Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

9
votes
5answers
696 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
7
votes
2answers
674 views

LTE networks and MITM

2G would leave you vulnerable to spoofed base stations. 3G tried to somewhat fix that using mutual authentication. Now, I tried to check how LTE handles this but I couldn’t find any usefull ...
1
vote
2answers
646 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
2
votes
1answer
372 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
4
votes
2answers
184 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
44
votes
1answer
8k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
1
vote
2answers
268 views

Is there man in middle attack when using mobile phone calls?

My question is about the encryption between me and my mobile operator. My mobile operator uses A5/1. I use Samsung. Sometimes I see the symbol G on my phone which means GPRS. I don't know whether it ...
1
vote
1answer
2k views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
0
votes
2answers
421 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
-1
votes
1answer
1k views

Someone borrowed my phone and Im scared its hacked [closed]

I am from Australia and I use a iPhone 4. Today, a young guy asked to borrow my phone, since he was out of credit and since I was trying to be a good samaritan, let him borrow my phone (also we were ...
0
votes
0answers
52 views

Mobile App Processing Debit Card Transactions

I am creating a mobile app for iPhone and Android and the respective API that will be exposed to support the operations. This operations will require the customer to type the PIN to complete the ...
0
votes
2answers
92 views

How to securely serve client-side-only web content to mobile with convenience?

For a cryptocurrency client implementation, I am serving a single page webapp to mobile clients. It is a client-side-only page. I would like to serve this page to clients, but I fear tampering by ...
6
votes
3answers
2k views

Is it possible to track a missing brand new phone? [closed]

I ordered a Nokia phone online and it turned out that the packet had been tampered and the phone was missing from the package. Obviously it does not have a SIM card, etc. I assume someone stole it ...
0
votes
1answer
165 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
1
vote
0answers
448 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
1
vote
1answer
175 views

Checking if apk's contain malicious software [closed]

Is there a programmatic way to check if a given mobile application executable is malicious through some sort of lookup service? I have used Virustotal for desktop malware, does it work for mobile ...
5
votes
3answers
467 views

Detect spy software on Symbian

I would like to check a Nokia N8 for possible software that might send any kind of data without my consent. Is there a specific tool to achieve this? Are there specific techniques?
1
vote
1answer
131 views

What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?

I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
-2
votes
1answer
69 views

Voicemail PIN reset - what is a DDN? [closed]

Here is a recording of Glenn Mulcaire using social engineering to reset the PINs to voice mailboxes to which he did not have authorised access. (At least, that's my understanding.) He appears to say ...
1
vote
0answers
39 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
3answers
124 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
0
votes
1answer
114 views

How do I secure “Data at Rest” only allowing Service API to access it from a mobile application

How do I secure data at rest from unauthorized access, but still allowing my application to access the data using user authentication over HTTPS? My scenario is as follows: Login to application ...
1
vote
0answers
181 views

Security risk of connecting one mobile device to another mobile device's hotspot

Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions. The Android Phone will basically be tapping the data plan of the ...
0
votes
2answers
270 views

What is the purpose of HTTPS GET vs POST requests when certificate pinning?

I have a mobile app which uses public key pinning to make sure that I only connect to servers from my CA. This works great with https, and it makes it so that nobody can really proxy my server and ...
1
vote
1answer
633 views

Transparently authenticating users or devices on mobile devices

I have an interest in using EAP-TLS to authenticate both users and devices separately on mobile devices (phones, iPods, tablets, etc.). My issue is how to delineate between user authentication and ...
5
votes
2answers
2k views

GET over HTTPS vs POST over HTTPS [duplicate]

How safe is a hybrid mobile application developed using a GET Web service over HTTPS? What are the pros and cons of using it and how safe is POST over HTTPS?
0
votes
2answers
155 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
1
vote
1answer
156 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
2answers
927 views

Is there any documentation or reviews about LINE messenger security?

I tried to find any documentation about the security of LINE messenger, but I couldn't. Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
4
votes
1answer
1k views

Authenticating users on offline devices such as ipad

We are wanting to authenticate the user inside a webapp (JavaScript/HTML inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realize this ...
0
votes
2answers
217 views

IMEI or IP being recognised?

Can a website see my IMEI number? I have been banned from a website for multiple accounts, although I always cleared cookies, disconnected and reconnected from "the cloud" which gives me a different ...
17
votes
5answers
6k views

Are SMS,MMS stored on the network service providers' servers?

Are SMS and MMS sent via a mobile phone stored on telecommunication service providers' servers before passing them to the recipient? Does it depend on the country or does every network service ...
14
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
1
vote
0answers
122 views

How do Android reverse engineering tools extract packages/ package hierarchy present in Android apps? [closed]

I have been involved in disassembling Android apps using baksmali and dexpler. Whenever I disassemble an app, I find the packages and package hierarchy (that would have been available in development ...
25
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
1
vote
0answers
35 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
6
votes
1answer
3k views

Imei and phone number given to unknown sources. What are the risks?

The facts: A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend his Whatsapp account that was ...
11
votes
5answers
1k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
9
votes
8answers
8k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
1
vote
0answers
47 views

Is there a TOTP variant that does not require the user to type in a code? [closed]

We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
7
votes
2answers
181 views

Why are apps for mobile devices more restrictive than for desktop?

Application devlopement for mobile devices is generally more restrictive, i.e. the apps runs in a sandboxed environment, they have many limitations when accessing the filesystem, etc. compared to ...
0
votes
1answer
98 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
1
vote
0answers
272 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
3answers
3k views

How to detect the “Hello packets” sent by a wifi enabled smartphone

Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network. I have seen somewhere that a ...
1
vote
2answers
271 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
11
votes
5answers
4k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
3
votes
1answer
1k views

How the shopkeepers are getting MAC address of wifi enabled smartphones

It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done? I have the similar issue.. how to get the MAC address ...
2
votes
1answer
227 views

Is it possible to locate a cellphone's location just by ringing it?

With today's technology, is it possible to locate a cellphone's location just by ringing it, kind of like what we see in movies?
0
votes
1answer
137 views

What would be a valid approach to store private keys?

I'm implementing a mobile app which uses AES encryption algorithm to encrypt some critical values being sent to a remote server (basically, the user password), and then decrypted on the server side ...