Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

-1
votes
0answers
38 views

Security breach [on hold]

My Samsung s8 has just recently done a soft ware update, 3am this morning recived a miss call from Skype, but I'm not signed in or got it downloaded, and the phone showed no miss calls or any activity,...
0
votes
0answers
15 views

How to use Network Service Discovery in Android Studio

I am trying to create an android app that discovers devices on a network and lists these to the user. From what I understand, the best way of doing this is by using NSD. So, I have attempted to run ...
1
vote
0answers
28 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
0
votes
0answers
14 views

Using adb to list certificates in Android devices [migrated]

I want to use adb to list all certificates installed by USER. How can I do that?
1
vote
0answers
12 views

When Google removes malicious apps from their Play Store, are users notified? [migrated]

This Check Point Research article describes over 200 malicious apps on the Google Play Store that were downloaded over 100 million times. Google has now removed the apps from their Play Store. But ...
0
votes
2answers
94 views

Opened a phising email on school email

Hello I opened this email sent to my school email and I realized it was a phising email. And now my OCD and anxiety are going haywire. Is it possible I got infected? I did not click on any links. I ...
1
vote
2answers
44 views

Security Audit - How to make sure a specific android app does not send my data to its data center

We need to pass a specific security audit in our company. All our front line workers use the mobile phone provided by our company (controlled by Intunes) and they require to install apps such as ...
-3
votes
1answer
74 views

How to test for Android app reverse engineering vulnerability

I'm an Android developer who knows how to work with Android SDK and Android studio as an IDE. I am familiar with Proguard and Dexguard tools related to obfuscation of code. My Case: I've ...
1
vote
1answer
86 views

How do I protect from a PNG vulnerability on Android?

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached. What's interesting it's asking to interact with the image and "copy-...
1
vote
1answer
31 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...
0
votes
0answers
42 views

Unnormal “process” in smartphone

Checking my data use in my android, I saw that android.uid.lgapps.2901 used a great amount of data. So I searched for it and I founded this link: https://stackoverflow.com/questions/54478558/android-...
2
votes
1answer
60 views

Can any Android apps log my clipboard and upload it to their server without my permission? [duplicate]

Everyday we copy paste texts that are sometime very important and we don't want anyone to see that. Can any Android app log our clipboard and upload it to their server without my permission? I have ...
0
votes
0answers
14 views

can't find mapping of “android.permission.INTERNET” permission to famous methods which should use it

I was trying to evaluate effective permissions usage of an apk using axplorer mapping files. During evaluation I obtained an effective use of the android.permission.INTERNET permission equal to 0. ...
11
votes
2answers
202 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
1
vote
1answer
321 views

Phone sending many packets

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were ...
1
vote
0answers
36 views

Android Exploit Development Lab [closed]

Looking to setup an exploit development environment to do the following: Fuzz Android libraries to find new vulnerabilities Re-create already existing bugs/vulnerabilities based on bug fixes found on ...
49
votes
5answers
8k views

Downsides of showing email address on Android lock screen

My stock Android 9.0 gives me the option of showing some short text message on the lock screen. I want to add my email address here, so people know how to contact me if they find my phone. Are there ...
1
vote
2answers
210 views

How does an OS execute code from a PNG file? [duplicate]

A recent bug in Android allows a hacker to execute code that is contained within an image file. Here is the quote from the Android Security Bulletin, The most severe vulnerability in this section ...
7
votes
0answers
129 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
6
votes
2answers
125 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
0answers
42 views

Error report from unpublished version — have I been hacked?

I have an UncaughtExceptionHandler in my Android code. In the event of an uncaught exception, my app sends version info, device characteristics, and a stack trace via HTTP POST to my server. (My ...
0
votes
1answer
66 views

Android x86 vs Android on Qemu ARM

Situation: Emulating Android devices for pen-testing Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM Question: In terms of vulnerabilities/exploitability, ...
1
vote
1answer
43 views

Android boot sequence - verified boot security

After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows: PBL --> XBL (replaces SBL) --> Aboot --> Kernel PBL: Primary Boot Loader (...
0
votes
0answers
62 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
3
votes
1answer
150 views

Is storing information in RAM more secure than on Disk?

