Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
1
vote
1answer
76 views
What function(s) to be used to generate Salt on Windows Mobile 6
I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for ...
2
votes
1answer
683 views
How does a BlackBerry handheld connect to BES?
How does a Blackberry device connect to BlackBerry Enterprise Server (BES) for the first time? What are the security mechanisms used to protect against a rogue BlackBerry handheld trying to connect to ...
4
votes
3answers
252 views
Preventing users from tampering with replay data [duplicate]
Possible Duplicate:
Protect application from being modified
This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
7
votes
3answers
1k views
Encryption on mobile phone - myth?
Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
6
votes
4answers
3k views
Are the iPhone “connect the dots” passwords secure?
A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this:
Is this kind of passwords secure from brute force ...
17
votes
5answers
965 views
How can I choose a strong password that is easy use on a smartphone?
Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
23
votes
2answers
969 views
What is the attack tree to intercept traffic on Wimax?
My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
12
votes
7answers
3k views
Are jailbroken iPhones an enterprise security risk?
Background
My company is currently in the process of rolling out support for the iPhone. As a part of this rollout, they are requiring employees to install an application on their phones that allows ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
11
votes
2answers
2k views
Smartphone / GSM Sniffer
This question would be in the category of SmartPhone Sniffers.
So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
10
votes
1answer
297 views
What did Blackberry do wrong?
The NIST defines a vulnerability in RIM Blackberry encryption discovered last October.
Apparently, Blackberry's flavour of PBKDF2 was weak. They say:
The offline backup mechanism in Research In ...
3
votes
1answer
482 views
Which encryption algo should be best for an Android application [duplicate]
Possible Duplicate:
Which type of encryption algorithms android supports, and which would be better?
I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
8
votes
5answers
533 views
Protect application from being modified
I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
4
votes
3answers
6k views
Which type of encryption algorithms android supports, and which would be better?
I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports.
Regarding DES and AES (As wiki documentation) ...
8
votes
4answers
1k views
QR codes that can't be copied - possible?
I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one).
It has to be photographed by our smartphone app, but the image will not be changed over a ...
8
votes
5answers
818 views
Best practices for securing an iPhone
As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic.
There is already a question on protecting ...
4
votes
4answers
296 views
Data categorization: Critical or not
I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES ...
5
votes
2answers
342 views
Cellular phone cloning
It is known that certain methods of authentication are used to tie a particular device to a particular phone number, so that cloning can be prevented.
What are these authentication mechanisms? ...
12
votes
5answers
1k views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
4
votes
2answers
297 views
Cell phone voice mail hacking
The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
2
votes
1answer
585 views
iOS/Android authentication and security
Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local ...
5
votes
7answers
1k views
What security risks exist in cell phone apps' data transfer?
Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
3
votes
1answer
465 views
How to secure an application under iOS against jailbroken devices
I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device.
I couldn't find online how to check that a device is jailbroken. Please anyhelp ...
2
votes
1answer
221 views
Secure implementations of G2/G3/G4 cellular technology
It appears that GSM is like any other technology, and is only as secure as its implementation.
What implementations are known to be secure or insecure due to a fault on the implementor's side, or due ...
13
votes
5answers
2k views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
6
votes
4answers
2k views
How to implement a “Remember me” on a mobile app?
I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience,
...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
7
votes
1answer
968 views
How should I protect in-app Android payments when using a separate server?
I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for.
I have a simple application to view server-generated content. I want to allow the user ...
10
votes
8answers
477 views
iPhone Tracking debacle - risks and countermeasures
For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
4
votes
4answers
372 views
What do you do to protect data on a Macbook in the event of theft/loss of the device?
What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device?
I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
7
votes
5answers
523 views
Can a mobile phone battery contain malware?
It has 3 terminals and is presumably a smart battery.
I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50.
The ...
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
2
votes
1answer
1k views
How do you erase a Blackberry without having direct access to the server?
I have a Blackberry with no access to the BIS or BES server that managed it.
How does one erase and reset the device to defaults?
2
votes
1answer
352 views
Possible to use “Blackberry Protect” in conjunction with a BES IT Policy?
Is it possible to use Blackberry Protect in conjunction with a BES IT policy? If so, what settings are incompatible?
So far I discovered that Memory encryption appears to be incompatible, but I'd ...
7
votes
2answers
787 views
Caller ID Spoof and Text Spams – How do they work?
(Posted here after a comment/suggestion from: http://superuser.com/questions/254340/caller-id-spoof-and-text-spams-how-do-they-work. Apologies if deemed not appropraite)
A lot of people will have at ...
2
votes
1answer
612 views
Pen test cell-phones
A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the ...
3
votes
1answer
150 views
Which is more secure: develop a mobile app in its Native language or using cross-platform UI?
I am just wondering if there are benefits from a security perspective to develop a mobile App either as native app or as a cross-platform UI app, in particular Rhodes? I need to develop an application ...
4
votes
1answer
471 views
Blackberry + RIM Bluetooth-based Smart Card Reader
Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?
Can you tell me if it's possible to require only the presence of the card + card ...
9
votes
3answers
1k views
Suitable cipher for SMS encryption
I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
8
votes
4answers
502 views
How to track a laptop after theft?
Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.
...
10
votes
5answers
1k views
Do mobile OS's provide crypto-quality randomness?
Which mobile OS's provide a primitive to generate crypto-quality randomness that applications can use?
On desktop systems, these features are pervasive. Unix provides /dev/urandom. Windows provides ...
6
votes
4answers
519 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
6
votes
3answers
2k views
User “home directory” on iPhone, Android, Windows mobiles and Blackberry
Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
7
votes
2answers
1k views
3DES vs DES for VPN connections
I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption.
Is it safe to use DES, am I going to get hacked if I ...
4
votes
2answers
904 views
On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?
I asked this already on Stack Overflow, here. I was told I might find answers here.
26
votes
1answer
5k views
iOS Encryption Details
Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices?
The Apple marketing material here, ...
7
votes
1answer
360 views
Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?
iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
5
votes
6answers
4k views
Blocking insecure iPhones from accessing ActiveSync
Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In ...
