Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

0
votes
1answer
65 views

Hardware encryption for mobile data

Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local ...
0
votes
1answer
145 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
0
votes
0answers
39 views

What kind of security do WhatsApp and Viber use? [duplicate]

What kind of security do chat applications implement to preserve message integrity & confidentiality?
1
vote
1answer
233 views

Security implications of shared credentials on private APN

It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example). In M2M applications such as ...
2
votes
2answers
108 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
1
vote
1answer
355 views

Google's Mobile Authentication for REST APIs

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using ...
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
1
vote
1answer
157 views

Any risk of email configured for pop/imap access?

If my mobile phone is infected with some malware and the only connection I have to my corporate network is that the email client in the phone is configured for mail (pop/imap), what would be the risk ...
0
votes
1answer
48 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
0
votes
1answer
92 views

Compromised mobile device on a company network [duplicate]

What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?
1
vote
1answer
118 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
0
votes
2answers
796 views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
14
votes
4answers
3k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
8
votes
3answers
5k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
7
votes
4answers
253 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
2
votes
1answer
140 views

Danger of peer to peer software [closed]

I wanted to ask what are the risks of using P2P software. I found a lot of information on-line regarding the danger of file sharing but not about the software by itself. I am writing a mobile ...
3
votes
1answer
123 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
1
vote
1answer
377 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
0
votes
1answer
2k views

Show another number when calling mobile phone [duplicate]

Nowadays I heard that some cheaters make mobile calls to steal banking & other private information.They show private numbers like 911 to their victims. Is it possible show different number to ...
5
votes
2answers
398 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
2
votes
1answer
3k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
1
vote
1answer
483 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
26
votes
3answers
3k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
3
votes
2answers
472 views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
2answers
223 views

Do SPA applications have different security considerations than HTML5 sites?

I'm looking into Single Page Applications that are used for both mobile development (PhoneGap) and regular websites. Since the application can load from a offline copy, can run from ...
1
vote
1answer
66 views

Authentication and removing the ability to replay information from a compromised machine

Consider this scenario. You have a client machine which is compromised, and a "master" machine which monitors that client's status (IsCompromised = {True|False}). The client has an agent which ...
37
votes
6answers
9k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
2
votes
2answers
269 views

OFF Pocket or switch off your phone?

OFF Pocket: OFF Pocket is a "privacy accessory for mobile phones to block all signals". To use the OFF Pocket simply place your phone inside the case and close it. Your phone is now OFF. ...
2
votes
1answer
260 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
4
votes
1answer
285 views

Security Implications of Private/Corporate APNs

I'm interested in what (if any) the practical security implications of a company making use of a Private APN are as opposed to using a standard network provided APN and VPN connection back to the main ...
1
vote
2answers
453 views

Is it possible to respect a user's privacy while collecting phone MAC addresses?

In London, there are trash bins that track a phone's MAC address and monitor the users movement from one location to another. I want to see if there is any best practice for collecting private ...
1
vote
3answers
698 views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
13
votes
6answers
25k views

How can I identify my phone call is being tracked or tapped?

When I read about mobile call tracing, the hackers/security experts track and record mobile phone calls somehow. Is it possible for us to identify that our call is tracked by someone or heard by ...
2
votes
1answer
217 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
5
votes
2answers
301 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
0
votes
1answer
109 views

How can I securely identify mobile devices on a network without a lot of overhead?

I am thinking there must be some alternative better than passwords, but not so complex and difficult to administer as a full PKI infrastructure with client certificates on every device. My primary ...
-2
votes
1answer
86 views

Mobile Device Security [closed]

Are there any other security threats to a mobile device other then a rogue app? I am trying to secure a set of business phones and tablets and while anti-virus applications are possible, I don't see ...
4
votes
1answer
812 views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
63
votes
7answers
8k views

Touch Screen Password Guessing by Fingerprint Trace

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII. She figured this out by simply holding ...
2
votes
0answers
566 views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
2
votes
2answers
241 views

Can you protect corporate email on personal phones without the option of wiping all personal data?

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ...
6
votes
2answers
830 views

Securing a REST api at the message level

I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard way of doing this (or similar) so I can rely on a well tested implementation. I've seen many ...
7
votes
4answers
608 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
4
votes
2answers
331 views

Can botnets be injected through open wifi to smartphones?

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access ...
2
votes
1answer
800 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
9
votes
1answer
2k views

How to properly delete all data from cell phones?

Lately I've been thinking to get rid of some old smartphones; among them an Android device and a Blackberry. Not selling or recycling them is the ideal solution, however, I still would like to know ...
5
votes
5answers
3k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
21
votes
5answers
2k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
3
votes
4answers
809 views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...