Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
0
votes
1answer
51 views

What is “play security information update”

In my android phone I have random downloading progress started by download manager. The notification says "play security information update". I have no idea if this is a regular android security check ...
-1
votes
0answers
26 views

Obfuscation for Hybrid Mobile Applications [on hold]

Need recommendations for security best practices for the JS/HTML/CSS code in hybrid mobile applications. The javascript code in a hybrid mobile application built on a platform like Cordova, Ionic, ...
0
votes
0answers
29 views

Error while loading Android Keystore [on hold]

I am currently experiencing a problem with the use of Keystore on Android. My current situation is as follows: I want to store certificates in a custom format in the Keystore. For that, I created a ...
-5
votes
0answers
51 views

Folder Lock App guide me! [on hold]

I'm developing a folder lock app. In this app, I can pick images from phone storage and store in app and then I'll lock the app because no one can get access to my personal pics. The problem is that ...
-1
votes
0answers
120 views

5 VirusTotal engines detecting the apk as malicious file. Should I be worried? [closed]

I don't usually download apps from untrusted sources or which are not available on play store but for some reason I downloaded an apk file and just to make sure it is not malicious, after downloading ...
0
votes
0answers
39 views

Access Android files without entering pass-code

I have a Samsung A5 from a friend. Her screen is totally broken (black) and she wants me to recover her files. The problem is that you need to enter the pass-code of the phone in order to be able to ...
31
votes
4answers
7k views

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
4
votes
3answers
388 views

What is this Russian calendar reminder that popped up?

I woke up this morning and saw a calendar reminder that I definitely did not put there, written in Russian. It would be super helpful if anyone knows what the text means, but I figured opening the ...
-1
votes
0answers
61 views

How particularly insecure to give unlimited physical access to Android device?

Suppose I have a phone with broken screen secured by several digit (for example 4 digit) password and fingerprint check. So I cannot backup my data and make factory reset before transfer it to ...
1
vote
1answer
65 views

Android key protection

I was reading this documentation and saw this part; When an application performs cryptographic operations using an Android Keystore key, behind the scenes plaintext, ciphertext, and messages to be ...
4
votes
1answer
111 views

Is restricting a Google API key for an Android app useless?

According to Google, one can add the SHA-1 certificate fingerprint and the name of the package in the Google Developers Console to restrict the usage of his API key to his Android app, so that ...
0
votes
1answer
76 views

Unable to intercept android app traffic neither in Burp Suite nor in Network Profiler. Can anyone help?

I need to perform MITM attack on an app which doesn't use HttpURLConnection and OkHttp libraries for network connection. Analysis : Configured burp on the devices, able to capture request of Chrome ...
2
votes
1answer
64 views

Encrypting mobile user data in event of PIN/device compromise

As I understand it, modern mobile OS's often encrypt app data when a device is locked with a pin or password. However, how do I protect users if their device or pin has been compromised? If I ...
0
votes
1answer
43 views

Implicit Service for Firebase

I'm starting android bug hunting and I've seen a service with implicit intent, and I saw in Android documentation that : Using an implicit intent to start a service is a security hazard because ...
0
votes
0answers
82 views

SSL handshake: Client Hello and Server Hello

I am trying to understand how a client communicates with a server when using a proxy. The client is an Android device, whom the traffic is proxied to the server through mitmproxy. This is my topology:...
1
vote
1answer
202 views

How secure is full-disk encryption technology on LineageOS, or Android phones in general?

We're attempting to assess the information security on our mobile devices, and information seems rather varied on the question of encryption. Is the encryption technology employed by Android-based ...
0
votes
0answers
47 views

Error: Inavlid template facebook.apk while using metasploit for hacking android

I am learning ethical hacking recently. I installed Metasploit on my Ubuntu system. While I'm building the payload, I'm getting the following error message: error : Invalid template:facebook.apk I'm ...
0
votes
0answers
41 views

Checking authenticity of a mobile app (digital staff card) [duplicate]

I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
1
vote
0answers
47 views

Android KeyStore key storage

How are RSA private keys stored within the Android KeyStore (on devices that do not have a secure hardware element) protected ? Are they encrypted using some form of Password Based Encryption based ...
0
votes
1answer
98 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
0
votes
2answers
88 views

Using device fingerprint to prevent an attacker from calling my login REST service for doing dictionary attacks, is this an effective solution?

