Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
1answer
1k views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
4
votes
1answer
444 views

Implementation of Blizzard's Mobile Authenticator

How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
4
votes
1answer
239 views

What are best practices considering the use of Apple data protection?

Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but ...
4
votes
1answer
514 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
4
votes
1answer
506 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
4
votes
2answers
189 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
4
votes
1answer
1k views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
4
votes
1answer
1k views

Authenticating users on offline devices such as ipad

We are wanting to authenticate the user inside a webapp (JavaScript/HTML inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realize this ...
4
votes
2answers
521 views

Can botnets be injected through open wifi to smartphones?

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access ...
4
votes
1answer
118 views

Is there such thing as a smart phone with auto-forget password feature?

Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
4
votes
1answer
331 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...
4
votes
0answers
65 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
4
votes
1answer
136 views

Hacking/Sniffing/recording GSM like Karsten Nohl

For a course at college, I wanted to reproduce the attack on GSM shown in this video by Karsten Nohl: https://www.youtube.com/watch?v=0hjn-BP8nro. From what I understand he used an USRP radio to ...
4
votes
0answers
75 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
4
votes
2answers
207 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
4
votes
1answer
142 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
3
votes
4answers
655 views

User-to-user encryption in addition to SSL for mobile phones?

I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption). There are ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
3
votes
3answers
6k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
3
votes
2answers
2k views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
3
votes
3answers
2k views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
3
votes
1answer
944 views

How to secure an application under iOS against jailbroken devices

I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device. I couldn't find online how to check that a device is jailbroken. Please anyhelp ...
3
votes
3answers
90 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
3
votes
4answers
251 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
1answer
1k views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
3
votes
3answers
2k views

Do telecom operators listen to every phone calls

I usually don't answer unknown numbers. Few days back i got couple of calls from unknown numbers and i didn't answer it. That evening i had contacted one of my lady friend and the next day i got a ...
3
votes
2answers
121 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
3
votes
1answer
4k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
3
votes
2answers
735 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
3
votes
3answers
748 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
3
votes
4answers
516 views

If a thief has the phone in their possession, how can Password Recovery be implemented securely?

Standard password recovery involves sending a password reset mechanism to the user; either to email, sms or telephone call. However, if a phone has been stolen the thief has full access to these ...
3
votes
1answer
106 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
3
votes
2answers
72 views

Mobile apps and apps store security

This question is with regards to mobile apps and apps stores. Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use ...
3
votes
2answers
2k views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
3
votes
2answers
266 views

When cellphone providers give “unlimited social networking”, how do they identify the traffic?

Some providers will give unlimited traffic for things like Facebook, Twitter, LinkedIn and even YouTube in some rare cases on smartphones. I'm wondering if there's any documented way they identify ...
3
votes
3answers
607 views

What are the security implications of phone based keyless entry systems?

I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious ...
3
votes
3answers
433 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
3
votes
2answers
485 views

Is it possible to find out the oauth 2.0 client id and secret when an app is communicating with a web service?

I'm building an mobile app that needs to communicate with a web service. To make sure that only my app is communicating with the web service, I authenticate using OAuth 2. The fact that I need to ...
3
votes
1answer
322 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
2answers
51 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
3
votes
4answers
415 views

Can my phone be affected by malware through mobile phone signal?

My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider? ...
3
votes
1answer
212 views

Offloading private key operations to a trusted device

If I have a cryptosystem built around PGP/GnuPG, I can keep my secrets safe by using an OpenPGP smart card and storing my private keys there. If I'm instead using DJB's NaCl, is there any sort of ...
3
votes
2answers
172 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
3
votes
2answers
887 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
3
votes
2answers
2k views

SMS / voice call interception with a fake base station

This answer to a similar topic describes in a detailed way how vulnerable SMS and voice calls are in terms of decryption. In order to do so, an attacker needs to set up a fake base station located ...
3
votes
1answer
2k views

How does a BlackBerry handheld connect to BES?

How does a Blackberry device connect to BlackBerry Enterprise Server (BES) for the first time? What are the security mechanisms used to protect against a rogue BlackBerry handheld trying to connect to ...
3
votes
1answer
112 views

Dangers of WAP billing?

Recently I clicked an ad by mistake on my phone and it routed me through different pages and popups automatically. On of the pages had my mobile phone provider in its URL and WAP-billing. So I ...
3
votes
1answer
2k views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
3
votes
1answer
126 views

Why do mobile operating systems not implement a way to deny permissions to an app?

Android and iOS (afaik) implement a relativly fine-grained permission schema for their apps. But as I user I only have the change to acceppt all or nothing. When I think about it, it shouldn't be a ...