Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

BHIM app repackaging [closed]

I used apktool to get the decompile the BHIM apk and rebuild the apk without any modiciation and signed the apk with the help of apk-signer. But when I launched the application on Android pie in redmi ...
1
vote
1answer
61 views

Can Bluetooth “headphones” be malicious?

I received a parcel from Amazon which I did not order, addressed to me. It contained Bluetooth earphones. It may just be part of a brushing scam, but it's got me curious. So my question is.. Could a ...
0
votes
0answers
29 views

How does android boot and shows notifications with full encryption but without pre-boot authentication

i have android 5.1 (motorola moto g xt1039). i encrypted the phone and set screen password. then after every password change i can choose one of an two options: 'require the password at startup' '...
2
votes
1answer
52 views

how to protect smartphone data against theft?

i assume typical android has fully encrypted disk with a key stored in a header. header is encrypted using pin / pattern / fingerprint or not encrypted when there is no lock. is that correct? when ...
0
votes
0answers
57 views

Bypassing SSL pinning Using Frida issue

I am a penetration tester, and I was doing some SSL pinning bypass using Frida. I have pushed all the required files and certificates, and burp is intercepting traffic from the Android Studio ...
0
votes
2answers
33 views

is it safe to implement custom way of storing cookie in android?

i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (...
1
vote
1answer
31 views

Is it possible to login to accounts if you have access to an android phone? [closed]

Similarly if you have access to a PC you can steal session cookies which allows you to login without password and without the login showing in login logs. If one has access to an android device is it ...
2
votes
2answers
47 views

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
1
vote
1answer
105 views

Risks of photographing sensitive information using Android devices?

Sometimes I have to photograph sensitive documents such as bank checks or tax forms etc. Is it completely safe to do with a smartphone, or can there be security threats? Notably, the legit apps in ...
0
votes
1answer
56 views

Playing a shared video file or viewing a pdf file in “incognito/private mode”

I know how incognito/private tab works. But I'm not sure private mode works as expected in this situation: If someone uses Chrome "incognito/private mode" on Android device and plays a video file or ...
2
votes
2answers
61 views

Does using VPN or encryption on an Android phone do anything since Google knows who is logged into the phone?

Is it worth paying for a VPN to protect myself from Google tracking since, on an Android phone, you're logged into a Google account and Google knows who you are, anyway? Google can still track your ...
0
votes
0answers
12 views

Session Hijacking with remote server [duplicate]

Session cookie can help to bypass 2FA. Suppose victim and attacker are on same network without firewall. Attacker wants to steal victims login session. So attacker sends original login page over ...
0
votes
0answers
18 views

Can Android application access Unix sockets from other applications?

I have an Android application that creates an unnamed Unix socket. From a security standpoint, could another standard application without any association (not child process or anything similar) access ...
0
votes
2answers
56 views

How to make sure my phone is secure after a phishing attempt?

Situation: My phone is an android (Samsung Galaxy s6) - In a moment of mindless distraction yesterday I opened a pdf in a phishing email - it did contain a link but I did not click it. Very shortly ...
0
votes
0answers
80 views

Can someone explain exactly how Facebook hacked and intercepted a text message?

I have an Android phone (Blackberry KEY2). I do not have the Facebook app installed on it. I did log onto Facebook once on it via the Chrome browser to confirm it worked. The other day, I responded ...
0
votes
1answer
36 views

Android app is the only party authorized to decrypt

If we have data stored in encrypted format by the android app (encryption key in keystore), is it possible for the app to be the only entity capable of decrypting it to do some calculations? I am ...
2
votes
2answers
91 views

Can an Android app steal cached/stored passwords from other apps on my phone

Can an android app steal a stored password from any other app I have installed? Say I have snapchat and I only log in once and stay logged in, if I later delete the cache from that app it will log me ...
1
vote
0answers
72 views

BURP SSL connection failing on Genymotion Virtual Device - Android 8.0 API 26

Everything earlier used to work fine. However, recently I downloaded a newer virtual device on Genymotion, which is an Android 8.0 API 26. I have been struggling to get HTTPS traffic intercepted on ...
1
vote
1answer
91 views

Mobile Hotspot, Smartphone or Router?

I am using a laptop with dual boot Windows and Ubuntu. In addition, I am having another Linux distro installed on a usb thumb drive and using it only for certain things. Generally speaking - if ...
0
votes
0answers
86 views

Android 10 downloaded suspicious files without my permission

This is my first question on this forum so please let me know if I need to clarify anything. My Android 10 Pixel 2 just downloaded 2 files without my permission today, both named something to the ...
0
votes
0answers
53 views

Frida could not find libflutter.so

I disassembled apk using apktools there is a library libflutter.so, but when I call Frida, there is no library in the list. start frida: frida -U -f com.app -l script.js --no-pause script js ...
0
votes
0answers
58 views

How to ensure your own native app is talking to your own API [duplicate]

I'm developing an API and different apps to access to it, each with different scopes, including a native mobile app, and I'm wondering what would be a good strategy to authenticate my own native app ...
0
votes
1answer
57 views

Which is less trackable by online services, using a SIM card or free wifi?

