Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Mobile Application Security

Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code ...
user avatar
-1 votes
0 answers
26 views

Can a hacker resign an APK and keep the same certificate fingerprint

I'm a developer of a mobile Android app. In my app, I've implemented code that reports the SHA-1 certificate fingerprint (implemented in Java code, as described in this post), in this way we can tell ...
user avatar
-1 votes
0 answers
46 views

How much more smartphone security am I getting by picking the Google Pixel 6 Pro vs others? [closed]

I am trying to decide between the Google Pixel 6 Pro vs the Samsung Galaxy S22 Ultra. Device security is very important to me, so much so that it could be the deciding factor for me with this choice. ...
user avatar
0 votes
0 answers
23 views

Android secure folder/second space for trusted or untrusted apps

Any opinions on whether to use virtual env Secure Folder or Second Space for trusted - bank app, sensitive info etc or rather to use it for untrusted apps and limit exposure to your sensitive data? My ...
user avatar
  • 1
0 votes
2 answers
115 views

How to realistically de-google an Android smartphone?

Smartphones have the options to selectively disable tracking in the settings menu. By visiting this menu, you can manually disable each application from having permission to access your private data ...
user avatar
0 votes
1 answer
33 views

Burp suite: URL encoding of request body - Is this safe?

Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
user avatar
0 votes
0 answers
37 views

is it useful to encrypt files on Android 11 using something like cryptomator [closed]

Is it useful to encrypt files using file encryption apps like edslite, cryptomator and boxcryptor or is the device encryption enough on Android 11?
user avatar
0 votes
0 answers
21 views

Encrypted/Encoded text in the Burp HTTPS request - Android [duplicate]

I am analyzing the HTTPS traffic from a particular Android app using the Burp proxy. So every 5 minutes, the app hits an endpoint and sends an encrypted/encoded text in its HTTPS request. I tried ...
user avatar
2 votes
0 answers
48 views

No root firewall vs any spyware / malware

I am wondering about the effectiveness of no root firewalls as a solution against any type of spyware / malware. Particularly on an android device. No root firewalls like this one here (aptly named) ...
user avatar
-1 votes
1 answer
87 views

Malware from Android text?

Lots of questions! I clicked a scam USPS link on my phone while half asleep. The website loaded and a small window popped up immediately and I quickly backed out of my browser but briefly saw the site ...
user avatar
0 votes
0 answers
24 views

How to keep android meterpreter shell script running in background after app is closed

I am connected to android using a meterpreter shell, using an embedded backdoor. I want to run a loop, on the android which will stay running even when the app is closed. My test.sh script is: #!/bin/...
user avatar
1 vote
1 answer
56 views

Android- ads in applications are in local language even when using proxy

I have noticed some weird behavior on my smartphone that I can't explain myself. I'm using Orbot application as proxy to route all of the phone's internet traffic through the Tor network. When I ...
user avatar
0 votes
0 answers
29 views

Spam popup using Google news

The other day I was using Google News, clicked a Politico link, and got a popup saying Google had selected me to get a free iPad if I answered some survey questions. I didn't fall for it but I had ...
user avatar
  • 101
0 votes
0 answers
34 views

Can I find the private key on an old Android Wallet's source code?

I recently found an old wallet from my younger self with God-knows what kind of embarrassing data on it. I only found the back up files on a cloud service and did some digging as to what it was when ...
user avatar
0 votes
0 answers
24 views

What can a malicious user do with a shared android tablet on a corporate network via connected to corp WIFI?

We are deploying android tablets with a shared pin for users in an office. If the device was stolen or in the hands of a hacker, what can a hacker do on the network (realistically)? Android does NOT ...
user avatar
1 vote
0 answers
34 views

Request to produce Android APK without 'certificate pinning'

Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
user avatar
  • 111
1 vote
0 answers
60 views

Is it risky to let (trusted) Android devices connect to my computer over USB?

