Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

0
votes
0answers
17 views

Windows mobile native application do have CSRF? [migrated]

I developed a windows mobile application which connects back to my web services hosted on internet to sync with the server data. I didnt put any control for CSRF on mobile application, Is it required ...
1
vote
1answer
91 views

Mobile, WebServices and SSL

I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the ...
-3
votes
0answers
36 views

Preview of Planned Backdoors in Smart phones and their OSs [on hold]

I want to know if there are planned backdoors or not in hardware and its OS. I am not interested in those backdoors which come and go. However, note that there can be agreements between the ...
1
vote
2answers
30 views

Mobile apps and apps store security

This question is with regards to mobile apps and apps stores. Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use ...
2
votes
6answers
82 views

Deterring Mobile phone Tethering in the workplace

How do you put in controls to prevent a staff using his/her mobile phone to tether 3G/4G connection and download unauthorized files onto the office PC? Of course minimally there must be an AV in ...
0
votes
0answers
15 views

What OpenID Connect authorization flow to authenticate mobile app users?

I am building a cross-platform mobile app that interacts with a RESTful API, and I want to use OpenID Connect to authenticate my users. I will be building my own OpenID Connect provider server. ...
0
votes
1answer
16 views

Possible for Lync clients to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, ...
0
votes
1answer
3k views

What is the risk of leaking IMEI / IMSI numbers over a network

Should I worry if a developer programmed an app to send IMEI / IMSI number of the phone where the app is installed back to him? What can an attacker do with such information?
0
votes
2answers
44 views

Mobile App Security vs. Traditional PC Desktop Security In The New Era

I have been using a Windows PC for many years now. Since Android has come to market, I have been very wary of installing apps that require unrelated permissions. Obvoiusly, these extra permissions ...
8
votes
3answers
8k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
0
votes
2answers
213 views

When Activesync policy is applied to iPhones allows thumbprint-unlock, while Android does not. Which is correct?

We have a long-standing ActiveSync device policy that requires an unlock code for all phones that use corporate email. It seems that iPhones with "swipe to unlock" and Android phones with similar ...
31
votes
5answers
41k views

How to trace a (mobile) phone?

Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless ...
1
vote
1answer
68 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
0
votes
1answer
146 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
3
votes
1answer
434 views

Is it safe to use the official Facebook apps in a public Wifi?

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi. And I ...
0
votes
2answers
256 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
1
vote
1answer
217 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
3
votes
2answers
177 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
2
votes
1answer
157 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
9
votes
3answers
2k views

Suitable cipher for SMS encryption

I would like to create application for encrypting SMS messages. After long enough discussions I decided to use symmetric encryption, since handling public/private keys issue is too difficult for most ...
0
votes
1answer
42 views

Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?

If I'm using something like Authy for soft tokens for my users, and they log into the web application on the mobile device itself, haven't they just lost the benefit of 2FA (ie loss of the mobile ...
6
votes
2answers
333 views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
2
votes
2answers
181 views

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
23
votes
2answers
3k views

Why do I need to hide my phone's IMEI

If it is a secret then why is it visible on the box, invoice and the back of the phone? If it is not a secret then why does it have to be blurred when it gets posted online?
10
votes
4answers
2k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
1
vote
0answers
36 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
1answer
87 views

Tracing a text message

Good afternoon, Is there anyway to trace a text message? As far as the real phone number that the text is being sent from? Or the location of where the text is being sent from? I've been getting ...
2
votes
1answer
304 views

Can my phone be hacked just by being called?

I recently found a site, Cell-Spy-Stealth.com, that claims to sell spyware which can be targeted on a phone by simply making a call to it: "It will work even if you get the voice mail, or if the ...
-5
votes
1answer
76 views

How to find phone number of any user in a specific area? [closed]

I have learned about IMSI catchers but also read that one can not get the phone number through that IMSI. Lets suppose I want to collect the phone numbers of all people in a college/ shopping mall/ ...
3
votes
5answers
2k views

Strange android app … possibly a mass malware?

I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page ...
1
vote
1answer
88 views

TextSecure/WhisperPush instant messaging by Open Whisper Systems: End-to-end encrypted or not?

Open Whisper Systems claims that its TextSecure messaging is end-to-end encrypted, but at the same time there are now some rather serious allegations of how it might be betraying its users. If I ...
9
votes
1answer
4k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
2
votes
2answers
298 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
16
votes
3answers
2k views

Is my phone carrier monitoring my traffic?

Today I started using a VPN on my phone (nexus 5), and after I switched on mobile data and turned off my WiFi, I received a text message from my carrier offering me roaming packages for Europe (which ...
3
votes
2answers
141 views

Application communication monitoring

I am seeking a way to monitor communication between Android applications in order to detect their suspicious behaviour but I am not sure where to start the development process from. As far I have ...
5
votes
5answers
3k views

Is there a reason to protect SIM with PIN?

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found. If phone would be losed then it will be harder to find an owner for people that ...
-4
votes
2answers
113 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
0
votes
0answers
36 views

Do iOS applications have access to the certificates installed?

As the title says, I'm curious if a generic iOS application can access/retrieve the certificates installed in the device (e.g., via a management profile) Thanks
0
votes
3answers
68 views

How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
0
votes
3answers
83 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
25
votes
4answers
11k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
3
votes
1answer
104 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
3
votes
1answer
87 views

Why use “App Secret” in mobile applications?

I see some SaaS require to import "App Secret" into your application also with "Application Key". I understand the "Applicaton Key", but can not understand the "App Secret". Here is why: I can ...
1
vote
1answer
137 views

How does authentication work without OAuth in mobile apps?

I have a (Drupal) website that needs a companion mobile app for some stuff (quite customized, not just creating/viewing nodes). I know I can use OAuth for this, but I was wondering about alternatives ...
-1
votes
1answer
26 views

TPMs available on mobile with application access [closed]

I am looking for a mobile device, preferably a smartphone or a tablet, that contains a TPM (v1.2 or 2.0) and provides application access to it through an API. Does anyone know if any such devices ...
10
votes
2answers
2k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
2
votes
1answer
71 views

Android app isolation risks & implementation

Are Android apps, specifically Chrome, isolated? Can other apps listen to other apps' activity? If so, how can apps be sandboxed?
9
votes
4answers
9k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
1
vote
1answer
72 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
32
votes
3answers
6k views

Why is GSM still used?

GSMs vulnerabilities have been known a long time now. UMTS was supposed to fix those problems. Why is GSM still used?