Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

0
votes
1answer
75 views

Is a temporary local hotspot on an Android device secure enough for my purposes?

I intend to deploy some embedded software on Raspberry Pi devices. All will have WiFi capability, but not all will have internet access. I want to occasionally be able to update the firmware in all, ...
0
votes
0answers
21 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
-1
votes
0answers
34 views

Develop my own SCA/DCA tools for Android testing [on hold]

I want to develop my final year project on automation tool in Python for Android testing both SCA & DCA. But don't know where or how to start. Can someone help? CLI application will work for me. ...
-1
votes
1answer
32 views

Can I spoof a specific AP of a network?

My college wifi requires a certificate installation and also is very unreliable. Therefore, I prefer using my mobile data when I am on campus. But the college has its own app for attendance taking and ...
-3
votes
0answers
56 views

How can I implement a custom payload persistence script? [on hold]

This persistence script isn't working for the injected (final) application. The code is for the original payload (not injected). But after I inject it into an app the script doesn't work. Any idea ...
1
vote
0answers
50 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
2
votes
0answers
102 views

Why don't smartphone manufactures write the IMEI onto one time writable ROM so that it can't be tampered with? [closed]

The title says it all basically. Even now, why is tampering IMEI possible at all? Shouldn't manufactures be using one time writable memory to embed IMEI into phones? Why don't they?
0
votes
1answer
94 views

Android - What are the practical security benefits of using a hardware-backed keystore vs software-only keystore vs no keystore

Say a legitimate app makes use of either: No keystore Software-only keystore (for encryption/decryption of data) Hardware-backed keystore (for encryption/decryption of data) For the following ...
0
votes
1answer
119 views

Do smartphones have built-in surveillance in certain countries?

I recently was in a third world country which is know as a police state with heavy cyber surveillance. I noticed that brand new smartphones came in a box that had a nice holographic seal showing the ...
1
vote
2answers
90 views

What is technically different from iPhone/iOS to Android phones when it comes to data privacy?

Historically Apple never shows up at CES, and this year they put up the following ad close to the convention center: There is always this argument that Apple has better privacy policies in it's ...
-1
votes
0answers
33 views

Is it safe to output logs in Logcat and if not then how is it vulnerable?

I am pentesting an android app that is storing user credentials in itself for further uses. Suppose I submit the "credit card no" using submit button, it is showing up in logcat in clear text. Is it ...
0
votes
0answers
46 views

Risks of having an Stored Keystore in Android APK file

I'm analysing an APK package for a University paper, I have found a BKS keystore inside the package and the password to use this keystore hardcoded in a configuration file. This keystore is also used ...
2
votes
2answers
65 views

Do interactive ads on Android pose a security risk?

I have recently started seeing interactive ads in free applications I use on Android. I'm used to ads that come in the form of images, gifs or videos. Now, a lightweight, seemingly HTML5-compatible ...
1
vote
2answers
116 views

How to optimize the diffie hellman key exchange algorithm

I am making a chat feature in my app where I want to encrypt it E2EE, but the problem is when I start to calculate the public key (public key = g^private % n) it takes a decade to get it done. I need ...
1
vote
0answers
45 views

Android WebView JavaScript Enabled

I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
0
votes
0answers
22 views

About MAC spoofing and WiFi security [closed]

I am a student and my institution doesn't allow WiFi for Android but I can use it on my laptop. I decided to try MAC spoofing and it worked. Now I can use college WiFi on my Android but is there any ...
0
votes
0answers
33 views

Current generally recommended minimum Android API level for security reasons (Late Dec 2018) [closed]

I am currently reviewing some Android application build hardening guidelines which specify a minimum allowable supported API level. This was set internally at API level 15 and has been for some time, ...
0
votes
1answer
61 views

How can I tell if a keyboard for android is safe?

Background: I am a normal smart phone user, with no experience in information security. I want to download a new keyboard for my Android 6 phone off Google Play, as my current keyboard is not great. I ...
1
vote
1answer
63 views

Does License check response needs further obfuscation to make it more secure?

I have created an android app which is a paid app.The app utilizes google's licensing verification library for the license checks and implementing ServerManagedPolicy in it. As the ...
1
vote
0answers
44 views

Securing an android smartphone [closed]

Recently I got a new smartphone (OnePlus 6T, Android 9 Pie) and would like to do everything right from the start. My main concerns are, I would like to be able to backup my data, I would like the ...
0
votes
2answers
202 views

View packets of whatsapp?

I start doing a research about what's actually delivered from some android applications (such as telegram or whatsapp) outside to the world. I do it in the following mediums: 1. Wifi 2. GSM It ...
4
votes
2answers
126 views

Upload malware to F-Droid repo?

