Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

9
votes
8answers
4k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
0
votes
0answers
5 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
1
vote
0answers
38 views

Imei and phone number given to unknown sources. What are the risks?

The facts: A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend its Whatsapp account that was ...
1
vote
0answers
21 views

Is there a TOTP variant that does not require the user to type in a code? [closed]

We're considering a 2 factor TOTP solution on a mobile phone. However, it would be much easier for the user to somehow send the OTP to the server by pushing a button, rather than manually typing in a ...
4
votes
2answers
65 views

Why are apps for mobile devices more restrictive than for desktop?

Application devlopement for mobile devices is generally more restrictive, i.e. the apps runs in a sandboxed environment, they have many limitations when accessing the filesystem, etc. compared to ...
1
vote
1answer
197 views

Security: Oauth and Mobile apps

This is what I believe are the security implications of integrating Oauth using embedded webview vs browser in mobile application. Embedded Webview * Keep UI for mobile app Security implications ...
0
votes
1answer
58 views

Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place?

In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections. This site is full of ...
1
vote
0answers
78 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
3answers
121 views

How to detect the “Hello packets” sent by a wifi enabled smartphone

Actually I have a case where I should able to detect the mobile phones and get some data about the device available in my network range without connecting to the network. I have seen somewhere that a ...
0
votes
2answers
64 views

Protecting the remote database against tampering in a mobile app

This is the first time I face a mobile app deployment at big scale. This app needs to connect to a remote server where to store and retrieve data. I discarded connecting directly to the MySQL ...
11
votes
5answers
2k views

QR codes that can't be copied - possible?

I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one). It has to be photographed by our smartphone app, but the image will not be changed over a ...
1
vote
1answer
364 views

iOS: sandbox of an iphone app

I am new to iOS so I do have only limited knowledge about iOS in general. For self learning purposes, I would like to know several things as I am quite confused after searching the web. I do know ...
1
vote
1answer
112 views

How the shopkeepers are getting MAC address of wifi enabled smartphones

It is clear that some big mall's are tracking all the wifi enabled mobile phones before they are connected to the network..how can it been done? I have the similar issue.. how to get the MAC address ...
1
vote
1answer
55 views

GSM A5/1 encryption: Key management

I'm currently studying the A5/1 algorithm used for GSM encryption. I understood how thanks to the symmetric private Key and a public counter frame one can encrypt the communication between A and B. ...
2
votes
1answer
73 views

Is it possible to locate a cellphone's location just by ringing it?

With today's technology, is it possible to locate a cellphone's location just by ringing it, kind of like what we see in movies?
0
votes
1answer
83 views

What would be a valid approach to store private keys?

I'm implementing a mobile app which uses AES encryption algorithm to encrypt some critical values being sent to a remote server (basically, the user password), and then decrypted on the server side ...
85
votes
9answers
37k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked no problem, considering the ...
0
votes
1answer
96 views

Cellular Mobile Network Vulnerabilities - Is VPN the solution?

Do current mobile cellular networks like 3G offer enough security? The article from Info-Security states that 3G encryption cracked in less than two hours. Could a eavesdropper or ...
2
votes
1answer
112 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
13
votes
2answers
9k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
2
votes
2answers
344 views

Security evaluation of Vasco's Digipass Mobile SDK for OTP?

Has anybody worked with or integrated the Vasco Digipass Mobile SDK OTP generator into a custom mobile app for iOS devices? I am currently performing a full security evaluation of the solution ...
2
votes
1answer
2k views

How to track a Spoofed SMS on Iphone

A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
3
votes
1answer
93 views

Is mosh now recommended by the security experts? (2014)

Mosh has been around for a while now. Although it's claimed to be "a replacement for SSH" by its authors, mosh does actually depend on ssh to do the initial authentication, after which an instance of ...
4
votes
5answers
3k views

Track lost Android phone, if the thief is using it to access internet

I had a Samsung Galaxy S3, which got stolen recently but didn't have any built-in tracking software. But since the theft my friends often see 'me' on many online mobile chat applications. I conclude ...
5
votes
5answers
2k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
4
votes
4answers
156 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
0
votes
1answer
110 views

Performance of biometric authentication on cell phones as of 2014?

