Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

14
votes
7answers
3k views

Are jailbroken iPhones an enterprise security risk?

Background My company is currently in the process of rolling out support for the iPhone. As a part of this rollout, they are requiring employees to install an application on their phones that allows ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
12
votes
2answers
4k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
11
votes
1answer
384 views

What did Blackberry do wrong?

The NIST defines a vulnerability in RIM Blackberry encryption discovered last October. Apparently, Blackberry's flavour of PBKDF2 was weak. They say: The offline backup mechanism in Research In ...
4
votes
1answer
840 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
9
votes
5answers
746 views

Protect application from being modified

I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
5
votes
3answers
11k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
11
votes
5answers
3k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
11
votes
5answers
1k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...
4
votes
4answers
327 views

Data categorization: Critical or not

I need to provide two means for securing data within my application. First is using the Operating System sandboxing model (I am talking about Mobile Phones OS) and the second using the OpenSSL AES ...
6
votes
2answers
503 views

Cellular phone cloning

It is known that certain methods of authentication are used to tie a particular device to a particular phone number, so that cloning can be prevented. What are these authentication mechanisms? ...
14
votes
5answers
2k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
4
votes
2answers
455 views

Cell phone voice mail hacking

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
2
votes
1answer
796 views

iOS/Android authentication and security

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security? Each user will have their own private database on the cloud. He will have his local ...
5
votes
7answers
2k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
3
votes
1answer
810 views

How to secure an application under iOS against jailbroken devices

I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device. I couldn't find online how to check that a device is jailbroken. Please anyhelp ...
2
votes
1answer
362 views

Secure implementations of G2/G3/G4 cellular technology

It appears that GSM is like any other technology, and is only as secure as its implementation. What implementations are known to be secure or insecure due to a fault on the implementor's side, or due ...
26
votes
6answers
3k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
7
votes
4answers
3k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
9
votes
4answers
5k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
8
votes
1answer
1k views

How should I protect in-app Android payments when using a separate server?

I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for. I have a simple application to view server-generated content. I want to allow the user ...
10
votes
8answers
646 views

iPhone Tracking debacle - risks and countermeasures

For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
5
votes
4answers
450 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
9
votes
5answers
649 views

Can a mobile phone battery contain malware?

It has 3 terminals and is presumably a smart battery. I bought it on ebay recently for $2.74 USD and that included postage from China to Australia. It would normally retail for maybe $40 - $50. The ...
8
votes
3answers
6k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
3
votes
1answer
2k views

How do you erase a Blackberry without having direct access to the server?

I have a Blackberry with no access to the BIS or BES server that managed it. How does one erase and reset the device to defaults?
2
votes
1answer
410 views

Possible to use “Blackberry Protect” in conjunction with a BES IT Policy?

Is it possible to use Blackberry Protect in conjunction with a BES IT policy? If so, what settings are incompatible? So far I discovered that Memory encryption appears to be incompatible, but I'd ...
10
votes
2answers
1k views

Caller ID Spoof and Text Spams – How do they work?

(Posted here after a comment/suggestion from: http://superuser.com/questions/254340/caller-id-spoof-and-text-spams-how-do-they-work. Apologies if deemed not appropraite) A lot of people will have at ...
2
votes
1answer
775 views

Pen test cell-phones

A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the ...
3
votes
1answer
158 views

Which is more secure: develop a mobile app in its Native language or using cross-platform UI?

I am just wondering if there are benefits from a security perspective to develop a mobile App either as native app or as a cross-platform UI app, in particular Rhodes? I need to develop an application ...
4
votes
1answer
848 views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
9
votes
3answers
2k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
8
votes
4answers
726 views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
11
votes
5answers
2k views

Do mobile OS's provide crypto-quality randomness?

Which mobile OS's provide a primitive to generate crypto-quality randomness that applications can use? On desktop systems, these features are pervasive. Unix provides /dev/urandom. Windows provides ...
7
votes
4answers
819 views

What is your process for wiping a lost Blackberry or similar device?

For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
13
votes
7answers
7k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
7
votes
3answers
2k views

User “home directory” on iPhone, Android, Windows mobiles and Blackberry

Is anyone aware of any mobile (iPhone, Android, Windows mobiles and Blackberry) Operating System that support multi users? I am not aware but I thought it is worth double checking. Off course, in ...
8
votes
2answers
2k views

3DES vs DES for VPN connections

I'm trying to get Android 2.1 phones to connect to our corporate VPN, but it would appear they only support DES rather than 3DES for encryption. Is it safe to use DES, am I going to get hacked if I ...
4
votes
2answers
1k views

On iOS, what's the benefit of OpenSSL over using CFStream, CFNetwork etc. for secure sockets?

I asked this already on Stack Overflow, here. I was told I might find answers here.
27
votes
1answer
6k views

iOS Encryption Details

Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices? The Apple marketing material here, ...
7
votes
1answer
421 views

Should iPhone backups be encrypted? Is this in-scope for Corporate IT if the device is linked to a home pc?

iPhone backups may reside on a computer that is outside of IT Policy (Home PC) and therefore doesn't have any Corporate IT protections on it. If this home PC was stolen or hacked, then the iPhone ...
5
votes
6answers
6k views

Blocking insecure iPhones from accessing ActiveSync

Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint? In ...
3
votes
1answer
388 views

Do you know any .xry reader for MacOS/*BSD or Linux?

I am looking for a .xry reader (software) that works on mac/*bsd/linux in order to perform a forensic analysis. Can you suggest one?
7
votes
4answers
2k views

How effective is iPhone 3GS and 4 device-at-rest encryption?

My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device. In that context how effective is iPhone 3GS and 4 encryption?
7
votes
1answer
134 views

What was the issue the UAE had with RIM/Blackberry and what was the outcome? What countries have similar agreements?

I'd like to understand what came out of UAE's desire to monitor RIM traffic, and what technical compromise was made. Do other countries have similar agreements with RIM? What are the details? ...
7
votes
4answers
613 views

What security settings are likely used in Obama's Blackberry?

It's widely publicised that Obama has a blackberry, but it isn't clear to me what security settings are employed by the NSA or what private businesses can learn from his configuration? What is known, ...
11
votes
4answers
668 views

Vulnerabilities common only in mobile solutions?

I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier. I haven't heard of any serious or common problems that ...