Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
0
votes
0answers
42 views

How many possible ways are there to track the location of a mobile phone? [closed]

I really need to know the nearest location (and if possible exact) of a mobile phone (Android or iPhone). Yes, the simplest answer will be with a Google Maps API, but the mobile GPS must be activated ...
3
votes
1answer
339 views

Is it safe to transfer location data by using TLS?

Is it safe to transfer location data by using TLS with self-signed certificates? I read a lot of varied discussions on the web which makes me to ask about the subject.
2
votes
0answers
24 views

What was the original intent for the feature that StrandHogg uses?

The "Affinity" of Android tasks seems really complex to handle. The StrandHogg vulnerability uses tricks with "Affinity" to render itself inside an another app. The information that I've found this ...
0
votes
0answers
52 views

Is it possible to analyze and decrypt personal message? [closed]

I'm doing a pentest for my thesis on an Android application called Picmix that targeted to private message. I still do not know the concept. Can a private message conversation of an android app be ...
0
votes
0answers
9 views

Is it possible to support TLSV1.3+ on Android API <20 by using a 3rd party library? [migrated]

I have to support an Android device that uses Android <20. We use AWS for our API's and want to support TLSv1.3 and beyond, but these devices may not be upgraded for some time. Android API <20 ...
1
vote
1answer
52 views

Is my data safe if I run an android app (a game) on emulator inside a virtual machine

I want to play a very popular game made for mobile platform, but, my father doesn't allow me to touch any smartphone. I tried bluestacks to play it on my pc. But, while installing the game, its ...
2
votes
1answer
50 views

JWT Token Stored in /data/data/<app>/shared_prefs - Android App

I am testing an Android application I am creating for learning purposes (I am using a pre-existing skeleton code my friend gave me). The application uses firebase and stores the JWT token in an xml ...
1
vote
0answers
39 views

Is it possible to obtain a forensic image of an Android device without installation of custom recovery mode or rooting?

I need to forensically image a Samsung phone that is not rooted or running a custom recovery mode. I have not been able to pull an image using ADB, as the default Samsung recovery mode only allows ADB ...
1
vote
0answers
53 views

Why does Samsung access my contacts and storage if I use their store? [closed]

If I want to access the Galaxy Store on a Samsung Galaxy phone I have to agree to a set of terms (Legal information). These terms are excerpted below: All content made available to you by the ...
1
vote
0answers
69 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
3
votes
0answers
68 views

CORS Trusting Arbitrary Origin on Mobile App

I am testing a mobile app that makes calls to a REST API. The API is only used by Android and iOS apps. Apps are native apps and they do not use web views. API trusts arbitrary Origins and Access-...
0
votes
0answers
30 views

Ideal technique for ensuring a refurbished phone is clean of malware [duplicate]

I'm thinking of buying my next phone refurbished rather than new, since I can easily get something that meets my needs for a lot cheaper. But one concern is whether something might get surreptitiously ...
2
votes
1answer
80 views

Countering a system killing UID/GID=0 processes in Android

Suppose that there were a security system in an Android kernel meant to prevent exploits that have arbitrary kernel memory read/write from getting root privileges. This system, Kills a process by ...
1
vote
0answers
20 views

gdb in virtual emulator [migrated]

I am testing some code for an Android device, emulated with Android studio. I would like to debug the c code ("POC") with gdb (which is not included in the binaries of the device) to find where it is ...
0
votes
1answer
57 views

Android forensics on Samsung Galaxy S7 edge's Voice Recorder

I have a Samsung Galaxy S7 edge. The default app that comes with the phone is called Voice Recorder and it belongs to Samsung, it cannot be uninstalled. I recorded something highly sensitive that ...
1
vote
1answer
73 views

Bank client android app authentication security

I'm currently developing an android bank client app. Obviously security is key here. The app sends requests over HTTPS TLSv1.2 to my java server. What I currently have in mind Login The app asks ...
1
vote
1answer
54 views

Monitoring the HTTP(S) calls being made from android App

I want to test for security vulnerabilities in an Android App and hence want to monitor all HTTP(S) calls being made from an Android App. I have setup BurpSuit in my Laptop and have also set up the ...
2
votes
1answer
74 views

Is there any way to keep the request in intercepting proxy for atleast a min before application says check your connection?

I just bypassed SSL pinning on an android application but the problem is application won't let me play with the request on my intercepting proxy. It says something like problem with your network or ...
3
votes
1answer
103 views

Security risk of leaving bluetooth on all the time on an Android 10 phone

What are the security risks associated with leaving bluetooth on all the time on a Pixel phone updated to Android 10? In this question, I am NOT focusing on the risks associated with someone ...
-3
votes
1answer
89 views

Is there any service/application which would detect the encryption type? [duplicate]

I am debugging a TCP connection, which returned multiple values such as: +†Ä˜Õõıû and 'G1÷ù]TB*ø5£"ñB—£s∏f '1÷ù] What I am trying to find out, is how is this encrypted, and find a way to ...
2
votes
0answers
96 views

How do I protect myself from Pegasus and alike malwares?

I recently came across reports in media that Whatsapp's services were exploited by a malware Pegasus for illegal surveillance of certain individuals. Pegasus, which exploits 0-day vulnerabilities, is ...
0
votes
1answer
89 views

Disinfecting Android device

If an unrooted Android device is infected with a virus, rootkit or malware, would resetting the device disinfect it?
0
votes
0answers
45 views

Does the NSO Group's Pegasus malware compromise chats and voice calls in Signal as well?

I am aware that the Pegasus malware is capable of extracting contact lists, ordinary text messages, switching on microphone / camera remotely etc. Is it also capable of extracting the contents of ...
2
votes
1answer
68 views

Reason to generate encryption keypair server side rather than on device?

