Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

2
votes
1answer
3k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
2answers
314 views

What are the best practices for maintaining privacy on a non-jailbroken iOS device?

iOS, like most other mobile OSs, has the potential to leak significant chunks of personal information to 3rd-party apps and to ad and tracking networks used by those apps, which in turn also has the ...
2
votes
1answer
360 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
2
votes
1answer
339 views

Secure implementations of G2/G3/G4 cellular technology

It appears that GSM is like any other technology, and is only as secure as its implementation. What implementations are known to be secure or insecure due to a fault on the implementor's side, or due ...
2
votes
1answer
746 views

Pen test cell-phones

A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the ...
2
votes
2answers
106 views

How safe is Money Toolkit?

Money Toolkit is a smartphone app that can alert you to your balances and transactions across multiple accounts. I was reading their site and whether their practises are as secure as they claim to ...
2
votes
1answer
196 views

Does Verizon Wireless LTE network have intrusion prevention capabilities?

Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM. EDIT for clarity: I ...
2
votes
1answer
296 views

iPhone Credit Card Payment

I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I ...
2
votes
1answer
695 views

Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize?

I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager. I searched the Apple Developer ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
2
votes
2answers
228 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
2
votes
1answer
73 views

Is there a drawback for local log in compared to server log in?

For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
2
votes
1answer
1k views

How does a BlackBerry handheld connect to BES?

How does a Blackberry device connect to BlackBerry Enterprise Server (BES) for the first time? What are the security mechanisms used to protect against a rogue BlackBerry handheld trying to connect to ...
2
votes
1answer
402 views

Possible to use “Blackberry Protect” in conjunction with a BES IT Policy?

Is it possible to use Blackberry Protect in conjunction with a BES IT policy? If so, what settings are incompatible? So far I discovered that Memory encryption appears to be incompatible, but I'd ...
2
votes
2answers
458 views

Security evaluation of Vasco's Digipass Mobile SDK for OTP?

Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices? I am currently performing a full security evaluation of the solution ...
2
votes
1answer
185 views

What are best practices considering the use of Apple data protection?

Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but ...
2
votes
2answers
431 views

How secure is Goodlink for mobile phones when compared to Activesync?

Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink. One argument is the ...
2
votes
1answer
117 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
2
votes
0answers
548 views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
2
votes
1answer
208 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
1
vote
5answers
1k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
1
vote
3answers
170 views

Smartphone SSH clients with shared user

I am writing an application for smartphones to provide very limited SSH usage. The user cannot perform arbitrary actions when logged in. They can run a specific script(s) only. For various reasons ...
1
vote
1answer
359 views

How the shopkeepers are getting MAC address of wifi enabled smartphones

It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done? I have the similar issue.. how to get the MAC address ...
1
vote
3answers
651 views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
1
vote
1answer
439 views

Transparently authenticating users or devices on mobile devices

I have an interest in using EAP-TLS to authenticate both users and devices separately on mobile devices (phones, iPods, tablets, etc.). My issue is how to delineate between user authentication and ...
1
vote
3answers
244 views

How this kind of mechanism considered as vulnerability?

From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
1
vote
3answers
91 views

Is it possible to read files in a mobile phone for carriers through mobile network alone?

Say a smartphone does not have any (internet) data plans activated (no gprs, 3g data etc.). It just connects to the tower for calls. So is it technically possible for the carrier or law enforcement ...
1
vote
2answers
343 views

Is there any documentation or reviews about LINE messenger security?

I tried to find any documentation about the security of LINE messenger, but I couldn't. Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
1
vote
2answers
444 views

Is it possible to respect a user's privacy while collecting phone MAC addresses?

In London, there are trash bins that track a phone's MAC address and monitor the users movement from one location to another. I want to see if there is any best practice for collecting private ...
1
vote
1answer
136 views

How to verify data from localStorage on a server

This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit. On my mobile app, I am ...
1
vote
2answers
688 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
2answers
103 views

Can I instruct a Telco to prevent 2G connections from our phones?

Given that 2G is proven to be insecure (broken) at DefCon, is it possible for a Corporate IT department to work with the Telco and ban 2G connections for their devices? Some cell phones are unable to ...
1
vote
1answer
61 views

Checking if apk's contain malicious software [closed]

Is there a programmatic way to check if a given mobile application executable is malicious through some sort of lookup service? I have used Virustotal for desktop malware, does it work for mobile ...
1
vote
1answer
39 views

Does PCI DSS 1.4 include tablets and smartphones?

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the ...
1
vote
1answer
212 views

Security implications of shared credentials on private APN

It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example). In M2M applications such as ...
1
vote
1answer
116 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
1
vote
1answer
375 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
1
vote
3answers
218 views

Requirements for a smartphone anti-theft App

I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
1
vote
1answer
154 views

Would it be possible to extract user agent strings from 3G/4G Data

At a location where 3G/4G Data is prohibited, would it be practically possible to extract user agent strings from 3G/4G Data and compared to a list of known mobile browsers, assuming that the correct ...
1
vote
1answer
87 views

What function(s) to be used to generate Salt on Windows Mobile 6

I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for ...
1
vote
1answer
178 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
1
vote
1answer
149 views

Any risk of email configured for pop/imap access?

If my mobile phone is infected with some malware and the only connection I have to my corporate network is that the email client in the phone is configured for mail (pop/imap), what would be the risk ...
1
vote
1answer
457 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
1
vote
1answer
66 views

Authentication and removing the ability to replay information from a compromised machine

Consider this scenario. You have a client machine which is compromised, and a "master" machine which monitors that client's status (IsCompromised = {True|False}). The client has an agent which ...
1
vote
1answer
123 views

What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?

I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
1
vote
1answer
68 views

Starting point for Mobile Device Security particularly in a MDM setting?

I am looking for some good reference material (books, blogs, names, etc..) regarding Mobile Device Security. I am specifically interested in Corporate Mobile Device Management (MDM) where often ...
1
vote
1answer
236 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
1
vote
2answers
840 views

Is Webroot's Business Endpoint Security up to snuff for mobile workforce?

I'm in a small software company and getting ready to begin supporting 7 remote sales guys out on the road. They all have recent ultrabooks and most of the tools they will be using are in in the ...
1
vote
2answers
139 views

Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

Suppose an Activesync phone needs to be wiped because it was lost, stolen, or it was an employee termination. If we disable the account prior to wiping the device (or the device receiving the wipe ...
1
vote
1answer
443 views

Are there Bluetooth attacks on Smartphones that will not notify the user of the attack?

Are there Bluetooth attacks on Smartphones that will not notify the user of the attack? Specifically forcing a reset or opening an application.