I cannot do anything about government agencies, but I doubt that they are interested in me. I do not like the idea of Google, FaceTweet, etc, compiling data on me. What's the best way to prevent ...
0
votes
0answers
56 views

How to store ECDSA public key securely in Android

I am writing an Android application that needs to verify that a request is sent from a trusted party (me). This is my current solution: Storing keys: Generate ECDSA public key / private key from a ...
1
vote
0answers
124 views

Cell phone receiving text messages between an acquaintance and his girlfriend

An acquaintance was staying with us a short time ago and I let him use my cell phone to text his girlfriend and listen to music. A week ago he acquired a cell phone of his own. Completely different ...
-1
votes
2answers
253 views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
1
vote
1answer
63 views

What is the impact of controling the content of a webview in Android?

I'm learning android application pen testing and I'm kinda lost about what can do an attacker that control the content of a webview ? I guess if there is no javascript enabled there is no impact, ...
0
votes
0answers
48 views

How to decrypt a rocksdb file from Android?

I have collected an encrypted RocksDB file from an Android application. By reverse engineering the mobile application I have also collected the encryption key. However, for the life of me I cannot ...
0
votes
0answers
148 views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
0
votes
0answers
70 views

Android Encryption: Can an attacker get the master key due to Android's default password and wear-leveling?

Since Android 5.0: Upon first boot, the device creates a randomly generated 128-bit master key and then hashes it with a default password and stored salt. The salt and the encrypted master key are ...
1
vote
1answer
160 views

Is the Android screen lock good enough to prevent access to an Android 8 device?

I have Android 8 mobile phone and I need to give it for mobile repair center for battery replacement. There is chip car, but there are lot of data in my phone. What I want to know is it enough having ...
0
votes
0answers
63 views

memcpy() in device/program with jemalloc allocator does not crash

Managed to get signed length value to memcpy() 02-16 01:44:49.096 6423 6471 W bt_hci_packet_fragmenter: reassemble_and_dispatch reassemble_and_dispatch 02-16 01:44:49.096 6423 6471 W ...
1
vote
1answer
60 views

Is there any way to protect main activity of the Android application from being launched by the other applications?

By default main activity of my application (HelloWorld from the Android Studio) is exported and does not require any permission to launch it. Is there any way to protect my main activity from being ...
0
votes
0answers
37 views

Can I copy audio data from mic to a file in android?

I have recently found a UAF vulnerability in android that renders MIC data stream to be accessible. I am relatively very new to this field and do not really know how to capture the data from the ...
5
votes
1answer
141 views

What's the worst security issue what can happen by using eval() in Android WebView?

I've come across a hybrid Android app - meaning most of its UI is implemented in a WebView using HTML and JavaScript technologies. The app itself is connecting to the server and one of the possible ...
3
votes
1answer
70 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
1
vote
0answers
59 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
1
vote
1answer
2k views

I clicked a Grabify link. Is my phone hacked now?

Someone sent me a grabify link on discord. Now they told me they know my IP address, the device's name that I am using, my location and IP address. I am wondering how much else do they know? Should I ...
1
vote
1answer
158 views

APK Signature Scheme v1 vs APK Signature Scheme v2/v3

What are the security implications of using the APK Signature Scheme v1 instead of the APK Signature Scheme v2/v3? Are there any additional attack vectors for v1 except for direct attack vectors in an ...
0
votes
0answers
34 views

I found io.fabric.apikey in Androidmanifest.xml [duplicate]

Is there any way to use this api maliciously. If yes please give reference. If this api key is leaking anywhere on internet is it considered as sensitive?
0
votes
2answers
86 views

Protective steps to prevent files sent through WhatsApp from installing malware

I have been reading articles about exploits which allows someone to send an MP4, PDF or other file type through WhatsApp or other service, which self-executes to install malware without any user click ...
-1
votes
2answers
454 views

Uniquely identify each mobile phone of Android 10 / 9 and below

Background: I have an Android APP with millions of users, but some users are malicious users (robot, fake, privilege escaped, etc). The common solution is to detect & block those "bad" accounts ...
4
votes
1answer
321 views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
1
vote
1answer
38 views

Is a debuggable android application exploitable from another application?

I know that if an application set debuggable to true in the manifest a user with physical access can debug the application and get access to the private directory of the debuggable application. But ...
0
votes
1answer
395 views

Is Android encryption secure? [duplicate]

As far as I know Android (Pie) is encrypted by default with some hardware-based password. But how secure is this encryption? I am not talking about password compromise, but if somebody gets my phone,...
0
votes
0answers
94 views

msfvenom: backdoored apk

I am using msfvenom to backdoor an Android apk. It is supposed that msfvenom adds extra permissions to original AndroidManifest: [*] Poisoning the manifest with meterpreter permissions.. [*] Adding &...
1
vote
0answers
74 views

How I rescue my Android from a trojan and how did I get it? [closed]

I received a message with the famous link My-love co via Whatsapp and I never clicked on the link; I blocked the contact and deleted the message containing it; such a link was reported as infected by ...
3
votes
1answer
222 views

Do mobile apps have their own certificate store?

When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
0
votes
0answers
19 views

Sniffing Traffic Android App [duplicate]

So, imagine that a vulnerable app provides a login interface. This login sends the user's credentials to the App's server to authenticate the user. However this is done via HTTP, therefore not secure. ...
0
votes
1answer
136 views

Are cell towers basically routers? If so, could one be hacked to spread malware to all connected devices?

Just listened to a bit of the Darknet Diaries podcast episode on NotPetya. It’s insane just the damage it was able to cause even if it was only able to infect one machine initially. Which got me ...

1
2 3 4 5
23