Tag Info

New answers tagged

0

What do you define as unauthorized app? For example if your (Android)-users install a new keyboard, the author of this keyboard "could" read all information a user types with it. Android even warns about this, but not every user listens to warning labels...


0

From what I understand. You know what it's like to be under surveillance. You want to keep anonymity. Your threat model doesn't include TLAs (FBI, NSA, etc.) You want to visit websites more than communicate with others. So... First. Use a small laptop, not a phone. ANY (Android, iOS, Windows)phone leaks data like crazy. Google: SS7, IMSI Catchers. Use ...


-2

All publicly disclosed touchjacking attacks depend on inserting a malicious layer into webviews, not on an unrelated piece of malware. Assuming you are only installing from a trusted source (i.e. signed code from Good) via a trusted platform (Google Play, Apple Store, Microsoft whatever) then touchjacking attacks are unlikely.


2

Using the source listed for the SSL Socket object in the Android API Client Side +-------------------------------------------------------------------+ | Protocol | Supported API Levels | Enabled by Default (API Levels) | +-------------------------------------------------------------------+ | SSLv3 | 1+ (BASE) | 1+ (BASE) ...


10

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable. We have the habit to use firewalls on desktops/servers because they are available and every layer of ...


1

Doesn't that mean that my phone is practically open for access by anyone? You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing ...


1

There's also the Xposed-Framework module XPrivacy which allows very advanced permission management. AFAIK this soultion gives the most possible control over the permissions of an app. However you need some deeper knowledge to fully understand all the possibilities. It follows the idea of providing mock(fake) data instead of just denying the access to it. ...


0

CyanogenMod already has this feature. You can set every permission for every app on Allow, Ask everytime or ignore the request. There are also apps like "Permission Manager - App ops" or "F-Secure App Permissions" which are able to show and disable the permissions for your apps.


1

To my knowledge, CyanogenMod allows you to modify each app's permissions at any time after install. When an app requests a service that you've blocked in this way, the call will fail and throw a java.lang.SecurityException. Android Marshmallow will partially bring this feature to stock Android, ie some permissions will be modifiable after install, but ...


0

To your questions: [...] I don't have ability for user to login with social network accounts and other Oauth2 servers in the network [...]. You will need your own OAuth authorisation server, that will manage your resource server. The OAuth server from Google, Facebook, Twitter, etc., will not help because, as far as I know, can only grant ...


3

The factory reset on any phone/computer shouldn't be trusted, as it can be modified by the system and thus becomes a heaven for malware that wishes to persist. This also applies to the Windows 8 "refresh my PC" feature, the "recovery partition" nonsense OEMs put up to avoid supplying $0,01 recovery DVDs (which are write-once media and can't be compromised) ...


-1

It is possible, I personally haven't seen or heard of any malware that flashes the rom. It would need to be very sophisticated malware with root privileges to flash the rom in the first place, in addition flashing the rom would be a very visible process. Factory resetting the phone will as the name suggests reset the phone and wipes everything, including ...


0

As many people already wrote in comments, this is not about MMS, but about a bug in the multimedia library, so disabling MMS will only help to avoid your phone being hacked, when you do not use it, but keeps it turned on and connected to the cellular network. If you use your phone, you could still be hacked through web browser or ANY OTHER APP, that works ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


1

The best solution is when ettercap does not MiTM the SSL connection, just forwards it to Burp, and Burp can be set up as a transparent SSL MiTM proxy. In this case, the client will see Burp's server certificate, which has to be trusted by the client. As you can see on the following, only 2 SSL connection is set up. SSL1 SSL2 Client ...


2

How secure this is will depend on a number of factors. Do you have device wipe enabled on incorrect guesses. Assuming that you have the device set to wipe after 10 incorrect PIN guesses then without any clues and a purely random PIN, an attacker has a 1/1000 shot at guessing it. Of course most users base PINs on things like dates or years which cuts the ...


