New answers tagged

2

how does Android ensure that the throttling of failed authentication attempts is not by-passed during an offline attack? Android KeyStores can be hardware or software based previous to android N, which has made hardware KeyStore a MUST in the CTS. EDIT: In the below I am using the term online attack as something with the property Online entities ...


2

From what sources can an Android device be infected with malware? The most common problem is to install apps from outside the google play store, i.e. third party app stores or just by downloading an APK. Often these apps claim to be hacked versions of commercial apps, the next version of a popular game or similar. Installation of such apps requires ...


0

The key thing to remember about malware on Android is that you have to actually install the malicious app. Malware writers will use increasingly clever techniques to try and trick you into doing just that. So, can an android app on Google Play be fake or malicious? Yes, it might be. What can an Android malware/virus do? The vast majority of malware ...


2

You should NOT. First, you don't know if the file is trustable, you got it from some "source". It is never advisable to install APKs from untrustworthy sources, especially on your primary device. Second, it contains a known vulnerability. Third, it is an offline game, and it requires full internet connection(it may be because of ads, but you never know ...


0

Most older Android "root methods" are using kernel exploits or exploits for drivers or applications running as root. More hardened phones are often attacked by booting an purpose crafted image without security measures in place. Goal of both methods is to place a su binary on the device that allows the user to give access when needed, without any further ...


2

You are reinventing the wheel. I don't think the state of art really warrants creating a new app from scratch (OTOH if you want to do so for other reasons, like practising creating an app, then go for it). Note that with secure encryption, the third-party server wouldn't be able to snoop on the conversations (albeit it would be able to record metadata). And ...


3

A bit of a wild guess here: privacy and anonymity. Having worked on ePassport software, I can tell you that developers need to be extra careful when handling users' fingerprint and iris data. Think of how careful we are about storing usernames, passwords, credit card numbers, etc, then consider that in the case of a breach, passwords and credit card numbers ...


1

Android requires app updates to be signed by the same key as the original app. So unless the developers themselves have been compromised, a MITM won't be able to update existing apps. Note that this process is completely unrelated to SSL certificates. App signing certificates are self signed and don't rely on certificate authorities for trust. It sounds ...


0

I would not say that I am an expert in this so my point may not be valid. I quickly readed on Wikipedia On modern mobile devices such as smartphones, an over-the-air update may refer simply to a software update that is distributed over Wi-Fi or mobile broadband using a function built into the operating system From this quote we may note that the ...


4

However, for security patches, wouldn't a staggered release make it much easier for blackhat hackers to utilize the now-public vulnerabilities against users whose devices have not yet received the OTA, even though a patch for their device model is already available? Easier than what?, is the important question. Yes it will be easier for the hacker ...


54

Excellent question. Yes, your understanding is correct, as well as your rationale behind it. Staggering roll outs for new features often makes good sense. Staggering roll outs for security patches rarely is a good idea. As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited. Perhaps even more importantly, the ...


2

You can read the PCI standards here: https://www.pcisecuritystandards.org/document_library First of all find the regulations your app needs to follow, then check out specific cryptography / implementation related recommendations regarding CC data storage. They provide way more details than what we cound gather here.


2

It is as secure as the place where you store the CC encrypting key. Android features a keystore, which handles key generation, storage and usage for you. Your app talks to it via the KeyChain API. It offers some advantages: Each app can only access their own keys. The keystore enforces this for you. Key material is protected in case of app process ...


1

Another reasonably useful dataset that i've come across is: AndroMalShare - http://sanddroid.xjtu.edu.cn:8080/ (The domain name has changed at some point but can be found also at http://202.117.54.231:8080/#home ... and if not, the project seems to go as "AndroMalShare Project" ... so just Google that)


1

As the exposure is only to a few customers, it may be that the risk is low. That said, I'd err on the side of caution and treat the private key as having been compromised. This means revoking the signing certificate and creating a new one. (Applications signed prior to revocation will continue to be valid.) If you want to take a less cautious route, you can ...


1

You can easily do this by being a good, secure user. Follow the basic tenants of security, and be careful of what you install on your phone. After all games are great, but not when they're really viruses. Since it sounds like you're really going for a super secure phone with data archiving and backup, don't install something unless you KNOW it's safe, and ...


-3

You have already said the answer to your question: I want to use a few apps (Titanium Backup, Droidwall and maybe XPrivacy) with root access in a "secure way", which means: I want to limit the security implications described above to the least possible. Yes, use those apps to secure your phone, but I do not recommend you to install some credit card ...


1

To properly expand your thesis, you should probably read the rest of the article you posted. Under "Android and Google Service Mitigations" it explains the current posture of Google to deal with these threats. While the best solution is naturally to patch the OS at the lowest level the bug exists, it is effective enough to patch the apps in userland that ...


0

This is how I would do it. Have the web app generate a public/private pair (say DH). Show the public key on the screen as QR code, the user then scans it with the phone. From this point onward, the phone can send anything to the web app securely.


1

Until edits come I can only make assumptions, but it sounds like it's your Google account that has been compromised. Check what devices are signed into your google account, change your password, enable Multi Factor Authentication, and clear some caches.


0

You don't mention what phone it is, when the problem started or where you got it in the first place. I've found that some of the cheaper Android phones and tablets for sale on Amazon come with malware embedded in the firmware itself which installs all sorts of adware and helpful Chinese "utilities," even after deleting all the responsible apps and non-stock ...


4

An increasingly common attack is to use your Google Play Store credentials to force apps onto the device via the web page for the app. If you are seeing apps install automatically this is the likely source. In any event if you got malware on your phone, you really need to change your Google credentials and reset any 2fa tokens or app-specific passwords ...


0

I would just set up a wireless router and have both android devices and the PC connect to it. Most android devices have the ability to disable mobile data and thus force your connection to go over wireless.


1

My suggestion is a little different to what you asked: Download the app Packet Capture from the Google Play Store and install it on your Phone. Start the app, skip the generation of the root certificate (or generate one - this will help you decrypt SSL traffic), and start a capture. You can then capture and analyze packets directly on your phone - ...


13

It's All About the Security Model We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web browsers we have to keep in mind that they have different threat models. For example on desktop machines when designing an application we already know that there ...



Top 50 recent answers are included