I want my native applications (android/ios) to have a keypair (RSA or ECIES) so that certain data on requests to my API can be encrypted. I want each client to have a unique keypair. The device will ...
1
vote
0answers
39 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
61
votes
6answers
9k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
0
votes
0answers
75 views

Anti-Theft Mobile CPU

The newest Android phones use the Qualcomm Snapdragon 855 chipset with its TrustZone/TEE. The Android OS makes sure that a stolen phone, in its assembled form, is not usable. Does Trustzone further ...
0
votes
0answers
28 views

Chrome on Android connects to suspicious address on open [duplicate]

I had legitimate suspicion that someone is spying on my internet traffic. So I connected my Android phone to proxy via mitmproxy. I noticed that when I opened Chrome, it automatically connects to ...
6
votes
1answer
104 views

How much of a security issue discontinued vendor security patches are on Android?

As an example, the original OnePlus One has good LineageOS support, but the vendor security patches were seemingly discontinued three years ago: What are the security implications and is the vendor ...
63
votes
6answers
13k views

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

My Android (8.0) phone was pickpocketed from me yesterday. It was immediately turned off by the thief and when I tried to locate it using Find My Device it shows as offline. As a programmer and a ...
1
vote
2answers
170 views

How an ISP can detect if someone having a WhatsApp call or video call? without detecting or blocking the rest of the app [duplicate]

I am asking the questions because of the latest news: https://www.bbc.com/news/world-middle-east-50095448 I wonder how the ISP can detect the use of call and video calls, without detecting or ...
1
vote
2answers
83 views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
0
votes
1answer
103 views

Unrooted Android

Can a hacker install a spying software or hack an unrooted Android device with physical access?
0
votes
0answers
42 views

Mobile Code Scanning

I know that MobSF is generally well recommended as the OSS solution for code scanning of mobile devices. To my knowledge though, it only performs dynamic analysis of android applications (and you ...
1
vote
0answers
50 views

Why does CVE-2019-2130 show up in Ubuntu and NodeJS?

In the NVD report for CVE-2019-2130 it shows that the products that are affected are only Android, and the links found in the Mitre page of the CVE lead only to an Android report of the CVE. This is ...
2
votes
0answers
55 views

Implications of adding work account to an android device

Once there's a primary Google account registered on the device and then another work account is added in order to access G Suite of the work place, what are the G Suite administrators are able to ...
1
vote
1answer
64 views

Is sending an object created via intent.getSerializableExtra to handler.postDelayed leading to Code Execution?

I'm new to android pentesting and I would like to know : if sending an object created via the result of intent.getSerializableExtra("EXTRA_TEST"); to handler.postDelayed(TheObject,500) could lead ...
0
votes
0answers
45 views

How to access variable of the parent class from a DexClassLoader?

I have an application that run a method from a class via DexClassLoader like that : Class<?> classToLoad = new DexClassLoader(codeFile.getAbsolutePath(), tmpDir.getAbsolutePath(), null,...
0
votes
0answers
47 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
1
vote
2answers
61 views

Use bidirectional SSL with CAC from phone

Is it possible to extract the certificate from a CAC (DOD common access card) and install it on a phone so that access to websites using bidirectional SSL can be done from a user phone. Ideally, the ...
0
votes
0answers
29 views

Activity (Logging Screen, and recovery password) are vulnerable to using by others applications?

I have an application, and I ran the Drozer Framework, It show me some Activities that has not permission, Is the activity of my Login and recover password, So If I run the activity in external ...
0
votes
0answers
52 views

Decrypting Android KeyStore as root

Is it possible to decrypt and extract data from the Android keystore when the device is rooted? Since the device is rooted, I assume that it is possible to get access to the Hardware key to decrypt ...
0
votes
0answers
344 views

Step by step guide for doing Wireguard VPN security and setup properly, for Android phone to OPNSense/pfSense LAN

Truism: Doing security right, is subtle and full of snags for the clueless. Concern: I haven't ever set up a connection between 2 computers using RSA/SSH keys or certificates, in my life. ...
6
votes
0answers
66 views

Can a wireless headphone contain malware which can infect an Android device? [duplicate]

I go to conferences and there are often free bluetooth earbuds and headsets given away. If I pair them with an Android device, is it possible for them to infect the phone with a virus? I have read ...
0
votes
0answers
18 views

Is there a way to clone my student ID card with an Android phone? (MIFARE DESfire) [duplicate]

Is there any way to clone my Student ID card for use with my Android Phone? I found an app for cloning MIFARE Classic cards, but it shows my card as a DESFIRE I realize it's exactly the sort of ...
1
vote
0answers
50 views

Suspicious Android app - install on its own - no uninstall option - name in Japanese [closed]

I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea: what it is why it's in my phone how long it's been there and how to uninstall it (there's no ...
1
vote
1answer
65 views

Is there a way to protect a supporting app against changing the REST endpoint?

Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application. Looking for online, I found some articles about this app ...
0
votes
1answer
68 views

How to detect new device in Android?

I'd like to notify my users if a login happens from a new device. Like Google does for Gmail logins. Android ID and IMEI usage for tracking is discouraged by google. How can I track devices without ...
0
votes
1answer
86 views

Is there any real protection against Google on Android phones? [closed]

There's a lot one can do to protect his self identity and from being tracked on standard computer machine, but I wonder if there's any way to do so(or at least as close as it possible) on the Android ...
0
votes
0answers
22 views

Auto execute meterpreter commands on session start(android) [duplicate]

I want my meterpreter to execute the command as soon as it gets the session. My payload is android/meterpreter/reverse_tcp I want a file that can execute these commands automatically as soon as ...