I'm wondering what security threats I should be aware of if I set up a testing farm (like STF) which will have several Android devices connected to PCs over USB. The Android devices will have USB ...
user avatar
  • 129
1 vote
0 answers
128 views

How does Android 12 / Pixel 6 allow data access before encryption key entry?

Following on from Why do mobile devices force user to type password after reboot?, I've noticed that my Pixel 6 Pro can access data after a restart. e.g. WhatsApp messages come through and ...
user avatar
1 vote
1 answer
85 views

What is the most secure internet access option for Android phones?

My goal is to make one of my android phones as secure as possible, hence the question: What is the most secure way for an Android phone to gain internet access? Options I (think I) have: The phone ...
user avatar
  • 33
1 vote
0 answers
43 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
user avatar
0 votes
0 answers
63 views

When the phone breaks and I regret encryption

I believe most new Android phones have full encryption enabled by default, so even if I just download some PDF weather report from the internet, it will sit encrypted on my phone's SSD. Now, suppose ...
user avatar
  • 230
0 votes
1 answer
49 views

If I create a ServerSocket on Android without specifying an IP to bind to, is it safe to assume this port is unreachable via the cellular network?

I'm using ServerSocket to create a listening port on Android, so that other clients in my local network can connect to it while the phone is providing a personal hotspot. I probably can't specify the ...
user avatar
0 votes
1 answer
209 views

Can my android phone get hacked if I share my hotspot?

I lent my mobile data to someone's computer and was not in the room while they were using it. Suppose they wanted to gain control/access to my android device. How easy would it be? As far as I know, ...
user avatar
0 votes
0 answers
19 views

Android Keychain: How to restrict the system-wide credentials based on the app developer or manufacturer only?

As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain ...
user avatar
0 votes
0 answers
111 views

How secure is the Android Keychain

I have been able to understand the Android KeyChain API via this link. However, I want to ask how secure this API is, on the Android OS, the KeyStore is available on a cryptographic scale, but I would ...
user avatar
0 votes
1 answer
178 views

Can two antivirus softwares work on one android phone?

Scenario: You have one antivirus installed on your phone. You suspect that your phone might have malware on it so you do a system scan and your AV doesn't find anything. So you decide to download ...
user avatar
  • 1
0 votes
0 answers
22 views

Is there any way I can verify that my app in not modified or tempered (code is changed or something) on clients phone? [duplicate]

I have created an App and made clients install it on there phone. When my app tries to connect to server or request data from my server I want to verify if that app is genuinely my app and not ...
user avatar
0 votes
2 answers
108 views

How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?

Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
user avatar
0 votes
2 answers
113 views

Someone accessed my phone application in Android 10 and dialled some codes to do some transactions while I was using the Tor browser [closed]

I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. ...
user avatar
0 votes
1 answer
60 views

Can an android based antivirus prevent data-leakage?

Can an android antivirus detect or even prevent data-leakage of a mobile phone? Moreover if the user has installed .apk outside playstore. I searched on google, but answers like this: https://www....
user avatar
0 votes
0 answers
65 views

How easy is it to hack a laptop using android phone assuming it's firmware is infected?

Wonder about if it is possible for an android device with infected firmware and fully controlled by hacker to compromise my computer remotely (assuming hacker has already locally flashed a different ...
user avatar
  • 3
0 votes
0 answers
69 views

Utilities and apps that bypass Google password/security

How do applications(UnlockGo) that allow one to connect their Android to PC work in removing password? I thought the password also is used to encrypt Android device. Is the data erased? i.e. ...
user avatar
  • 149
1 vote
1 answer
113 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
user avatar
0 votes
1 answer
47 views

What does "exported" means in drozer framework?

