New answers tagged

3

Is it unsafe to restore backed up data from Google servers? Not generally. Like Matthew said in his comment, the restore process will not restore the vulnerable versions of previous applications unless the application is still vulnerable. What Google does is simply store a list of applications you used. You will then have to re-download them, and most ...


2

Androids permission model up to lollipop is flawed in the sense of usability, and they are moving towards context driven permission request model. Let us review the current situation again: You as a normal user are looking for an application and after searching the google play, you finally find it. As happy as you can be you click install, and then there ...


3

One option: They can clone the whole system to a computer or another phone. After that, they will do the tries. After it wipes itself, they will clone it again. Second option: If it is the data what is going on, they can copy it to a PC and crack it there. No wiping applies on that in this case ...


11

Use Android SafetyNet. This is how Android Pay validates itself. The basic flow is: Your server generates a nonce that it sends to the client app. The app sends a verification request with the nonce via Google Play Services. SafetyNet verifies that the local device is unmodified and passed the CTS. A Google-signed response ("attestation") is returned to ...


0

This problem is something that mobile games have to deal with for income reasons, and from what I can tell, they deal with this by constantly updating the app, requiring the user to download and install a fresh patch every time before they start the game. usually this is a small amount. These patches also add new content to the game. The patches also handle ...


18

This is impossible. Anyone who has the integer APK file can decompile it and make a malicious clone that behaves in exactly the same way towards the server.


5

Yes. A Harris Stingray, Boeing DRT box, or other cell simulator can intercept SMS messages. These are monitoring devices that have secretly been used by police agencies for over a decade. They come with strict non-disclosure agreements where the agencies that purchase them are not even allowed to acknowledge their existence to the public, and certainly ...


1

The general process of rooting a phone works by exploiting a vulnerability in the respective Android OS to conduct a privilege escalation which in turn makes you (a non-root user) root. You can then install modified firmware. This is, by definition, relying on security holes There is no guarantee that using the exploit on your phone to root it doesn't ...


2

I will confine my answers to Nexus phones. I have rooted my Nexus phone. I am sure that rooting will work on new Nexus phones. ( Samsung phones can also be rooted) Rooting does not rely on any particular security hole. The broad idea is to be able to execute commands as a root user (as like in the linux system). Rooting a phone in itself cannot be termed ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


1

If you have total control of the device and are very careful what connects to it then there's no risk in leaving debugging on at all times. Leaving USB debugging on is risky when you do not have control. So if you have a phone you use purely for development and testing then leaving USB debugging on makes sense. If you use your personal phone for development ...


0

Are you facing this problem while using a wifi connection? If yes, please make sure other devices connected to the same wifi router are working properly. I am experiencing a similar issue in my home. My desktop computer with Fedora 23 is affected, together with all wifi devices sharing the same router. I have read in the avgforums that manually resetting the ...


3

A few things come to mind. Avoid storing things locally that should not be exposed. Data like sessions, cookies, passwords, account details, whatever. There have been numerous and various ways that data gets dug out of mobile apps and reused. As a rule of thumb, if it's data that is specific to that user (the user's session, the user's ID, the user's ...


3

The development platform has as close to nothing to do with the security of your app. It might, if your development machine is not properly secured or directly targeted. The number one rule you have to follow is to not implement your own crypto. Use well known and tested libraries.


0

The token that you are speaking about is not generated in the mobile app. It is generated in the 3rd-party authentication servers and passed to your mobile app. Your mobile app has to pass it back to the servers to validate your apps's authorization. Regarding security of the token, assuming that you are using SSL, you can pass the token in either a query ...


-1

You are right, it is impossible to reliably detect root, especially from a sandboxed app. A rootkit can (i.e. it is not technically impossible) run your app in a specially crafted VM, so that it sees an unmodified unrooted system. On the other hand, such kits have not yet been detected. And building such would require a very serious effort and investment. I ...


0

Firstly, go into Chrome -> Settings -> Search Engine and check the search engine. There is a malicious search engine bug that google is yet to fix involving JS execution via the Default Search Engines feature. Then, grab everything from /data/data/com.android.chrome/. The chrome cache is in a directory named cache under this directory. Next, wipe the ...


0

Most of the time it is possible to intercept Application traffic even if you have implemented certificate pinning for Application but request should be encrypted when you have intercepted using Charles proxy. But it is possible to intercept traffic using SSLBypass, SSL Trust Killer, iOS SSL Kill Switch using proxy such as Burp.



Top 50 recent answers are included