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
0
votes
2answers
305 views

Suspicious new folder named .um in internal storage, google search says file is spyware

I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the ...
0
votes
0answers
31 views

How can I use netcat to connect back from my meterpreter session to my santoku OS android

I have install netcat in my genymotion VM machine. When I give command through adb nc -l <IP ADDRESS> -p <PORT> -e /system/bin/sh It runs. But when I try to launch this same command from ...
3
votes
1answer
77 views

Is there any way for server side to verify the application integrity during OAuth2 workflow

During OAuth2 PKCE workflow, the native application (installed on Android/iOS device) issues the authorize request to server and exchange the OAuthtokens. For server side, is there any way that we ...
0
votes
2answers
129 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
4
votes
1answer
85 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
5
votes
1answer
110 views

Can I find out what encryption is used by my Android Bluetooth keyboard?

I've got an Android tablet (Samsung Tab S2) and a Bluetooth keyboard (Celicious Tri BK01). I occasionally use the keyboard to enter my password. Is there any way, in Android, to find out whether the ...
1
vote
0answers
35 views

How to secure Wifi Direct p2p connection between android devices?

I found this answer. However, I want to know how to use WPA2 and ssl to secure wifi - direct connection. Also is there a way to make wifiDevice visible only in the app that I want and not in other ...
2
votes
2answers
75 views

How to protect API endpoint from abuse in mobile App?

Let's assume I have a mobile app that fetches the news feed from an url on my server. GET/ https://example.com/api/v1/newsfeed Is there a way to restrict the access to this endpoint to only from ...
1
vote
2answers
163 views

How to intercept http/https requests done by an Android app in plain text? [duplicate]

When I give an android app internet permission and read access to my files, malicious software can send my personal data (pictures and video) to a remote server without me being aware of it. Is ...
1
vote
2answers
191 views

How secure is the fingerprint sensor in the Pixel 3?

As far as I understand different fingerprint scanners have different security levels. Old fingerprint print scanners could be fooled quite easily as the CCC (Chaos Computer Club) demonstrated. How ...
2
votes
0answers
50 views

Risk that apps with access to your saved files and camera roll get a hold of all your saved files and photos [closed]

Since I made pictures of some documents that should never be released to the public I was wondering how high the risks actually are, that the pictures I made have been "saved" by some of my apps, or ...
1
vote
2answers
94 views

Is it good to auto log out users after when they change password?

Is it a good practice to implement automatic log-out in an android App after changing the password through the app?
6
votes
2answers
139 views

Is breaking out of a Java binary serialized string possible?

During an assessment of an android application I discovered a file which contained serialized data from a standard call to ObjectOutputStream.writeObject(). A string serialized in the data is ...
2
votes
1answer
49 views

What should I do to develop a secure note taking app in Android 8.0?

One of the factors I considered was, having all the text encrypted and stored in the device memory. But we cannot avoid having raw unencrypted data on the RAM, when the application runs. Won't ...
1
vote
3answers
71 views

Would Gmail server be able to protect me from phishing attacks if I'm using a stock email app on Android?

I have a Gmail account and I am using Samsung email app. Recently I have switched to the Gmail app because I thought using the Gmail app would be safer because that app would automatically filter ...
0
votes
0answers
24 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
0
votes
1answer
64 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
0
votes
1answer
40 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
3
votes
2answers
90 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password ...
1
vote
0answers
153 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
94 views

Does Whatsapp change key when switching phone?

Alright so, I really didn't expect this but here's the story. I was doing some tests, I copied one of the .db.crypt12 in /sotrage/emulated/0/Whatsapp/Databases/ from my phone to my computer, then, I ...
1
vote
1answer
47 views

Android hardware Keypair Info

Basically I would like to use Android Keystore to sign requests going to a server from an Android phone. My goal is to have a way of verifying the origin of the request. Does Android Keystore offer ...
0
votes
1answer
95 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
1
vote
0answers
42 views

Working with Security Metadata in APK file

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
1
vote
0answers
29 views

Connection between PIN/password and encryption keys in Android

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
0
votes
1answer
139 views

Is it safe to store user's secure pass-code in database with encrypted form while creating bitcoin wallet?

I would like to create a Bitcoin Wallet. Part of the process is to store public and private keys in encrypted form in server database. All keys I am storing is encrypted using user's passcode. 1) ...
2
votes
2answers
103 views

HSTS for android apps?

Websites such as Facebook visited on browsers have the HSTS capability which is one more layer of security for TLS from some attacks. What about, in particular, the Facebook android app? Does it ...
0
votes
1answer
53 views

How to response to Meterpreter HTTP Request sent from client

First of all apologies for mistakes as i am at beginner level. I was exploring Meterpreter HTTP Handler. I have created a payload with meterpreter reverse HTTP and writing my own http server for ...