Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

11
votes
1answer
9k views

Mobile numbers capture and transmit data

will it be possible to build a low cost hardware/software device which can capture mobile numbers within a specified radius and then use that information to transmit an sms to those numbers? From what ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
27
votes
4answers
13k views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
12
votes
1answer
154 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
24
votes
2answers
2k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
18
votes
2answers
1k views

Security threats of wireless charging?

It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
5
votes
1answer
1k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
7
votes
4answers
5k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
4
votes
1answer
1k views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
16
votes
3answers
556 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
13
votes
4answers
2k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
11
votes
5answers
2k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
10
votes
1answer
191 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
10
votes
1answer
5k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
8
votes
4answers
386 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
7
votes
3answers
6k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
6
votes
1answer
750 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
5
votes
3answers
4k views

Self sign SSL certificate for my mobile app?

My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
4
votes
1answer
391 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
3
votes
2answers
914 views

List of Top security risk/attack scenarios for android application [closed]

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
0
votes
2answers
11k views

Why don't mobile operators blacklist stolen phones using their IMEI?

I've just read this piece of news that Android and Windows phones will get a 'killswitch', rendering them useless to potential thieves. However, since all devices have a unique identification number ...
8
votes
1answer
176 views

What was the issue the UAE had with RIM/Blackberry and what was the outcome? What countries have similar agreements?

I'd like to understand what came out of UAE's desire to monitor RIM traffic, and what technical compromise was made. Do other countries have similar agreements with RIM? What are the details? ...
7
votes
4answers
1k views

What is your process for wiping a lost Blackberry or similar device?

For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
6
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
6
votes
2answers
5k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?
5
votes
2answers
1k views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
4
votes
3answers
665 views

What are the problems with bring-your-own-device related to smartphones?

What are the problems with bring-your-own-device related to smartphones? Companies see this more and more everyday, people want to use their personal devices on the corporate network or even use them ...
3
votes
3answers
448 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
3
votes
2answers
2k views

SMS / voice call interception with a fake base station

This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
1
vote
2answers
1k views

Is there any documentation or reviews about LINE messenger security?

I tried to find any documentation about the security of LINE messenger, but I couldn't. Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
1
vote
1answer
1k views

Fuzzing Android API

I am thinking of trying to make an Android API fuzzer (I never made a fuzzer before, but I understand the concepts), and I was wondering which API calls would be the most interesting ones to fuzz from ...
9
votes
4answers
18k views

How can SMS spoofing be detected?

SMS spoofing involves faking the source ID, by replacing it with alphanumeric text. This can be useful for mobile providers, but can lead to security issues such as social engineering. How can we as ...
9
votes
2answers
4k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
5
votes
2answers
625 views

Mobile phone security eavesdropping based on data transfer

is there an easy way for particular governmental organizations (especially in countries where freedom of speech is a problem) have some technology where they can easily eavesdrop on cellphone internet ...
4
votes
1answer
813 views

Security Implications of Private/Corporate APNs

I'm interested in what (if any) the practical security implications of a company making use of a Private APN are as opposed to using a standard network provided APN and VPN connection back to the main ...
4
votes
1answer
936 views

Does KASUMI (A5/3) Related Key attack apply to 3G or other mobile providers?

The KASUMI is a block cipher used to encrypt UMTS, GPRS, and GSM SMS messages. The references section in Wikipedia says that a related key attack is possible in 3G systems. Q: Has it been proven ...
3
votes
3answers
3k views

Do telecom operators listen to every phone calls

I usually don't answer unknown numbers. Few days back i got couple of calls from unknown numbers and i didn't answer it. That evening i had contacted one of my lady friend and the next day i got a ...
2
votes
3answers
5k views

How to detect the “Hello packets” sent by a wifi enabled smartphone

Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network. I have seen somewhere that a ...
2
votes
4answers
2k views

Tails like OS for Smartphones

In Jacob Applebaum's latest talk at the 30c3 conference, he advised all journalists to use Tails or similar OS for their laptops. Does anyone know of a similar OS or functionality for Smartphones? ...
2
votes
1answer
525 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
1
vote
2answers
54 views

Detecting different jailbreaks

I am using an application that shuts down and quits when it detects a jailbroken phone. Is it possible that this application only detects some kinds of jailbreaks and not others? Or do applications ...
1
vote
2answers
1k views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
1
vote
2answers
135 views

How to secure Epson Beamer?

I work in a school and we have several Epson Beamers but some of our students have download an application for their mobile (with infra-red and WiFi connection) and they now have remote control and ...
1
vote
1answer
103 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...