As you know, REST services of mobile application are vulnerable from calling by other unauthorized users, some attacks can be done, and we don't have any prevention mechanism for them, such as ...
1
vote
1answer
111 views

Android leaking app analysis

In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted. How can I analyze this data without decrypting it?
0
votes
0answers
36 views

Android keystore and accessing keys

I'm reading this documentation on how to use Android keystore. There're couple of points I don't quite understand. First of all, in the docs, it says; Key material never enters the application ...
1
vote
1answer
176 views

Prevent bypassing of SSL Pinning in android application

I am creating an android application which is able to ping the server for certain information and return them. There are a few methods by which a user can bypass the pinned SSL certificate of an ...
0
votes
2answers
63 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
1
vote
0answers
99 views

Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?

main question is in the title. Some clarification though: When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
0
votes
0answers
47 views

Logging Keycode event in android secure or insecure?

During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not? Please observe the ...
0
votes
1answer
76 views

On a mobile, does using a password instead of a PIN make encryption stronger?

On a mobile, does using a password instead of a PIN make encryption stronger? What key does the phone use for its encryption? Would it use the PIN itself?
3
votes
2answers
112 views

Outlook for Android uses intermediate Microsoft Servers

I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established. I was auditing ...
9
votes
3answers
211 views

Does connecting an android device via usb to a PC pose a risk if charging is selected?

If an android device has some something malicious on it that can also target/affect PCs. And that device is connected to a PC via USB, by default it automatically chooses to start charging. Is there ...
2
votes
0answers
127 views

Cambridge University paper on Android factory reset still up to date?

An answer (Data deleted after encryption - recoverable?) came to conclusions, which triggered some questions for me. Link to the paper: https://www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf ...
-1
votes
1answer
73 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
1
vote
1answer
124 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
0answers
86 views

How to intercept packets of system apps in Android?

I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser. I have configured the proxy of my machine with burp port(8080) on the test ...
4
votes
0answers
109 views

How can I securily use a pre-owned smartphone?

Is there a feasible way to safely use a pre-owned smartphone? For a PC/Laptop I would simply shred the contents of the hard disk drive before creating new partitions. If feeling paranoid, I might ...
0
votes
0answers
122 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
10
votes
2answers
249 views

Is it possible to get infected by opening an email in Android Gmail app?

I just received an email from an unknown person, titled "da vinci" and containing a docx file with the same name. Not suspicious at all, right? I have not opened or downloaded the file, but: The ...
1
vote
1answer
159 views

Data deleted after encryption - recoverable?

My device (Android 8.0) is encrypted with the default encryption (no startup password). As far as I know, when I have data on my phone and factory-reset the phone, the data is unrecoverable, since a ...
1
vote
2answers
152 views

how easy a device can be hacked? [closed]

from when i was kid until today , i still have this idea that hacking is someone knows your ip address then he magically control your device and take a copy of your data. without even sending you a ...
1
vote
0answers
223 views

How to crack encrypted Android SQLite DB? [closed]

I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts, How do we ensure that DB is encrypted properly and it is ...
0
votes
1answer
56 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
1
vote
1answer
250 views

How to sniff bluetooth traffic to Android app?

Please bare with me with this introduction to the problem. Unfortunately title might be confusing, but it's hard to came up with proper one - let me show you why. I'm trying to decode WM-Bus (Smart ...
2
votes
1answer
86 views

About Android's PNG vulnerability

I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can ...
0
votes
0answers
43 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
28
votes
2answers
5k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
0
votes
1answer
73 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
1
vote
1answer
533 views

Can I decrypt my SD card as phone died

The mainboard of my s7 passed away and i need to decrypt my SD card. Does Samsung store the keys in their cloud? Is there any way to decrypt the card? I can't believe that once the phone dies (mb, ...
1
vote
0answers
152 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
1answer
203 views

What is more safe: 3g/4g or public wifi?

The scenario is: John is out of home and, using his smartphone, he need to send some messages from Whatsapp, use Facebook's app and do some bank operations. Since I have read this and this topics, I'...
-5
votes
1answer
159 views

A safer way to read emails on Android devices

I've been trying to think of a safer way to check the email on an Android device. Android devices are generally very insecure, and therefore they should not be trusted for anything serious. Here are ...