Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

1
vote
0answers
29 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
-2
votes
1answer
61 views

Is my iPhone 6S Plus compromised? [closed]

Is it usual practice on an iPhone 6S Plus for the wifi and Bluetooth addresses to be identical except for the very last number? One ends in .44 and the other .45. I've also had a lot of weird things ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
437 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
6
votes
2answers
119 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...
3
votes
2answers
329 views

Google Chrome on Android constantly being redirected

I have an Android (5.0.1 with December 2015 patches). My problem is with Chrome (latest version as per Google Play Store). Which has malicious redirect going on to ...
0
votes
0answers
25 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
5
votes
1answer
97 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
7
votes
1answer
121 views

Do cellphones periodically send a “hello” msg to nearby WiFi APs?

I recently stumbled on this site, offering cell phone detection solutions: http://www.libelium.com/products/meshlium/smartphone-detection/ Where they state that: Users have to do nothing to be ...
2
votes
1answer
95 views

The Walmart clerk takes pictures of my IMEI # and Phone numbers

I went to WalMart looking for a cover for my new LG-Stylo Smartphone. I asked a one of the workers where to find them and he said they don't have any. Come to find out he has the same phone so I start ...
2
votes
1answer
193 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
9
votes
2answers
200 views

Why are Android permissions granted in groups?

The Android documentation on Permission Groups states that If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same ...
5
votes
4answers
147 views

Laptop battery dies, only IT is allowed to access machine after plugging in

Apparently, my company has a security policy that states that if a laptop's battery dies (that is, uses up all charge because it's unplugged), the laptop gets locked and a domain administrator has to ...
5
votes
2answers
192 views

What happens when you SIM-unlock a cellphone

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to ...
-4
votes
1answer
164 views

What is the most secure mobile os? Ubuntu? [closed]

What's the most secure mobile os for the average day to day user concerned with protecting online banking, personal data, photos etc? And is the new Ubuntu mobile os likely to have the same security ...
0
votes
1answer
102 views

Mobile phone tracking, identification of the attacker [closed]

Once I was told that you can identify if your mobile phone is being tracked by someone (e.g. police), by calling placing a specific prefix to the number. This prefix in my country is normally reserved ...
4
votes
2answers
171 views

Passwordless website authentication scheme

I have a userbase which really isn't all that inclined to create a secure password for a website. They're also almost entirely on mobile devices, so I would like to try something a little different ...
3
votes
0answers
77 views

Can a mobile phone be reliably “nuked from orbit”? [duplicate]

Similar to how a rootkit affects PCs, and how mobile phones have special OEM software on them.... Is it possible to reset a suspect phone to it's OEM/patched state, and have high confidence that ...
2
votes
1answer
47 views

How can I inspect/audit an Android phone if it's vulnerable to CVE-2012-4221 (or any other?)

I want to create a guide (or app) to audit devices and determine if the hardware or software is vulnerable to attack. Given an arbitrary phone, what process should I do to determine if outstanding ...
1
vote
0answers
85 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
2
votes
1answer
95 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
3
votes
2answers
73 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
1
vote
1answer
87 views

Are there any potential complications with these secure baseband ideas?

So I have been working on some ideas for securing cell phones from baseband level exploits and I was wondering if there are any potential complications with these solutions such as practicality or ...
0
votes
1answer
992 views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
1
vote
0answers
35 views

TLS in slow/unstable mobile/wireless networks [closed]

We have this rather old VPN tunnel software that is running in various wireless/mobile networks (from 2G mobile and upwards). It is currently running WTLS, as this software is from the old days when ...
3
votes
2answers
2k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
0
votes
2answers
81 views

Two-factor authentication methods: password + SMS/voice message vs. password + app-generated code?

I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone ...
3
votes
3answers
86 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
1
vote
2answers
77 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
5
votes
1answer
320 views

Hacking/Sniffing/recording GSM like Karsten Nohl

For a course at college, I wanted to reproduce the attack on GSM shown in this video by Karsten Nohl: https://www.youtube.com/watch?v=0hjn-BP8nro. From what I understand he used an USRP radio to ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
5
votes
3answers
171 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
-1
votes
2answers
135 views

Someone received a text from my iphone. I don't even have the number the text was sent to [closed]

My son said two of his friends received a text from my phone, showing my phone number. I don't have these boys phone numbers in my phone or know their names. How did this happen?
3
votes
2answers
1k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
6
votes
1answer
125 views

What tools are needed to view or detect covert messages in a 60 fps video?

The eye can't detect changes in a frame greater than 60 FPS. Similar to this scene in Fight Club, a QR code equivalent is used in pairing the Apple Watch with the iPhone Without knowing that the ...
2
votes
0answers
74 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
4
votes
2answers
143 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
2
votes
1answer
101 views

How is Smurf Toolkit possible? [closed]

We've probably all heard about the Smurf Toolkit by now. It's the GCHQ's way of tapping phones revealed by Edward Snowden. So supposedly they can take over your phone (even power it off/on!) by simply ...
3
votes
1answer
208 views

Privacy issues when mobile app has access to phone number and contacts

It seems that when it comes to mobile apps convenience defeats security - always. In particular all messaging/communication apps seem to require to have access to your contacts on the phone and your ...
2
votes
0answers
58 views

Can a Tsunami early warning turn “on” remotely some cell phones in Japan?

In Japan, some televisions and radios seem to be capable of getting out of sleep mode if a tsunami warning is issued. If tsunami warnings are issued, the Emergency Warning Broadcast system ...
6
votes
2answers
894 views

Discovering IP or Mac address of mobile devices passing by.

Is it possible for someone to discover the IP and/or MAC address of my mobile device, even if I do not attempt to connect to their network?
3
votes
3answers
128 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
2
votes
5answers
591 views

Is the newly adopted NFC technology going to be safe?

I got sent a link today talking about how the business card company "Moo" is implementing a chip into their cards that will allow NFC connections to do many things such as share contact info, open a ...
0
votes
3answers
220 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
2
votes
2answers
348 views

password grant without client secret?

I'm struggling to decide what to do to get an access token from a mobile app. I'm sure this has been covered before, but I can't find it. I've enabled resource owner credentials grant on my oauth2 ...
9
votes
4answers
3k views

Securely erase personal data from android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
6
votes
1answer
90 views

Methods to Monitor Ads For Malware on Mobile Devices

I've noticed that malware being introduced to a mobile application or web application through advertisements, unknown to the developer of the application, is becoming increasingly popular. I've been ...
1
vote
2answers
185 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
4
votes
2answers
90 views

How am I supposed to verify the origin of a sign-in page in a web view? [duplicate]

I just had to sign in into my google account in an iPhone app. It's a third party, that only uses the google account for authentication. The familiar google sign in page appeared in what is known as a ...