2

Alternatively, you might consider the JuiceSSH client. It stores your keys in its private app directory. In addition, it encrypts its storage so even jailbroken phones offer some level of protection. Sources: - @JuiceSSH: "External storage won't work as keys are imported into the internal JuiceSSH database". - @JuiceSSH: "They [ssh keys] are stored in an ...


0

This feels like an instance of the XY Problem. The short answer is: Your external applications Bind to your Service. This requires permission from the user, set with the permission tag. You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme). In general, this is how you provide information ...


3

Yes, Zimprerium was the group that discovered and reported the StageFright vulnerability (here's the original blog post). Zimperium's Sr. Director of Platform Research and Exploitation, Joshua J. Drake (the discoverer and presenter of StageFright) is a famous Android security researcher, and a former researcher for metasploit. While I applaud being ...


0

Developers get the MINIMUM VERSION and TARGET VERSION confused. The minimum version acts as a filter in the play store to show only compatible apps. The target version is a measuring stick to how up to date it is with newer operating systems. Here is the problem: Android OS will automatically grant additional permissions to an application if it hasn't ...


0

Android Permissions are a tricky subject - there are a range of reasons why an App might require some fishy sounding permission to private data: Intent to steal you data and use it for advertsising or selling it Lazy coding / incompetent coding ( I'm not sure what exactly we need, so let's just get this general permission to all files ) Bad Android Design ...


3

cgroups and namespaces are about isolation whereas SELinux is a mandatory access control system: fine-grained access over which system calls are allowed, how information is allowed to flow between processes (domains). The android permissions that applications have to subscribe to can be easily enforced through SELinux, as can process isolation and even many ...


1

So this is a really tough problem, and I don't believe there are any APIs out there to achieve what you want. What you can't do: Custom Permissions While they sound like a good idea custom permissions are defined in the AndroidManifest.xml. Checkout this SO answer on how to define/use them, but they look something like this: <permission ...


12

The security model for Android is that all of the protected resources (Identity, Contacts, Camera, GPS, etc, [Full list of permissions you can request here]) are protected inside the operating system API. That means that an app does not have direct access to the hardware, instead it has to ask the operating system to talk to the hardware for it. That way, ...


19

Every permission needs to be declared in the AndriodManifest.xml before an app can use them. For example: <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.android.app.myapp" > <uses-permission android:name="android.permission.RECEIVE_SMS" /> ... </manifest> to be able to receive SMS. This ...


0

You should not install anything that you (YOURSELF) did not try to install. No exceptions, unless if you look it up and find it is needed or useful and comes from a reliable source. For example you need to install winPCap to install Wireshark. When you are asked to install winPCap you go and type winPCap in a search engine to determine if Wireshark is ...


2

can malware spread when sending a clean file to someone or receiving it via bluetooth ? As you mentioned, malware uses pair-wise communication mechanisms such as Bluetooth to spread. But whether the file you want to send is clean or not does not prevent you (or the destination deice) from being infected because one of the commun ways that malware ...


0

Android's in-place encryption works very well for new and existing files, but the fact it doesn't wipe free space has to be kept in mind. Note that even if it did a "full-disk" encryption as you say, where it declares the whole partition as "encrypted", doesn't help, because it wouldn't overwrite all blocks too. Most guides I've seen include to additional ...


4

You're making the common mistake of asking the wrong question: “is this system secure?” instead of “is this system secure in this scenario?”. Google's choice to not encrypt unused space makes perfect sense in the typical usage scenario where a user decides to encrypt their data, and all their current and future data is encrypted. The choice not to encrypt ...


2

Initial Analysis I think the most thorough way to test 3rd party apps is to: Download the Android SDK/Tools Create a virtual Android Device with the Android version of your phone. Enable Android Debugging through USB on your device. (Can be turned off later) Check with ADB that your emulator is detected: adb devices Install the 3rd party app with ADB: ...



Top 50 recent answers are included