Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

-2
votes
0answers
40 views

How to restore photos on factory reset phone [on hold]

I accidentally factory reset huawei mate 20 pro. There is no backup anywhere. How can I recover the photos without tooting the device? Rooting voids warranty so It is best to recover without rooting.
0
votes
1answer
26 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
3
votes
2answers
65 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password ...
-1
votes
0answers
31 views

Blackberry have the authentication system of picture and digits combination

Has per security concern, I personally used this feature on blackberry. I felt more secured while unlocking the phone ,even someone watching you while unlocking they can't get the pattern or ...
-5
votes
0answers
51 views

How I can hack android with java image [on hold]

I code with java How i can hack android with java image like put java code into image and execute in phone target
0
votes
0answers
101 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
51 views

Does Whatsapp change key when switching phone?

Alright so, I really didn't expect this but here's the story. I was doing some tests, I copied one of the .db.crypt12 in /sotrage/emulated/0/Whatsapp/Databases/ from my phone to my computer, then, I ...
0
votes
0answers
20 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
1answer
81 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
0
votes
0answers
23 views

Native mobile app securely launching another native mobile app

Let's say native mobile apps App1 and App2 from vendors V1 and V2 already exist independently. How would App1 securely launch App2? Both App1 and App2 must operate in the user authentication ...
0
votes
0answers
20 views

Can Wifi HotSpot download a file automatic right after connecting?

Can HotSpot fishing android devices by connecting to the wifi and automatic download a file? or even send a file from the HotSpot owner to the victim without he knowing or do anything?
1
vote
0answers
30 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
0
votes
0answers
4 views

How do I install the OWASP ZAP certificate as a trusted system CA on Bluestacks? [migrated]

I have a rooted bluestacks android. I would like to use ZAP to monitor its SSL traffic. I exported ZAP's SSL certificate as a .cer file ("----- BEGIN CERTIFICATE .... ------ END CERTIFICATE -------")....
1
vote
0answers
25 views

Connection between PIN/password and encryption keys in Android

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
0
votes
0answers
13 views

PHP JWT (Json Web Token) implementation in Android (Retrofit) [migrated]

I have a PHP file with JWT token APi->(https://github.com/durgesh-sahani/restapi-jwt-php-mysql/tree/master/jwt-api) my problem, this Api d'ont have $_POST[] method. And all method delete,insert,update ...
0
votes
1answer
64 views

Is it safe to store user's secure pass-code in database with encrypted form while creating bitcoin wallet?

I would like to create a Bitcoin Wallet. Part of the process is to store public and private keys in encrypted form in server database. All keys I am storing is encrypted using user's passcode. 1) ...
2
votes
2answers
68 views

HSTS for android apps?

Websites such as Facebook visited on browsers have the HSTS capability which is one more layer of security for TLS from some attacks. What about, in particular, the Facebook android app? Does it ...
0
votes
0answers
37 views

How could a boolean value be successfully protected in an Android app?

I've an app that in several points of its code changing it assembly code so if a comparison that is done in the app is set to always return true the user is open for cheating a lot with the app. I've ...
0
votes
1answer
30 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...
0
votes
1answer
54 views

How are USSD messages used and who could send them?

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree). There is a Wikipedia ...
2
votes
1answer
92 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
3
votes
0answers
59 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
4
votes
0answers
76 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
0
votes
0answers
27 views

MITM between device and PC in a different network using adb

I am trying to intercept my Android network. Is it possible to intercept network traffic between an Android device and my computer only by using ADB (Android Debug Bridge)? Only a cable should be used ...
1
vote
1answer
44 views

Deutsche Bank PhotoTan app signed with self-signed certificate?

Deutsche Bank recently started forcing its customers to switch their transaction authentication from iTAN to PhotoTAN. Now I wanted to verify the authenticity of the Android app like this: # ...
0
votes
0answers
32 views

How to set autorunscript of core commands?

I'm trying to automate scripts of an Android Metasploit payload. I can successfully automate any script on the /post module, however, I'm trying to automate geolocate, dump_calllog and others that are ...
507
votes
18answers
106k views

Police forcing me to install Jingwang spyware app, how to minimize impact?

