New answers tagged

0

It is most likely that your router was infected and android takes its dns server from dhcp. There are a few driveby attacks that work on routers like this.


1

Not necessarily Operating systems in general and Android specifically, implement a privilege model to access data (When you install an app, you can decide which permissions you want to give it. You can also edit those permission later on). If an application is taken over by a malicious piece of code, it will have the same privilege level as the affected ...


2

Most android malware will steal information or spam your phone with aggressive ads. But they do not necessarily modify any installed apps on the phone. If a phone is rooted, the malware can, however, uninstall apps and replace them with malicious app copies. The following link gives an overview of many of the known android malware capabilities. http://...


2

Wouldn't it be easy for Google to stop piracy as the Google Play Store knows which apps are installed and it would raise a red flag if an app that cost money is installed but there was no history of it being downloaded through the app store? It's not as straightforward as that. There is no reliable, automated way to tell that a side loaded application is ...


0

In the case of HummingBad, if rooting fails, the next step is an attempt to socially engineer the user into giving it the required access by posing as an Android update.


0

Process or verify the payment server-side. This works for paypal und afaik your server can see in-app purchases of a authorized app and specific user, too. Just dig into the documentation on PayPal, Google Play e.t.c


1

Because Linux is open source. The app makers rely on the quality of their apps and convenience of the users (click & pay instead of a little more complex download and install procedure.) to make their $, which is both morally correct and good for everyone. Such a system will cause apps to increase in quality, unlike over-protected games, where companies ...


0

As this page says: https://support.google.com/googleplay/answer/6014972?hl=en identity is mainly used to get your "contact card" which is obviously useful if the application want to automatically fill signature or sender friendly name. By following the link guideline to check the authorization: Using the Settings app on your device (for apps you've ...


7

In Android, permissions are categorized into 2 categories: Normal permissions: Very little risk to user's privacy (like access to internet) Dangerous permissions: High risk to user's privacy (like reading and modifying contacts) Normal permissions are allowed at install time, and they won't be asked. If there are any dangerous permissions, then you will ...


1

In order to use your WhatsApp account, they'll need your username and password. If they have that, then yes it's possible. This is one of the many reasons you shouldn't have the same password for multiple services. With your credentials, they can do anything and access any service available to a normally logged-in user -including view contacts.


2

No. It no way possible can they do this with out having you security token (Lets call it your login credentials). The PHP API you saw is an unofficial API and requires logging in when starting it up. What can a website do? There is something called WhatsApp URI which lets websites build a custom link that upon pressing will redirect you to WhatsApp so you ...


1

Mobile Device Management (MDM) solutions exist that allow you to control and lock down settings on the device, as well as manage devices from a central location.


1

What you are asking about is known in the hacking world as "Privilege Escalation". It's a fairly broad term that encompasses a lot of techniques over a lot of operating systems and platforms, but is generally taken to mean exploiting a bug or flaw within a system to gain additional levels of access -generally administrative in nature. To my knowledge there ...


9

The phone you are talking about is not the stock Samsung S4. As you can read in the article the cameras are removed, there is a special app store only and there are special apps on it. It also states that this phone was explicitly chosen because of the KNOX technology which includes secure boot and separation of work and private activities. The reason this ...


0

I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...



Top 50 recent answers are included