Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

4
votes
3answers
1k views

What OS's will “brick” a stolen phone; preventing their use or resale by a potential thief?

You can look at this question in two ways: Prior to purchasing a used phone, I want to ensure that the IMEI is not locked and I'm able to use it fully. Or you can be a purchaser who wants to devalue ...
6
votes
2answers
439 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
5
votes
2answers
105 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
2
votes
2answers
67 views

Apple's OTA update process

When reading the iOS security doc, on page 6, it discusses the OTA update process. The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, ...
6
votes
1answer
169 views

Possible for Lync (Skype for Business) to adopt Activesync-style policies?

My compliance manager recently told me that Lync IMs should be treated as e-mail for compliance purposes. This also made me realize that our other email policies (encrypted device, pin required, etc)...
2
votes
1answer
74 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
0
votes
1answer
28 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
0
votes
1answer
30 views

What things can the other person see about my phone when I pair it using bluetooth?

I need to know some correct information about bluetooth pairing technology. What are the things which becomes visible to the person about my phone when I'm using bluetooth from my phone and pairing it ...
0
votes
1answer
88 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
-1
votes
1answer
27 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
107 views

Does WhatsApp use certificate pinning?

Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions: Update 02/21/...
-2
votes
1answer
82 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
13
votes
0answers
408 views

What unique device fingerprinting information can an iOS8 app collect?

As a follow-on to this question: What unique fingerprinting information can an iOS7 app collect? What remaining device fingerprinting privacy / security vulnerabilities still exist as of iOS 8? Can ...
3
votes
0answers
28 views

In mobile, can “Early Media” be sent from the phone?

Early Media, aka in-band information, is sent from the network to the calling phone in some circumstances, to provide alternative tones or extra information about the status of the call. In GSM this ...
3
votes
0answers
79 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
0answers
181 views

What unique device fingerprinting information can an iOS9 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? Apple has apparently ...
3
votes
0answers
425 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
0answers
57 views

Is it possible to overwrite a phone through physical means?

I am currently doing some research into the Apple vs FBI controversy. During my research, I found a Edward Snowden comment that claimed that the government can actually override a phone's data, ...
2
votes
0answers
75 views

Google/Apple account for corporate issued mobile phones

We are working on implementing MDM (Airwatch) for all corporate mobile devices (no BYOD will be allowed). But I have a question as what is the best way to avoid users use their personal Gmail or ...
2
votes
0answers
62 views

Can a Tsunami early warning turn “on” remotely some cell phones in Japan?

In Japan, some televisions and radios seem to be capable of getting out of sleep mode if a tsunami warning is issued. If tsunami warnings are issued, the Emergency Warning Broadcast system ...
2
votes
0answers
90 views

Does the Java version matter when compiling an Android, Amazon, or Blackberry app? (for security reasons)

I need to compile an app that will run on an Android, or Android compatible system (Android, Amazon Fire, or Blackberry). The developer documentation says that JDK 7 is needed, however there are ...
2
votes
0answers
87 views

Are old Android WebViews a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked through unpatched WebViews (in PhoneGap and other apps), exposing Activesync email data, and other sensitive information. To mitigate this, ...
2
votes
0answers
800 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
0answers
1k views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
1
vote
0answers
33 views

What information about a user can wireless carriers access?

What is the maximum amount of imformatiom about a user and the user's phone that can be obtained by a wireless carrier on a GSM network? Here is a list of the things I know, but are there more? IMEI,...
1
vote
0answers
36 views

What is the iOS securecoding feature, and what risks does it mitigate?

iOS 6 and newer allows for developers to implement a secure coding method that seems to prevent impostor objects from being de-serialized Can anyone explain what this would actually protect to the ...
1
vote
0answers
29 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
1
vote
0answers
33 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
1
vote
0answers
97 views

Sensitive Information Disclosure via plist on iOS, does this affect security at all?

The security team has found sensitive information which is disclosed in info.plist, API keys were also exposed. Fabric is being used and Fabric API key is the way to authenticate the users or their ...
1
vote
0answers
167 views

How to know our mobile number or phone has been hacked?

We have a Xiaomi Redmi 2 phone and a sim card in it. Yesterday we started receiving angry and swearing text messages. we called the numbers back and apparently a mass angry text messages have been ...
1
vote
0answers
85 views

Possible to use Cellular encryption data to validate Geolocation?

I need offline-verifiable, time stamped, GPS signals or its equivalent. Since cellular protocols include time stamps, encryption keys and other data, perhaps it's possible to re-use this ...
1
vote
0answers
94 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password ...
1
vote
0answers
45 views

Is SCEP safe if I use a different long and complex password per enrollment, and validate it against expected parameters?

I'm considering using SCEP to enroll iPads and other devices in my network. The iOS configuration profile allows me to configure a different password for each device. Is it valid, and safe for me to ...
1
vote
0answers
38 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
1
vote
0answers
869 views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
0
votes
0answers
15 views

Which bytes in an OTA Command Package are encrypted with the KIc by 3DES CBC?

I have an un-ciphered OTA message in clear and I am trying to cipher it so it becomes secure data. The cryptographic checksum is already generated as part of the un-ciphered OTA message. I have the ...
0
votes
0answers
75 views

For multiple clients it's better symmetric or assymetric encryption?

I'm a newbie in the encryption world so I'm here for asking which is the best solution between Symmetric and Asymmetric encryption. In our use cases, we have multiple clients that must be ...
0
votes
0answers
35 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
0
votes
0answers
451 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
0
votes
0answers
25 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
0
votes
0answers
108 views

Cellular Mobile ID number Sniffing

As far as I know, cell phones intermittently transmit a Mobile ID number to inform surrounding cell towers that the phone is available. Is this transmission encrypted, or would one be able to ...
-3
votes
0answers
64 views

How to check when SD card was removed from phone?

I just picked up my phone from a mobile repair service without my SD card. They did not only destroyed my mobile's display but also removed my SD card! I just want to know if there is any way to ...