I realize neither is foolproof, of course. I would just like to confirm my thought that it's harder for an attacker to get a memory dump than to copy from disk/flash-storage or that malware just tends ...
0
votes
0answers
23 views

Enterprise Mobile Application Security Options?

Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
-1
votes
1answer
56 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
1answer
87 views

Is a temporary local hotspot on an Android device secure enough for my purposes?

I intend to deploy some embedded software on Raspberry Pi devices. All will have WiFi capability, but not all will have internet access. I want to occasionally be able to update the firmware in all, ...
0
votes
0answers
59 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
-1
votes
1answer
41 views

Can I spoof a specific AP of a network?

My college wifi requires a certificate installation and also is very unreliable. Therefore, I prefer using my mobile data when I am on campus. But the college has its own app for attendance taking and ...
1
vote
0answers
82 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
2
votes
0answers
108 views

Why don't smartphone manufactures write the IMEI onto one time writable ROM so that it can't be tampered with? [closed]

The title says it all basically. Even now, why is tampering IMEI possible at all? Shouldn't manufactures be using one time writable memory to embed IMEI into phones? Why don't they?
0
votes
1answer
112 views

Android - What are the practical security benefits of using a hardware-backed keystore vs software-only keystore vs no keystore

Say a legitimate app makes use of either: No keystore Software-only keystore (for encryption/decryption of data) Hardware-backed keystore (for encryption/decryption of data) For the following ...
0
votes
1answer
131 views

Do smartphones have built-in surveillance in certain countries?

I recently was in a third world country which is know as a police state with heavy cyber surveillance. I noticed that brand new smartphones came in a box that had a nice holographic seal showing the ...
1
vote
2answers
106 views

What is technically different from iPhone/iOS to Android phones when it comes to data privacy?

Historically Apple never shows up at CES, and this year they put up the following ad close to the convention center: There is always this argument that Apple has better privacy policies in it's ...
0
votes
0answers
55 views

Risks of having an Stored Keystore in Android APK file

I'm analysing an APK package for a University paper, I have found a BKS keystore inside the package and the password to use this keystore hardcoded in a configuration file. This keystore is also used ...
2
votes
2answers
67 views

Do interactive ads on Android pose a security risk?

I have recently started seeing interactive ads in free applications I use on Android. I'm used to ads that come in the form of images, gifs or videos. Now, a lightweight, seemingly HTML5-compatible ...
1
vote
2answers
159 views

How to optimize the diffie hellman key exchange algorithm

I am making a chat feature in my app where I want to encrypt it E2EE, but the problem is when I start to calculate the public key (public key = g^private % n) it takes a decade to get it done. I need ...
1
vote
0answers
123 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
0
votes
1answer
81 views

How can I tell if a keyboard for android is safe?

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I ...
1
vote
1answer
78 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
1
vote
0answers
53 views

Securing an android smartphone [closed]

Recently I got a new smartphone (OnePlus 6T, Android 9 Pie) and would like to do everything right from the start. My main concerns are, I would like to be able to backup my data, I would like the ...
0
votes
2answers
466 views

View packets of whatsapp?

I start doing a research about what's actually delivered from some android applications (such as telegram or whatsapp) outside to the world. I do it in the following mediums: 1. Wifi 2. GSM It ...
4
votes
2answers
181 views

Upload malware to F-Droid repo?

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
0
votes
2answers
854 views

Suspicious new folder named .um in internal storage, google search says file is spyware

I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the ...
0
votes
0answers
35 views

How can I use netcat to connect back from my meterpreter session to my santoku OS android

I have install netcat in my genymotion VM machine. When I give command through adb nc -l <IP ADDRESS> -p <PORT> -e /system/bin/sh It runs. But when I try to launch this same command from ...
3
votes
1answer
103 views

Is there any way for server side to verify the application integrity during OAuth2 workflow

During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens. For server side, is there any way that we ...
0
votes
2answers
139 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
4
votes
1answer
97 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
6
votes
1answer
148 views

Can I find out what encryption is used by my Android Bluetooth keyboard?

I've got an Android tablet (Samsung Tab S2) and a Bluetooth keyboard (Celicious Tri BK01). I occasionally use the keyboard to enter my password. Is there any way, in Android, to find out whether the ...