How well do the various biometric authentication methods currently perform in regards to precision and recall? Can anyone cite a relevant research article?
3
votes
1answer
68 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
1
vote
1answer
190 views

Is there any documentation or reviews about LINE messenger security?

I tried to find any documentation about the security of LINE messenger, but I couldn't. Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
4
votes
2answers
398 views

Cell phone voice mail hacking

The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
1
vote
0answers
115 views

Is it safe to use the official Facebook apps in a public Wifi?

I know, that my login credentials are sent in clear text for every body to read, when I log into facebook without using https from my mobile phone's browser in an public / non encrypted wifi. And I ...
5
votes
2answers
578 views

Spoofing USSD messages

I'm looking into USSD messages for a project I'm currently working upon and hoping someone can shed some light into spoofing. Firstly, I know it should be possible if you have the relevant ...
10
votes
3answers
1k views

Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
0
votes
1answer
283 views

What is the risk of leaking IMEI / IMSI numbers over a network

Should I worry if a developer programmed an app to send IMEI / IMSI number of the phone where the app is installed back to him? What can an attacker do with such information?
0
votes
0answers
29 views

Secure data with server and RSA? [duplicate]

the RSA system uses a private key to read the content encrypted with the public key. If I make a game for mobile, and want to save the data : I guess I cannot save the private key on the device. If ...
27
votes
5answers
27k views

How to trace a (mobile) phone?

Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless ...
2
votes
1answer
74 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...
2
votes
4answers
172 views

Tails like OS for Smartphones

In Jacob Applebaum's latest talk at the 30c3 conference, he advised all journalists to use Tails or similar OS for their laptops. Does anyone know of a similar OS or functionality for Smartphones? ...
5
votes
2answers
579 views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
5
votes
2answers
476 views

Is my SIM card vulnerable to DES cracking?

Srlabs have recently published article stating that many SIM cards can be exploited using vulnerability in DES: [...] While the option exists to use state-of-the-art AES or the somewhat outdated ...
-1
votes
1answer
70 views

physical access proof smart card for disk encryption [closed]

Current full disk encryption on mobile devices rely on low entropy passwords like PIN numbers or pattern locks. Being able to use a smartcard with such mobile devices is a tempting idea. I know that ...
12
votes
2answers
1k views

Ingress collects a lot of data - what impact could this have on my privacy or security?

The Augmented Reality game from Google, Ingress, has players travel to specific GPS locations to destroy and rebuild virtual targets, link locations, and team up with other players in order to carry ...
0
votes
2answers
111 views

Is there man in middle attack when using mobile phone calls?

My question is about the encryption between me and my mobile operator. My mobile operator uses A5/1. I use Samsung. Sometimes I see the symbol G on my phone which means GPRS. I don't know whether it ...
10
votes
3answers
549 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
2
votes
2answers
211 views

How to prevent user's mobile phone position tracked

Trying to follow up this post How to trace a (mobile) phone? , the answers on how to prevent being tracked while you own a mobile phone are: You cant. (even if you use disposable phones etc) 1) Why a ...
18
votes
4answers
8k views

Can A Powered Down Cell Phone be Turned On Remotely?

I know this is tin-foil hat fodder, but at least one judicial opinion (http://www.politechbot.com/docs/fbi.ardito.roving.bug.opinion.120106.txt) referenced a bug that could track/listen in on the ...
3
votes
4answers
244 views

Key-agreement protocol in a REST API

I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings. Since the app is in an early ...
0
votes
2answers
161 views

Does a simple mobile REST API need HTTPS?

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game). ...
1
vote
0answers
254 views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
0
votes
1answer
59 views

Hardware encryption for mobile data

Assume a requirement for creating a custom application for Android or iOS smartphones, which will send and receive data (documents, e-mails, etc.) to/from a corporate server, perhaps after local ...