of (native) iPhone applications?
0
votes
2answers
274 views
Is a VPN the only way to protect against rogue Wifi access points MITM attacks?
Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions?
This question relates to ...
1
vote
3answers
875 views
Intercept data sent via bluetooth
I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth.
The new application I ...
3
votes
1answer
130 views
Resources on security risks of NFC
Mobile phones are, increasingly, starting to support NFC. NFC can be used for a rich set of applications (including mobile payments, identity, and file sharing).
What are primary security risks ...
1
vote
1answer
280 views
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?
Specifically forcing a reset or opening an application.
6
votes
4answers
801 views
Is Remotely wiping a cell phone really a valid defense?
In this month's issue of the SANS Institutes "Securing the Human" newsletter, the topic was lost and stolen cell phones. In the section on what to do if your cell phone is lost or stolen, it included ...
3
votes
2answers
393 views
List of Top security risk/attack scenarios for android application
WHat are the possible security risk/attack scenarios for android application.
This is with regards to the OWASP top 10 Mobile Security threats discussed here:
...
-3
votes
1answer
170 views
How can cellular phones be eavesdropped on? [closed]
I know its really stupid question but one of my friend told me that he can listen to the guy who calling on his mobile phone without his phone being the one the call is controlled by.
What ways could ...
8
votes
4answers
2k views
How can SMS spoofing be detected?
SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
3
votes
3answers
526 views
Android Pen Testing
I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.
I have set up a proxy and am able to intercept the traffic, however the POST method ...
