Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

0
votes
1answer
105 views

Default Encryption - A Panacea or Placebo

I wrote this on LinkedIn - Discrete Discretion My first question is: Is it accurate to say that default encryption is a placebo? Will default encryption only make end-users think they are secure ...
2
votes
0answers
90 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
1
vote
1answer
153 views

Does the carrier network autheticates itself to the SIM card?

From my understanding this is how SIM authentication works: When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network Operator network finds the Ki(128 ...
2
votes
1answer
219 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
1
vote
1answer
569 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
3
votes
0answers
183 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
7
votes
1answer
707 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
2
votes
1answer
193 views

Two factor authentication: SMS/TOTP, but what if you only use your phone

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either ...
5
votes
1answer
455 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
4
votes
2answers
256 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
2
votes
1answer
54 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
-3
votes
2answers
214 views

Can your phone be traced without your SIM card for Android? [duplicate]

I'm just wondering I'm not a criminal but a friend is also wondering and Idk.
11
votes
1answer
9k views

Mobile numbers capture and transmit data

will it be possible to build a low cost hardware/software device which can capture mobile numbers within a specified radius and then use that information to transmit an sms to those numbers? From what ...
-1
votes
2answers
174 views

Can the payer of my cell bill listen to my calls? [closed]

I am not an IT person so I'd need a simply-worded answer. I'm considering getting a smart phone, and someone else would be paying the bill, someone I don't necessarily trust. I'd like to know: would ...
5
votes
2answers
320 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
0
votes
1answer
111 views

Is it possible for someone else to add a photo to text messages I am sending? [closed]

Is it possible for someone else to intercept a text message I am sending and add a photo to that message? I recently answered a text message I received from a friend and half way through typing out ...
1
vote
1answer
229 views

How does Memory Corruption apply to Android?

I have researched several DoS attacks within Android e.g.: CVE-2015-1474 CVE-2013-5933 CVE-2013-4710 CVE-2012-6301 etc. And although I found DoS attacks within Android difficult to understand at ...
6
votes
2answers
586 views

Are SIM proactive commands secure?

A SIM card can initiate some communication with a mobile device with so called "proactive commands" (chapter 6 of http://www.etsi.org/deliver/etsi_gts/11/1114/05.04.00_60/gsmts_1114v050400p.pdf). ...
1
vote
1answer
46 views

Tablet antitampering [closed]

We'll be distributing tablets for some group of employees. Enterprise applications will be installed and IT has been tasked with protecting them against users messing with these new toys (i.e ...
3
votes
4answers
325 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
5
votes
2answers
2k views

Are phone apps vulnerable to XSS or CSRF? (Webview, Phonegap, chrometab)

I need to provide evidence that CSRF or XSS is possible on a phone... using PhoneGap, a Webview, or specifically a "Chrome Tab" or iOS equivalent. I believe in theory this is possible, and mitigation ...
4
votes
1answer
6k views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
1
vote
1answer
6k views

Can virus save to SIM Card?

(Before everything excuse me because of my English) Today one of my friends asked me about his Nokia 130 Dual SIM. There was a problem about Short Message System. No Messages were sent from that phone....
2
votes
2answers
89 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
1
vote
2answers
150 views

Can a mobile operator assign traffic to every SIM card in their network?

When using 3G or 4G internet on my phone, is this running over the SIM card or is this similar to WLAN traffic? Can a mobile network provider assign my mobile internet traffic to my phone by either ...
1
vote
1answer
460 views

Difference between Kali Linux and Santoku Linux

I would like to know, before I will install Santoku, what are the differences between Kali Linux and Santoku Linux? I know that Santoku is dedicated to mobile security testing, but Kali has some tools ...
1
vote
1answer
527 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
4
votes
2answers
558 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
4
votes
1answer
296 views

How easy is it for hackers to gain unauthorized access to resources on an Android phone?

I caught a segment of an NBC news story describing how hackers can access messages, phone conversations, location, camera, microphone, and more provided that they can install a malicious app on your ...
0
votes
1answer
206 views

What factors make Android app code vulnerable to Cross-Site Request Forgery attacks?

According to techtarget.com Cross-Site Request Forgery is: a method of attacking a Web site in which an intruder masquerades as a legitimate and trusted user. An XSRF attack can be used to ...
-1
votes
1answer
451 views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
32
votes
4answers
7k views

Why is GSM still used?

GSMs vulnerabilities have been known a long time now. UMTS was supposed to fix those problems. Why is GSM still used?
6
votes
2answers
1k views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
6
votes
1answer
786 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
0
votes
2answers
11k views

Why don't mobile operators blacklist stolen phones using their IMEI?

I've just read this piece of news that Android and Windows phones will get a 'killswitch', rendering them useless to potential thieves. However, since all devices have a unique identification number (...
1
vote
3answers
125 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
2
votes
3answers
324 views

What security mechanisms are in place for iOS' custom keyboards?

Apple has just announced iOS 8. The new version appears to be more extensible than previous versions, and one of the new possiblities is to allow developers to develop custom keyboards, different than ...
1
vote
0answers
85 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
2
votes
2answers
308 views

In theory, can a restricted-use ToR network be created with “Verifiable Encryption”? How should I approach learning it?

I have mobile devices (low power, low bandwidth) need to act as a proxy for certain types of P2P encrypted data, such as voting, bitcoin payment, or other specific-purpose usage, and I want to make ...
5
votes
1answer
74 views

Can a mobile phone be induced to fall back to 2G comms?

http://techcrunch.com/2015/02/25/gemalto-2/ So, a bunch of SIM card keys were most likely stolen, but Gemalto claims that this would only affect 2G networks. Supposing all that is true, it's still ...
3
votes
2answers
2k views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
3
votes
1answer
133 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
1
vote
1answer
177 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
14
votes
3answers
14k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
0answers
79 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
44 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
1
vote
1answer
298 views

Is CloudKit or iCloud suitable for storing PII?

iCloud is Apple's storage technology that copies data from one iPhone and shares it with every other device. CloudKit is a similar technology that allows (from what I can tell) the partial ...
2
votes
0answers
87 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...