Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
1answer
899 views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
12
votes
3answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
3
votes
2answers
115 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
6
votes
1answer
110 views

What hardware do I need to monitor mobile traffic?

What kind of hardware would I need to monitor data sent between a mobile handset and a base-station?
4
votes
2answers
290 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
1
vote
1answer
273 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
3
votes
2answers
245 views

When cellphone providers give “unlimited social networking”, how do they identify the traffic?

Some providers will give unlimited traffic for things like Facebook, Twitter, LinkedIn and even YouTube in some rare cases on smartphones. I'm wondering if there's any documented way they identify ...
15
votes
4answers
1k views

What measures should be taken when losing an iPad

When losing a tablet that has been used to access email accounts , beside changing the passwords, is there anything more can be done? What are the most common problems that might occur if the iPad ...
1
vote
5answers
1k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
5
votes
3answers
955 views

Does any tablet support remote attestation?

Some PCs come with a TPM. One of the nifty capabilities of TPMs is the ability to perform remote attestation. Remote attestation allows your computer to tell a third computer what software your ...
3
votes
1answer
2k views

Should I install an antivirus on my mobile phone?

Is it advisable to install an antivirus for a mobile? I have recently purchased Note 2. Not too sure of how heavy application usage would I indulge into. But I would like to know if for safety ...
3
votes
3answers
8k views

Encrypt data within mobile app and send to web service

I'm developing a mobile application for Android and iOs. What is best practice when it comes to data encryption within the mobile application which will be sent to a web service? Basically I will ...
2
votes
2answers
329 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
0
votes
1answer
124 views

Mobile Broadband, e-Fraud & Anonymity Against My Website [closed]

I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore. What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain ...
1
vote
3answers
240 views

Requirements for a smartphone anti-theft App

I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
5
votes
6answers
6k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
2
votes
5answers
330 views

Safer way to access paypal, Mobile or Pc?

I often find it difficult to chose if it is safer (in any context) to log in to my paypal, or other similar banking accounts using my Nokia or my PC. Maybe, I am assuming the fact, that since I do ...
8
votes
3answers
882 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
5
votes
2answers
182 views

How much should I care about the iOS/Android version when pentesting mobile app?

Lets say I am performing penetration testing on mobile application, How significant is the version of operating system I am using while running the application? I.e. if I test mobile application ...
4
votes
4answers
408 views

Received a Kindle from a stranger, what are the risks?

While getting a coffee today, a man walked up to me and offered me a kindle. he said he no longer wanted it and that he was looking to give it away. An avid reader, I accepted. It has no accounts on ...
3
votes
1answer
297 views

Data remanence on mobile devices

The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD. Given ...
1
vote
2answers
1k views

Is Webroot's Business Endpoint Security up to snuff for mobile workforce?

I'm in a small software company and getting ready to begin supporting 7 remote sales guys out on the road. They all have recent ultrabooks and most of the tools they will be using are in in the ...
2
votes
1answer
3k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
1
vote
1answer
193 views

How to verify data from localStorage on a server

This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit. On my mobile app, I am ...
3
votes
4answers
465 views

User-to-user encryption in addition to SSL for mobile phones?

I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption). There are ...
1
vote
1answer
179 views

Would it be possible to extract user agent strings from 3G/4G Data

At a location where 3G/4G Data is prohibited, would it be practically possible to extract user agent strings from 3G/4G Data and compared to a list of known mobile browsers, assuming that the correct ...
1
vote
2answers
876 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
4
votes
4answers
625 views

Top Mobile Device Security Concerns? [closed]

What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
14
votes
3answers
406 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
18
votes
2answers
695 views

Security threats of wireless charging?

It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
1
vote
3answers
265 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
1
vote
2answers
150 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
6
votes
1answer
1k views

Same-origin policy for file: URLs in Android browser?

When you load a file:// URL in an Android WebView or in the Android browser, what does it treat as the origin? What can the Javascript on that page access? Can it access other files in the same ...
5
votes
1answer
5k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
4
votes
3answers
2k views

Self sign SSL certificate for my mobile app?

My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
10
votes
6answers
11k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
4
votes
3answers
403 views

Does GOOD Dynamics Proxy comply with EU data legislation?

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. ...
4
votes
1answer
106 views

Is there such thing as a smart phone with auto-forget password feature?

Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
3
votes
2answers
1k views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
3
votes
2answers
333 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
3
votes
1answer
263 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
7
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
9
votes
4answers
5k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
3
votes
3answers
901 views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
3
votes
3answers
516 views

What are the security implications of phone based keyless entry systems?

I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious ...
16
votes
4answers
1k views

Security risks of scanning an unknown QR code

What are the security risks of scanning a QR code from an untrusted source? If the QR code was constructed by an attacker, what can the attacker do to me? Do widely used QR scanners have any known ...
6
votes
4answers
3k views

How to harden an iPhone/Android app so its tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
5
votes
2answers
3k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
5
votes
2answers
4k views

iPhone full disk encryption and theft protection?

Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses? How can I protect my valuable data, such as email, when my iPhone gets stolen?