Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
4answers
521 views

Can my phone be affected by malware through mobile phone signal?

My phone is newly bought. Can a hacker actually scan the mobile phone signal around me, detect it, and put virus/malware into my phone THROUGH the mobile phone signal of my mobile service provider? ...
4
votes
1answer
237 views

Why use “App Secret” in mobile applications?

I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why: I can ...
4
votes
2answers
316 views

Evernote hacked - precautions?

On March 2, 2013, the digital note taking system Evernote was hacked. Evernote has forced new passwords and have released new updates to Windows, Windows phone and iOS of their client software. ...
4
votes
2answers
346 views

iPhone - logging out user when app goes into background

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs ...
4
votes
1answer
936 views

Does KASUMI (A5/3) Related Key attack apply to 3G or other mobile providers?

The KASUMI is a block cipher used to encrypt UMTS, GPRS, and GSM SMS messages. The references section in Wikipedia says that a related key attack is possible in 3G systems. Q: Has it been proven ...
4
votes
3answers
214 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
4
votes
2answers
78 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
4
votes
1answer
2k views

Intercepting and reading SSL traffic generated by Android

I am trying to use my PC to capture, decrypt and analyse traffic from SSL sessions on my android tablet. So far, I have a ZAP proxy server set up, with a CA generated. On my android device, I have ...
4
votes
1answer
133 views

Is access to the caller API in mobile phones a real security threat?

From time-to-time I receive "Unknown" caller on my mobile phone. I do not want to answer those calls as I do not trust the identity of a caller. I feel safer if I can see caller name or at least ...
4
votes
2answers
779 views

Blackberry QNX / Playbook encryption details

Now that Blackberry received FIPS 140-2 certification for one of it's QNX devices, does anyone have technical specifics on how data is encrypted on both mobile phones or the Playbook tablet? I'm ...
4
votes
1answer
1k views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
4
votes
3answers
402 views

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
4
votes
2answers
189 views

Difference/Relationship between data leakage analysis and vulnerability analysis?

What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis? I have to give ...
4
votes
2answers
537 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
4
votes
1answer
674 views

What unique fingerprinting information can an iOS7 app collect?

I'm interested in unique information that is beyond typical user knowledge or control. As of iOS 7, users can easily protect local physical tracking by controlling radios (cell, WiFi, Bluetooth) in ...
4
votes
1answer
812 views

Security Implications of Private/Corporate APNs

I'm interested in what (if any) the practical security implications of a company making use of a Private APN are as opposed to using a standard network provided APN and VPN connection back to the main ...
4
votes
1answer
1k views

Would introducing client certificates for a mobile app improve security?

I have developed a REST API which has been configured to only operate over HTTPS. The sole purpose of this API (at least for the moment) is to operate as the backend entry point for a mobile ...
4
votes
1answer
448 views

Implementation of Blizzard's Mobile Authenticator

How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
4
votes
1answer
240 views

What are best practices considering the use of Apple data protection?

Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but ...
4
votes
1answer
543 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
4
votes
2answers
135 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
4
votes
2answers
284 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
4
votes
1answer
6k views

IP address, iphone, Snapchat

My child is being accused of doing some improper things via Snapchat, but he swears that he did not do anything, and he is the type of person who probably would not. The only thing the police are ...
4
votes
2answers
193 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
4
votes
1answer
1k views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
4
votes
1answer
2k views

Authenticating users on offline devices such as ipad

We are wanting to authenticate the user inside a webapp (JavaScript/HTML inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realize this ...
4
votes
1answer
119 views

Is there such thing as a smart phone with auto-forget password feature?

Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
4
votes
1answer
332 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...
4
votes
0answers
76 views

Are mobile phone calls cached by the network? [closed]

While transmitting a phone call from one mobile phone to another across several carriers, I assume it may be necessary to buffer the audio data for a few seconds. My questions: a) Is it true, ...
4
votes
2answers
88 views

How am I supposed to verify the origin of a sign-in page in a web view? [duplicate]

I just had to sign in into my google account in an iPhone app. It's a third party, that only uses the google account for authentication. The familiar google sign in page appeared in what is known as a ...
3
votes
4answers
700 views

User-to-user encryption in addition to SSL for mobile phones?

I have learned that SSL is a protocol to implement machine-to-machine encryption and that there are protocols, like PGP, which implement user-to-user encryption (end-to-end encryption). There are ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
3
votes
3answers
6k views

Intercept data sent via bluetooth

I am trying to re-write a closed-source application, originally deployed on mobile devices, that lets you command and control a certain type of mechanical robots via bluetooth. The new application I ...
3
votes
2answers
2k views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
3
votes
3answers
2k views

Can malware on my computer infect my phone?

Suppose my computer is compromised or has malware. Can the malware spread to my phone? If so, how? Has any malware been observed in the wild to do this? Relevance: Some banks use two-factor ...
3
votes
3answers
118 views

Is it safe returning or giving away a sim card you already used?

I bought a prepaid sim card and used it on my android, but i had a problem using it and would like to return it. Is it safe to do so? I'm wondering if it could now contain my personal information ...
3
votes
4answers
300 views

Securing Data at Rest in Android

Here's a situation. I am the author of an app that allows my customers to stream videos on their local android device. I also allow them to download the video and store it locally on their android ...
3
votes
1answer
1k views

Track an Android phone through its IMEI

My mobile phone got stolen few days back. I tried all possibilities to track it, the only option is through IMEI. Can I know which SIM card is running on that specific IMEI?
3
votes
3answers
3k views

Do telecom operators listen to every phone calls

I usually don't answer unknown numbers. Few days back i got couple of calls from unknown numbers and i didn't answer it. That evening i had contacted one of my lady friend and the next day i got a ...
3
votes
2answers
121 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
3
votes
1answer
4k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
3
votes
4answers
119 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
3
votes
2answers
1k views

IKEv2 vs OpenVPN

I want to ask you for information about the IKEv2 protocol for a VPN connection. I haven't found so much information on the web. I am interested especially regarding the usage on a mobile phone. Is it ...
3
votes
2answers
849 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
3
votes
3answers
762 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
3
votes
4answers
2k views

If a thief has the phone in their possession, how can Password Recovery be implemented securely?

Standard password recovery involves sending a password reset mechanism to the user; either to email, sms or telephone call. However, if a phone has been stolen the thief has full access to these ...
3
votes
1answer
125 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
3
votes
2answers
73 views

Mobile apps and apps store security

This question is with regards to mobile apps and apps stores. Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use ...
3
votes
2answers
2k views

How can I get a fiddler-style trace of an iPhone / Android?

I want to audit the HTTP and HTTPS activity of apps downloaded onto my mobile device. What is the best way to do this? I own the device, can add a root certificate, and can connect the running ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...