Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

0
votes
1answer
19 views

how to debug for DNS changing Maleware on (linux/android)?

So by opening an application/browser on my Android device, I found that it pops open a set of ads. I channeled a proxy through my laptop trying to track the first web site it connects to. Later I ...
0
votes
0answers
10 views

How can I decrypt data stored using the android KeyChain API? [migrated]

I have an android application that stores secrets using the KeyChain API. I have root access, and I know all of the credentials for the device. I should theoretically be able to decrypt the files ...
0
votes
0answers
37 views

How do I decrypt Facebook's Messenger SSL traffic on Android?

I would like to investigate the Messenger chat protocol, and to do so i need to see it in clear... I've been able to successfully sniff the (not encrypted) traffic with the 'Shark for Root' but it ...
-4
votes
0answers
13 views

How do provide the android sandbox security to application? [on hold]

I want to know what is android sandbox security and how implement it in application? I want to provide the internal security to application so no other application can check the memory status and ...
0
votes
0answers
43 views

Is it possible to figure out a password to a router using an Android phone? [closed]

I have heard that there is programs which cracks the password on wifi for you. Would it be possible to do this using a smartphone?I am not asking for a recommendation for an app, just asking if it ...
0
votes
0answers
51 views

Comparison of security of PDFs on different platforms (web browser/adobe/android/iOS/mac) [closed]

There have been quite a few exploits of PDFs. Patches do claim to fix these exploits but what are the chances that PDFs are still widely used today as an exploit vector via zero-days? Of course, the ...
0
votes
2answers
37 views

Does a malware in an android phone have permission to read/modify/delete data of all the apps?

If an android phone is infected with malware/virus, can it access all the apps with modify/delete/read permission? Isn't there any control by an app , say a bank app which can't allow to read data by ...
0
votes
0answers
15 views

Security mitigation vis policy between Android watch and Android smartphone TEE

We are an e-store company and we have native apps for Android and iOS smartphones. We are building a new app for Android/Apple watch and enable authentication between the watch app and native app on ...
0
votes
1answer
38 views

What kind of damage does the HummingBad Android malware do when it fails to gain root access?

There is this Android virus out there called HummingBad, and it seems the first thing it tries to do is try to get root access. There are so many device models out there, and the rooting process is ...
0
votes
0answers
25 views

How exactly does the HummingBad Android malware gain root access?

I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put ...
0
votes
1answer
35 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
2
votes
2answers
67 views

Why is it so easy to pirate apps for Android, considering most have an internet connection and access to phone details? [duplicate]

It seems so easy to pirate apps for Android it's as if no one even cares. It's as easy as google searching for the apk and then installing it. Isn't this surprising as some apps cost money? Wouldn't ...
3
votes
1answer
56 views

Why does the ProtonMail Android app require Identity permissions?

The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require ...
4
votes
1answer
59 views

Android apps: required permissions reported before installing are misleading

I've noticed several Android apps that advertise different permission requirements than they actually get after they are installed. I'm on Android 5.0.2. To be more specific: I locate an app ...
0
votes
2answers
131 views

Can websites send WhatsApp messages without my permission through the WhatsApp API?

I want to know if it is possible for websites to send messages through my WhatsApp without my permission. I read about the WhatsApp API, but I haven't done much PHP so it did not make much sense to me....
1
vote
1answer
29 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
0
votes
1answer
55 views

Acquire new permission after installing an Android application

I would like to know if there is an attack that allows an installed Android application to acquire further permission that is not assigned initially during installation. I did some research and found ...
5
votes
1answer
147 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
5
votes
3answers
91 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
2
votes
1answer
81 views

Android N - Security Crypto Provider is deprecated

As mentioned in "android developer's blog" , http://android-developers.blogspot.in/2016/06/security-crypto-provider-deprecated-in.html , security Crypto provider is deprecated on Android N. And also ...
0
votes
1answer
54 views

Why doesn't Google uninstall or report, installed pirated apps? [closed]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
7
votes
1answer
53 views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
1
vote
0answers
31 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
2
votes
2answers
51 views

Disclosing used Libaries in App

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it ...
0
votes
1answer
80 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
1
vote
1answer
69 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
0
votes
1answer
36 views

Is it possible to deny Permission access and other Settings using Screen Overlay in Android?

I was noticing an app that doesn't need Camera access ever having camera access and other spy capable permission. When I tried to change the permssion there was a overlay text box saying something ...
-1
votes
2answers
68 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
-1
votes
1answer
35 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...
2
votes
3answers
41 views

Prompt for PIN when installing Android Apps?

is there a way to disable app installations until you provide a certain PIN? I have the following scenario in mind: I'm a heavy Google Photos and Google Drive user, but only from my Windows computer ...
42
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
49
votes
6answers
10k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
0
votes
0answers
34 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0
votes
1answer
36 views

Do android apps have signatures like Window executables?

Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs. If this would be the case, are they self signed? Are the play store apps signed by Google in ...
0
votes
2answers
101 views

Smartphone 2FA has been broken?

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is ...
1
vote
0answers
111 views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
0
votes
1answer
36 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
0
votes
0answers
65 views

Pop up in Facebook built-in browser

While I was visiting a page on a usual website with the built-in browser of the Android Facebook app, a pop-up just... poped-up, saying dumb stuff about my cellphone being full of viruses, etc. (Quite ...
6
votes
1answer
132 views

What excactly is encrypted by “full disk encryption” on Android 5?

This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and ...
1
vote
1answer
64 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
2
votes
0answers
28 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
0
votes
2answers
75 views

File types and ways that can infect Android devices with malware [closed]

From what sources can an Android device be infected with malware? What various file types, executable or non executable, can infect an Android device with malware?
0
votes
0answers
13 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
2
votes
1answer
108 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
1
vote
1answer
63 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
5
votes
1answer
119 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
1
vote
1answer
70 views

What is a root method and how is it achieved?

I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding? I know it's high privileges, but how can that not be enabled through a regular ...
2
votes
0answers
92 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
0
votes
1answer
70 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
60
votes
3answers
4k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...