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it. Knowing that I may be ...
1
vote
2answers
45 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
1
vote
1answer
64 views

Securing a file from getting stolen in an Android application?

I have a secret file which I cannot encrypt (because I am using it in a third party library) in an Android app which I want to protect from reverse engineering. The app will go public on Google Play ...
0
votes
0answers
32 views

Mitigations for Android Invisible Overlay Views

I would like to begin by clarifying, my question does not relate to TapJacking attacks on Android and to my knowledge filterTouchesWhenObscured will not help in my case. Here is the scenario: I work ...
0
votes
2answers
120 views

Achieve total anonymity on public wifi using Android [closed]

Would this be enough to achieve total anonymity on public wifi with an Android device: use Orbot spoof your MAC address turn off location services turn off cellular data Are there any other services ...
0
votes
2answers
86 views

What tests can be performed on mobile apps to determine if they are secure?

My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
0
votes
0answers
18 views

Security risks to embedding payment web page in Android app

I am very new to Android app development and I started out with the idea of fixing a small defect in an app. However, I got sucked further in and found that a payment processing company that we use ...
2
votes
2answers
69 views

Authenticate user based on mobile device identifier

I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
1
vote
0answers
46 views

Use BlueBorne to get arbitrary code execution on locked-down Android system from 2016

So here's the story. I have this smart watch, the Olio Model One. I would like to install Asteroid OS onto this watch, and in order to do that I have to get root code execution (the objective of this ...
2
votes
0answers
45 views

A way of doing secure data exchange in Android?

To my knowledge, all current Android apps with internet permission enabled are prone to apps stealing data. For example, if you have a messaging app, all your messages are readable by the company ...
4
votes
2answers
80 views

How to find what files in a zip are malware using Virustotal

I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
0
votes
1answer
264 views

Your connection will not be private - Wi-Fi CA certificate warning message on Android

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private. No certificate ...
0
votes
1answer
120 views

Android & Man In the Middle — how did Fox News do it?

A couple years ago Fox News aired a short clip on how smartphones track and upload user location/physical state data. The clip is freely available on youtube and it shows how two Android smartphones ...
2
votes
1answer
69 views

Is Amazon's app store vulnerable to external storage race condition?

There's been a load of kerfuffle about how Fortnite on Android saves APKs to external storage and how they can be overwritten before they are installed. (The press is awkwardly calling this a man-in-...
1
vote
3answers
207 views

How to inspect an email attachment without downloading it?

I accidentally opened a PDF email attachment on an Android phone as I was trying to figure out if the email was fraud or a scam. It was an email claiming I booked a flight and the pdf had my e-tickets....
0
votes
0answers
62 views

How to make screensavers secure?

For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
1
vote
1answer
50 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
0
votes
1answer
830 views

Strange Chrome notification on Android 8.0

I just got a notification in French (I live in a French speaking country): Sincere congratulations, you won a Galaxy S8 phone. The notification has the icon of Chrome and is coming from news3....
5
votes
1answer
548 views

Using android auto in a rental car

I've started using rental cars frequently for work and android auto has apparently become common enough that many of the cars I rent have it built in. It could be helpful to me even over the short ...
0
votes
0answers
405 views

Can a Whatsapp account be spoofed?

I've had a big privacy concern lately regarding the safety of my Whatsapp account. Ever since my phone was stolen from me and returned by certain malicious individuals, I've had the weirdest feeling ...
0
votes
0answers
53 views

Can a phone provider tracked your phone if their SIM is not in the phone?

Let's say I have a dual SIM phone and I took one of the prepaid SIM cards out, the one that is being used to track me. The tracker is unaware that I had another one, and turned off the phone before ...
8
votes
1answer
241 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
1
vote
0answers
23 views

How to open a Boxcryptor file from emacs running inside termux on Android

I'm using Boxcryptor to encrypt my files in Dropbox. I use termux to run emacs on my Android phone. I'm having trouble opening the Boxcryptor files in emacs because I don't know where to look for the ...
1
vote
2answers
56 views

At What Point Does A Device Correspond/Link to its Owner?

I am aware that governments, organizations and hackers can do a plethora of things to your device (i.e. track your location, tap calls, etc.), but I can only assume that they can only do these things ...