When we run app.package.attacksurface in drozer, it shows exported activities, content providers etc. I understand it means that they could be vulnerable, but why do they call it "exported"?
user avatar
  • 1
-2 votes
1 answer
241 views

Why are mobile phones OS easily hackable (Pegaus & Co)

Every now and then, you here a story about misuses of mobile OS' spyware softwares, developed by technology firms which usually sell their products to governments or groups with similar power. You ...
user avatar
  • 1
1 vote
1 answer
220 views

Is it safe to run Android apps natively on Windows 11

Are Android apps run in isolated sandbox/virtual machine on Windows 11 (like apps running in Bluestacks)? I'm interested in terms of security to make sure even malware android apps will not get ...
user avatar
0 votes
0 answers
147 views

Storing a private key in android/ios keychain encrypted or not

In my app, the user must use a private key to sign a transaction (on a blockchain). (It is quite common) I am facing questions regarding how to store my user's private key on the device. I am to use a ...
user avatar
10 votes
1 answer
2k views

Are fingerprints less secure (at a software level) on Android (10+)?

Inspired by this question (and more specifically, this answer to the same): When a passphrase is used, the encryption key is not stored directly in the device. [...] When using biometrics, each ...
user avatar
  • 423
11 votes
2 answers
4k views

Why does an encryption key derived from your lock screen password give you stronger protection (in Android 11)?

Why does an encryption key derived from your lock screen password give you "stronger protection" than a key chosen by the machine (or at any rate not derived from your lock screen password)? ...
user avatar
  • 215
1 vote
1 answer
120 views

Phone call logs in Android

I have a new Android phone that I purchased a few months ago directly from the company's website. All is fine with that phone, except one thing. It occasionally makes a short phone call. That call ...
user avatar
  • 205
1 vote
1 answer
92 views

Why is my unpublished app being run remotely? New info and an answer

This is a follow-up to a sequence of earlier posts. The posts have been closed because they did not meet the moderator's expectations. I have new information, and I'm re-posting so that I can answer ...
user avatar
0 votes
2 answers
84 views

What's the risk of keyboard languages being sent via Content-Language header?

The Android versions of Firefox and Chrome/Chromium and all derivatives (Ungoogled Chromium, Bromite, Brave) by default insert all the user's configured keyboard input languages into the Accept-...
user avatar
  • 291
0 votes
1 answer
118 views

Multiple SMS activation codes received by error

For several days now I am receiving activation codes by SMS that look like this: Your ToYou verification code is 8058 Some are from ToYou, that seems to be a delivery service, others are from similar ...
user avatar
  • 101
0 votes
0 answers
28 views

What can an attacker with physical access to your phone accomplish, if you flash a new OS? [duplicate]

What can an attacker with physical access to your Android device accomplish? More specifically, if you had ordered a phone through the mail and did not trust the OS that came on it and decided to ...
user avatar
0 votes
1 answer
97 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
user avatar
1 vote
0 answers
140 views

How can I know if phone is already infected?

Last year, my friend who is learning hacking for nearly 3 years hacked my phone using social engineering by installing some malware in my phone. (After researching on Google, I think it might be a ...
user avatar
0 votes
1 answer
92 views

What all data can software pre-installed by the phone manufacturer possibly snoop and send to the manufacturer's servers?

My question is whether there is any security feature built-in to the "open-source core" of android to prevent even pre-installed manufacturer apps(for some of which there is no way to revoke ...
user avatar
0 votes
3 answers
288 views

Can spyware be downloaded and installed on Android phone in a minute or less?

Following Scenario: You unlock your phone and you give it to someone so they can promply check it out (since it's a new phone). Now let's presume that the very exact person has intentions to install ...
user avatar
1 vote
1 answer
98 views

Is it possible to move image files from a text thread on a phone to a virtual box without downloading them?

I'm looking into a spam bot that's been sending me messages on my phone (Samsung s10). It's sent a couple images that I want to try and scrape for metadata and do a reverse image search on. Since the ...
user avatar
0 votes
0 answers
86 views

Requiring Google Mobile Service token

I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test. However, this endpoint need a tokenID (ex....
user avatar
  • 101

1
2 3 4 5
27