Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

1
vote
2answers
505 views

Is it possible to respect a user's privacy while collecting phone MAC addresses?

In London, there are trash bins that track a phone's MAC address and monitor the users movement from one location to another. I want to see if there is any best practice for collecting private ...
1
vote
3answers
1k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
13
votes
6answers
32k views

How can I identify my phone call is being tracked or tapped?

When I read about mobile call tracing, the hackers/security experts track and record mobile phone calls somehow. Is it possible for us to identify that our call is tracked by someone or heard by ...
2
votes
1answer
261 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
5
votes
2answers
423 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
0
votes
1answer
137 views

How can I securely identify mobile devices on a network without a lot of overhead?

I am thinking there must be some alternative better than passwords, but not so complex and difficult to administer as a full PKI infrastructure with client certificates on every device. My primary ...
-2
votes
1answer
106 views

Mobile Device Security [closed]

Are there any other security threats to a mobile device other then a rogue app? I am trying to secure a set of business phones and tablets and while anti-virus applications are possible, I don't see ...
4
votes
1answer
1k views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
67
votes
7answers
11k views

Touch Screen Password Guessing by Fingerprint Trace

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII. She figured this out by simply holding ...
2
votes
0answers
695 views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
2
votes
2answers
329 views

Can you protect corporate email on personal phones without the option of wiping all personal data?

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ...
7
votes
2answers
1k views

Securing a REST api at the message level

I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard way of doing this (or similar) so I can rely on a well tested implementation. I've seen many ...
7
votes
4answers
624 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
4
votes
2answers
387 views

Can botnets be injected through open wifi to smartphones?

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access ...
2
votes
1answer
931 views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
9
votes
1answer
3k views

How to properly delete all data from cell phones?

Lately I've been thinking to get rid of some old smartphones; among them an Android device and a Blackberry. Not selling or recycling them is the ideal solution, however, I still would like to know ...
5
votes
5answers
4k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
21
votes
5answers
2k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
-2
votes
2answers
2k views

Can a windows phone be traced without a SIM and battery [closed]

I lost my lumia 800 mobile two days back. If the sim and battery is removed can it be traced with the IMEI number by the cops if I lodge a complain? Or can the location be traced if a new sim is used ...
1
vote
1answer
73 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
3
votes
2answers
2k views

Do telecom operators listen to every phone calls

I usually don't answer unknown numbers. Few days back i got couple of calls from unknown numbers and i didn't answer it. That evening i had contacted one of my lady friend and the next day i got a ...
29
votes
5answers
15k views

What is preventing us from sniffing the mobile phone communcation?

I'm learning wireless penetration testing. It really is amazing. But it made me wonder, what about mobile phones? They are also means of wireless communication. So, our entire voice must be in the air ...
4
votes
1answer
116 views

Is access to the caller API in mobile phones a real security threat?

From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
2
votes
2answers
2k views

Android Apps accessing DNS settings?

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting ...
-2
votes
3answers
87 views

Do Mobile Device Management solutions provide a mechanism for an internal website to know what kind of device is connecting? [closed]

Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile ...
16
votes
2answers
497 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
3
votes
3answers
1k views

Security concerns with malicious NFC tags?

I was reading this article from Life Hacker, How to Automate Your Phone for Every Room in the House with NFC Tags. The idea is to place NFC tags around your house, car, etc. so that you phone will ...
14
votes
3answers
640 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
2
votes
1answer
213 views

Does Verizon Wireless LTE network have intrusion prevention capabilities?

Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM. EDIT for clarity: I ...
5
votes
1answer
795 views

Distributing API Keys to Mobile Apps

I'm currently developing a mobile app (iOS based initially) that consumes multiple APIs. Currently we're storing API keys as strings in the the prefix header file, and initializing most of the APIs ...
9
votes
1answer
760 views

List of methods in iOS that have been deprecated for security reasons?

Is anybody on the nets keeping track of iOS methods that have been deprecated by Apple for security reasons? I have searched around but with no luck. Going through all the deprecated methods and ...
3
votes
1answer
380 views

Does the Windows Surface RT or Pro (Windows 8) support local encryption of Activesync data?

Our company policy is requires the local encryption of data for all email (in case the device is stolen) Does the Windows Surface (either version) support local encryption? Is the local device ...
4
votes
1answer
1k views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
12
votes
3answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
3
votes
2answers
116 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
6
votes
1answer
110 views

What hardware do I need to monitor mobile traffic?

What kind of hardware would I need to monitor data sent between a mobile handset and a base-station?
4
votes
2answers
295 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
1
vote
1answer
313 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
3
votes
2answers
250 views

When cellphone providers give “unlimited social networking”, how do they identify the traffic?

Some providers will give unlimited traffic for things like Facebook, Twitter, LinkedIn and even YouTube in some rare cases on smartphones. I'm wondering if there's any documented way they identify ...
15
votes
4answers
1k views

What measures should be taken when losing an iPad

When losing a tablet that has been used to access email accounts , beside changing the passwords, is there anything more can be done? What are the most common problems that might occur if the iPad ...
1
vote
5answers
1k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
5
votes
3answers
1k views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
3
votes
1answer
2k views

Should I install an antivirus on my mobile phone?

Is it advisable to install an antivirus for a mobile? I have recently purchased Note 2. Not too sure of how heavy application usage would I indulge into. But I would like to know if for safety ...
6
votes
3answers
9k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
2
votes
2answers
336 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
0
votes
1answer
131 views

Mobile Broadband, e-Fraud & Anonymity Against My Website [closed]

I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore. What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain ...
1
vote
3answers
255 views

Requirements for a smartphone anti-theft App

I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
5
votes
6answers
7k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
2
votes
5answers
356 views

Safer way to access paypal, Mobile or Pc?

I often find it difficult to chose if it is safer (in any context) to log in to my paypal, or other similar banking accounts using my Nokia or my PC. Maybe, I am assuming the fact, that since I do ...