Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

6
votes
1answer
3k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
2
votes
1answer
82 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
-2
votes
1answer
82 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
1
vote
1answer
59 views

COPE vs. BYOD - as an employee why should I be interested in BYOD? [closed]

I am curios what is the motivation for employees to go with BYOD? As an employee why I should want to allow installation of MDM solution on my smartphone?
1
vote
2answers
382 views

Why does Telegram not use end-to-end encryption? [closed]

Signal and Telegram are both mobile applications that "try" to ensure secure chats. Signal uses end-to-end encryption, Telegram does this as well (in 'secret chats') but it does not use end-to-end ...
58
votes
3answers
5k views

Why aren't IMSI catchers rendered ineffective by standard MITM defenses?

There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications. ...
33
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
3
votes
0answers
79 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
2
votes
1answer
44 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
2
votes
1answer
374 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
2
votes
2answers
70 views

Apple's OTA update process

When reading the iOS security doc, on page 6, it discusses the OTA update process. The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, ...
-2
votes
1answer
100 views

Can someone send popup message to all mobile network users?

Can you detect all users in the same network cellular or mobile network as you? Is it possible to send SMS or broadcast popup message from your mobile phone to other mobile users in your proximity?
1
vote
2answers
69 views

Blackphone - Silentcircle - mobile apps

i have question about blackphone (silent circle). Is there any advantage over other mobile phones if i want to use third party mobile apps? So if I agree with terms of use of some applications, ...
11
votes
3answers
1k views

Why is my phone connection secure without a password when WiFi is not even with a password?

When I talk on the phone or send text messages, I never need to type a userid and password. But when I use WiFi I need to use a password. How is the phone connection secured without a password, and ...
0
votes
2answers
91 views

Is there a way to uniquely identify a mobile device through packet sniffing?

I need to uniquely identify a mobile device using the "ping" packets that it transmits to cellular towers regularly, in an area of interest by installing a packet sniffer at that location? I only need ...
3
votes
4answers
142 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
-5
votes
1answer
91 views

Mobile number tracking

Is there any way we can track our mobile when it is lost? I have done a google search on the same and found that we have websites which give us the details of where the SIM was purchased & ...
11
votes
1answer
273 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
2
votes
1answer
60 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
1answer
107 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
-2
votes
1answer
95 views

Possible phone tapping [closed]

Only when one of my contacts calls me (my son) when I pick up there is somebody else on the line, usually with a foreign accent. When I hang up and called my son, he confirms he made the call and ...
3
votes
2answers
191 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
5
votes
1answer
68 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
63 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
1
vote
0answers
33 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
-2
votes
1answer
61 views

Is my iPhone 6S Plus compromised? [closed]

Is it usual practice on an iPhone 6S Plus for the wifi and Bluetooth addresses to be identical except for the very last number? One ends in .44 and the other .45. I've also had a lot of weird things ...
0
votes
1answer
69 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
456 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
6
votes
2answers
137 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
3
votes
2answers
340 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
0
votes
0answers
27 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
5
votes
2answers
105 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
7
votes
1answer
134 views

Do cellphones periodically send a “hello” msg to nearby WiFi APs?

I recently stumbled on this site, offering cell phone detection solutions: http://www.libelium.com/products/meshlium/smartphone-detection/ Where they state that: Users have to do nothing to be ...
2
votes
1answer
99 views

The Walmart clerk takes pictures of my IMEI # and Phone numbers

I went to WalMart looking for a cover for my new LG-Stylo Smartphone. I asked a one of the workers where to find them and he said they don't have any. Come to find out he has the same phone so I start ...
2
votes
1answer
233 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
9
votes
2answers
233 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
5
votes
4answers
147 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
2answers
197 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
-4
votes
1answer
169 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...
0
votes
1answer
110 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
4
votes
2answers
180 views

Passwordless website authentication scheme

I have a userbase which really isn't all that inclined to create a secure password for a website. They're also almost entirely on mobile devices, so I would like to try something a little different ...
3
votes
0answers
77 views

Can a mobile phone be reliably “nuked from orbit”? [duplicate]

Similar to how a rootkit affects PCs, and how mobile phones have special OEM software on them.... Is it possible to reset a suspect phone to it's OEM/patched state, and have high confidence that ...
2
votes
1answer
49 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
1
vote
0answers
100 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
99 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
3
votes
2answers
76 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
1
vote
1answer
95 views

Are there any potential complications with these secure baseband ideas?

So I have been working on some ideas for securing cell phones from baseband level exploits and I was wondering if there are any potential complications with these solutions such as practicality or ...
0
votes
1answer
1k views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
1
vote
0answers
39 views

TLS in slow/unstable mobile/wireless networks [closed]

We have this rather old VPN tunnel software that is running in various wireless/mobile networks (from 2G mobile and upwards). It is currently running WTLS, as this software is from the old days when ...