Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

5
votes
10answers
610 views

Can a compromised mobile phone be used to penetrate a desktop or server?

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play? I don't know what protocol the transfer is ...
9
votes
8answers
7k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
6
votes
4answers
4k views

How to harden an iPhone/Android app so its tough to reverse-engineer it?

These are the following objectives I have in mind: Make the app hard to crack, as the binary will hold some secret tokens. If it still can be cracked, is there any way the app can tell someone or ...
13
votes
3answers
336 views

Malicious QR Code and Mitigation

I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today. I scanned a QR Code on a postcard I received, and it ...
3
votes
3answers
699 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
1
vote
1answer
369 views

How should I block BIS connections from accessing my Exchange Server

BIS is a technology from Blackberry that allows end users to connect to an Exchange server without a BES server. The problem is that BES asserts a security policy on the devices, and BIS does not ...
2
votes
1answer
501 views

How secure are native iPhone - PUSH Services

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service? ...
4
votes
4answers
650 views

Top Mobile Device Security Concerns? [closed]

What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
2
votes
1answer
877 views

Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize?

I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager. I searched the Apple Developer ...
7
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
10
votes
2answers
695 views

What else can be sniffed?

I'm a pentest newbie. Recently I've learned about sniffing in LANs. From the books and internet resources I'm studying, the sniffing (or packet capture) is always done on either Wired LANs (Ethernet ...
10
votes
3answers
3k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
7
votes
1answer
317 views

How are alternative operating systems even possible to load on a mobile device?

The whole idea of a signed boot image is to prevent replacing the boot image with something customized or malicious. However, the entire process seems to be reliant on a single point of failure: the ...
6
votes
3answers
4k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
8
votes
3answers
38 views

Active measures against lost or stolen PDAs in healthcare?

Many physicians, nurses, and technical staff like to carry PDAs to be kept abreast of patient conditions. Various companies want caretakers to view ECGs on their iPads. Due to the incredibly private ...
2
votes
2answers
1k views

Guidelines for secure iPhone application development

Are there any security guidelines for development and assessment of (native) iPhone applications?
3
votes
1answer
198 views

What are best practices considering the use of Apple data protection?

Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but ...
14
votes
4answers
4k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
3
votes
3answers
176 views

Resources/tools for controlling access to corporate email on smartphones

If one of our employees has access to corporate email on a smartphone I want to make sure that if they lose the phone then whoever finds it can't get at any corporate email on that phone. For iOS ...
2
votes
2answers
231 views

Securing iPads and laptops in an enterprise

We have users in our organization who own iPads and we'd like to connect them to the network; however, if the users download and store sensitive data on the devices, that can pose a security issue. Is ...
12
votes
2answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
2
votes
1answer
75 views

Is there a drawback for local log in compared to server log in?

For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
21
votes
2answers
1k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
5
votes
3answers
458 views

Detect spy software on Symbian

I would like to check a Nokia N8 for possible software that might send any kind of data without my consent. Is there a specific tool to achieve this? Are there specific techniques?
14
votes
3answers
421 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
5
votes
3answers
438 views

Should we store meeting minutes on an iPad?

Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, ...
5
votes
3answers
681 views

Why would configuring a Blackberry to turn radio off when charging help with security?

A friend's work Blackberry is configured so that phone and Internet access are disabled while the device is charging. I assumed this was a fault, but apparently it's a deliberate security policy. Has ...
2
votes
2answers
471 views

How secure is Goodlink for mobile phones when compared to Activesync?

Some of our more technical users are arguing to use Activesync for their phones, while the corporate standard is limited to Blackberry and any device that supports Goodlink. One argument is the ...
4
votes
1answer
322 views

How does the mobile security technology APNS and 3LM work?

APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones. I recently got off the phone with Boxtone and they said they ...
12
votes
2answers
1k views

Protecting cellphones from USB attacks (a.k.a. Juice Jacking)

We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB. The visual assumption ...
3
votes
1answer
3k views

Scan for mobile phones?

I'd like to measure queuing time, similar to what they're doing in Finland. Instead of detecting bluetooth (which is disabled in most phones) I thought of detecting EDGE/3G. I'd like to log the ...
5
votes
2answers
549 views

Mobile phone security eavesdropping based on data transfer

is there an easy way for particular governmental organizations (especially in countries where freedom of speech is a problem) have some technology where they can easily eavesdrop on cellphone internet ...
6
votes
1answer
6k views

Mobile numbers capture and transmit data

will it be possible to build a low cost hardware/software device which can capture mobile numbers within a specified radius and then use that information to transmit an sms to those numbers? From what ...
1
vote
1answer
91 views

What function(s) to be used to generate Salt on Windows Mobile 6

I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for ...
3
votes
1answer
1k views

How does a BlackBerry handheld connect to BES?

How does a Blackberry device connect to BlackBerry Enterprise Server (BES) for the first time? What are the security mechanisms used to protect against a rogue BlackBerry handheld trying to connect to ...
4
votes
3answers
437 views

Preventing users from tampering with replay data [duplicate]

Possible Duplicate: Protect application from being modified This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
6
votes
4answers
5k views

Are the iPhone “connect the dots” passwords secure?

A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this: Is this kind of passwords secure from brute force ...
21
votes
5answers
3k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
14
votes
7answers
4k views

Are jailbroken iPhones an enterprise security risk?

Background My company is currently in the process of rolling out support for the iPhone. As a part of this rollout, they are requiring employees to install an application on their phones that allows ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
13
votes
3answers
4k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
12
votes
1answer
403 views

What did Blackberry do wrong?

The NIST defines a vulnerability in RIM Blackberry encryption discovered last October. Apparently, Blackberry's flavour of PBKDF2 was weak. They say: The offline backup mechanism in Research In ...
4
votes
1answer
865 views

Which encryption algo should be best for an Android application [duplicate]

Possible Duplicate: Which type of encryption algorithms android supports, and which would be better? I am confused about to use of DES. Triple DES, RSA and AES algorithms, I think I ...
9
votes
5answers
802 views

Protect application from being modified

I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
5
votes
3answers
12k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
11
votes
5answers
3k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
11
votes
5answers
1k views

Best practices for securing an iPhone

As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic. There is already a question on protecting ...