Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

2
votes
1answer
9k views

How to track a Spoofed SMS on Iphone

A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
14
votes
1answer
1k views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
4
votes
5answers
4k views

Track lost Android phone, if the thief is using it to access internet

I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software. But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
7
votes
4answers
6k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
4
votes
4answers
256 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
0
votes
1answer
131 views

Performance of biometric authentication on cell phones as of 2014?

How well do the various biometric authentication methods currently perform in regards to precision and recall? Can anyone cite a relevant research article?
3
votes
1answer
183 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
4
votes
2answers
473 views

Cell phone voice mail hacking

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
5
votes
2answers
913 views

Spoofing USSD messages

I'm looking into USSD messages for a project I'm currently working upon and hoping someone can shed some light into spoofing. Firstly, I know it should be possible if you have the relevant ...
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
3
votes
1answer
137 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
4answers
1k views

Tails like OS for Smartphones

In Jacob Applebaum's latest talk at the 30c3 conference, he advised all journalists to use Tails or similar OS for their laptops. Does anyone know of a similar OS or functionality for Smartphones? ...
8
votes
2answers
3k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
5
votes
2answers
836 views

Is my SIM card vulnerable to DES cracking?

Srlabs have recently published article stating that many SIM cards can be exploited using vulnerability in DES: [...] While the option exists to use state-of-the-art AES or the somewhat outdated ...
-1
votes
1answer
117 views

physical access proof smart card for disk encryption [closed]

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea. I know that ...
12
votes
2answers
2k views

Ingress collects a lot of data - what impact could this have on my privacy or security?

The Augmented Reality game from Google, Ingress, has players travel to specific GPS locations to destroy and rebuild virtual targets, link locations, and team up with other players in order to carry ...
10
votes
3answers
667 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
2
votes
2answers
566 views

How to prevent user's mobile phone position tracked

Trying to follow up this post How to trace a (mobile) phone? , the answers on how to prevent being tracked while you own a mobile phone are: You cant. (even if you use disposable phones etc) 1) Why a ...
3
votes
4answers
427 views

Key-agreement protocol in a REST API

I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings. Since the app is in an early ...
0
votes
2answers
247 views

Does a simple mobile REST API need HTTPS?

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game). ...
1
vote
0answers
526 views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
0
votes
1answer
77 views

Hardware encryption for mobile data

Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local ...
0
votes
1answer
193 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
1
vote
1answer
390 views

Security implications of shared credentials on private APN

It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example). In M2M applications such as ...
2
votes
2answers
128 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
1
vote
1answer
492 views

Google's Mobile Authentication for REST APIs

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using ...
7
votes
3answers
2k views

Does a working JTAG diagnostics port on Android phone add unnecessary risk?

Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it. ...
1
vote
1answer
236 views

Any risk of email configured for pop/imap access?

If my mobile phone is infected with some malware and the only connection I have to my corporate network is that the email client in the phone is configured for mail (pop/imap), what would be the risk ...
0
votes
1answer
63 views

Securing data on a mobile device (even from the user/owner)?

I am writing an application to generate OTP codes for two factor authentication where I need to securely store data locally. This data must be secure from both the owner/user as well as intruders. I ...
0
votes
1answer
99 views

Compromised mobile device on a company network [duplicate]

What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?
1
vote
1answer
127 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
2
votes
2answers
1k views

Do i need SSL certificate signed by a CA for hybrid mobile apps?

I have just stepped into ssl domain and started exploring how to implement ssl. My question is i understand ssl certificates signed by CA actually allow the client or browser to validate that the ...
14
votes
4answers
4k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
7
votes
4answers
262 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
2
votes
1answer
153 views

Danger of peer to peer software [closed]

I wanted to ask what are the risks of using P2P software. I found a lot of information on-line regarding the danger of file sharing but not about the software by itself. I am writing a mobile ...
3
votes
1answer
152 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
1
vote
1answer
428 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
0
votes
1answer
4k views

Show another number when calling mobile phone [duplicate]

Nowadays I heard that some cheaters make mobile calls to steal banking & other private information.They show private numbers like 911 to their victims. Is it possible show different number to ...
5
votes
2answers
590 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
2
votes
1answer
3k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
1
vote
1answer
704 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
25
votes
3answers
4k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
3
votes
2answers
713 views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
2answers
300 views

Do SPA applications have different security considerations than HTML5 sites?

I'm looking into Single Page Applications that are used for both mobile development (PhoneGap) and regular websites. Since the application can load from a offline copy, can run from ...
1
vote
1answer
68 views

Authentication and removing the ability to replay information from a compromised machine

Consider this scenario. You have a client machine which is compromised, and a "master" machine which monitors that client's status (IsCompromised = {True|False}). The client has an agent which ...
42
votes
6answers
13k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
2
votes
2answers
290 views

OFF Pocket or switch off your phone?

OFF Pocket: OFF Pocket is a "privacy accessory for mobile phones to block all signals". To use the OFF Pocket simply place your phone inside the case and close it. Your phone is now OFF. ...
2
votes
1answer
357 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
4
votes
1answer
377 views

Security Implications of Private/Corporate APNs

I'm interested in what (if any) the practical security implications of a company making use of a Private APN are as opposed to using a standard network provided APN and VPN connection back to the main ...