Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.
8
votes
2answers
524 views
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
We have several smartphone with encrypted data on them (BES, iPhone, Android) and want to prevent an unauthorized person from downloading information from the device via USB.
The visual assumption ...
26
votes
5answers
4k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
12
votes
5answers
1k views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
8
votes
5answers
528 views
Protect application from being modified
I have a question about how to protect a program from modification if that program is able to communicate with a remote validation server. More specifically I'm asking for android APK file, but it can ...
3
votes
3answers
5k views
Is Android's Password Screen Lock Enough Data Theft Protection?
With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply ...
5
votes
6answers
4k views
Blocking insecure iPhones from accessing ActiveSync
Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In ...
11
votes
2answers
2k views
Smartphone / GSM Sniffer
This question would be in the category of SmartPhone Sniffers.
So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
9
votes
4answers
483 views
Vulnerabilities common only in mobile solutions?
I was wondering if there are any threats for web-applications used on mobile phones that haven't been known in the "full size" browsers earlier.
I haven't heard of any serious or common problems that ...
8
votes
4answers
1k views
QR codes that can't be copied - possible?
I assume this is impossible, but I need to find a barcode (that can contain a url, i.e., a QR style one).
It has to be photographed by our smartphone app, but the image will not be changed over a ...
6
votes
4answers
2k views
How effective is iPhone 3GS and 4 encryption?
My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device.
In that context how effective is iPhone 3GS and 4 encryption?
5
votes
7answers
1k views
What security risks exist in cell phone apps' data transfer?
Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
10
votes
5answers
1k views
Do mobile OS's provide crypto-quality randomness?
Which mobile OS's provide a primitive to generate crypto-quality randomness that applications can use?
On desktop systems, these features are pervasive. Unix provides /dev/urandom. Windows provides ...
7
votes
3answers
356 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
4
votes
1answer
270 views
How does the mobile security technology APNS and 3LM work?
APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones.
I recently got off the phone with Boxtone and they said they ...
13
votes
5answers
2k views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
10
votes
4answers
2k views
What risk does Carrier IQ pose, exactly?
There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out.
My questions: What exactly does Carrier ...
8
votes
4answers
3k views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
4
votes
1answer
469 views
Blackberry + RIM Bluetooth-based Smart Card Reader
Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?
Can you tell me if it's possible to require only the presence of the card + card ...
11
votes
3answers
273 views
Malicious QR Code and Mitigation
I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today.
I scanned a QR Code on a postcard I received, and it ...
10
votes
8answers
477 views
iPhone Tracking debacle - risks and countermeasures
For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
6
votes
4answers
3k views
Are the iPhone “connect the dots” passwords secure?
A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this:
Is this kind of passwords secure from brute force ...
4
votes
3answers
6k views
Which type of encryption algorithms android supports, and which would be better?
I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports.
Regarding DES and AES (As wiki documentation) ...
26
votes
1answer
5k views
iOS Encryption Details
Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices?
The Apple marketing material here, ...
17
votes
5answers
13k views
How to trace a (mobile) phone?
Even since growing up, I've watched films in which the "bad guy" is repeatedly tracked down when they call the police or FBI or police force de jour. They always have "about 30 seconds". Regardless ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
10
votes
7answers
3k views
What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?
I'm interested in updating this two pronged question for 2011:
What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective?
What cryptology is most ...
23
votes
2answers
966 views
What is the attack tree to intercept traffic on Wimax?
My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
17
votes
2answers
411 views
Security threats of wireless charging?
It is well known that plugging your mobile device for charging in public/uncontrolled places through Micro-USB can be a security hazard. USB protocol supports much more than just transferring power, ...
5
votes
10answers
464 views
Can a compromised mobile phone be used to penetrate a desktop or server?
Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play?
I don't know what protocol the transfer is ...
7
votes
5answers
817 views
Best practices for securing an iPhone
As this question on voicemail protection got answers veering more to protecting the mobile phone, I thought I should add a specific question on this topic.
There is already a question on protecting ...
6
votes
3answers
278 views
Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?
According to this accepted answer, there is no phone on the market today that is immune from "Juice Jacking"*. I think an easy way to mitigate this threat is to have a filter that blocks USB pins 2 ...
2
votes
1answer
148 views
Data remanence on mobile devices
The methods in which data should be deleted is strictly enforced by the DoD as well as others security sensitive organizations. However, there are complications with deleting data on an SSD.
Given ...
8
votes
2answers
2k views
Is doing credit card transaction via 3G secure?
3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
6
votes
4answers
517 views
What is your process for wiping a lost Blackberry or similar device?
For all devices I know of, if a device is lost or stolen, it needs to be connected to the Cellular network to receive the wipe command. Considering that the end user often needs to regain mobile ...
4
votes
4answers
484 views
Top Mobile Device Security Concerns? [closed]
What does everyone see as the top security concerns for mobile devices at the present time? I am working on a paper on the topic, but it seemed worth asking here to see if I might have missed ...
3
votes
1answer
281 views
Does KASUMI (A5/3) Related Key attack apply to 3G or other mobile providers?
The KASUMI is a block cipher used to encrypt UMTS, GPRS, and GSM SMS messages. The references section in Wikipedia says that a related key attack is possible in 3G systems.
Q: Has it been proven ...
1
vote
3answers
432 views
Self sign SSL certificate for my mobile app?
My mobile (iOS and Android) connects to my server via a REST API over HTTP. I would like that HTTP to be secure, so HTTPS seems to be the obvious choice. All of the questions about self signing SSL ...
