Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

0
votes
0answers
35 views

Checking authenticity of a mobile app (digital staff card)

I've been asked to implement a digital card for member's of our organisation, to replace the old plastic ones. Members would install our app on their phone and setup a "card" with their photo on it ...
1
vote
0answers
32 views

Android KeyStore key storage

How are RSA private keys stored within the Android KeyStore (on devices that do not have a secure hardware element) protected ? Are they encrypted using some form of Password Based Encryption based ...
-2
votes
0answers
62 views

Script for searching personal data in HTTPS request from Android [on hold]

How can I search for personal data in Burp Suite HTTP/HTTPS requests? I using Burp Suite for pen testing Android apps and I need some script for searching personal data which are transmited from ...
0
votes
0answers
36 views

openVPN client connects to VPN server from Android app but not from Ubuntu or iOS app [on hold]

Disclaimer: I am posting with full knowledge that the school owns the network and has every right to restrict traffic as they wish. My rpi3 is running an openVPN server configured using PiVPN and it'...
-2
votes
0answers
52 views

How to hack Android to use image binding method? [on hold]

I already created the program for binding method, but, it is not working. Please tell me the correct program coding.
0
votes
0answers
44 views

can someone explain ssl/tls renegotiation by giving an example? [closed]

I have started learning android pentesting. I want to know what is ssl/tls renegotiation. On a blog written on mcafee's website, it says that ecommerce apps use renegotiation. Can anyone tell me, how ...
0
votes
1answer
64 views

How to ensure same BCrypt hash on different platforms?

Do I get it right that BCrypt hash depends on implementation? I'm using jBCrypt on client side (android) and spring-security-core BCryptPasswordEncoder on server side (with the same strength=10) and ...
0
votes
2answers
69 views

Using device fingerprint to prevent an attacker from calling my login REST service for doing dictionary attacks, is this an effective solution?

As you know, REST services of mobile application are vulnerable from calling by other unauthorized users, some attacks can be done, and we don't have any prevention mechanism for them, such as ...
0
votes
0answers
44 views

How to verify firebase realtime database is public? [closed]

How to verify the firebase database is public or not using URL https://{Project-name}.firebaseio.com. I have given the rules like below for my firebase database { "rules": { ".read": true, ...
0
votes
1answer
91 views

Android leaking app analysis

In my thesis I'm trying to analyze leaking private data on Android apps. I noticed that the vast majority of data is encrypted. How can I analyze this data without decrypting it?
0
votes
0answers
33 views

Android keystore and accessing keys

I'm reading this documentation on how to use Android keystore. There're couple of points I don't quite understand. First of all, in the docs, it says; Key material never enters the application ...
1
vote
1answer
74 views

Prevent bypassing of SSL Pinning in android application

I am creating an android application which is able to ping the server for certain information and return them. There are a few methods by which a user can bypass the pinned SSL certificate of an ...
0
votes
2answers
57 views

Can 3rd party AVs have accessed to my Windows PC and Android phone even after uninstalling and removing them?

Before we start this, I have paranoia issues (doctor diagnosed, not self-diagnosed) so things might at some points seem like an extremely far reach, but please bear with me. I bought an AV yesterday ...
1
vote
0answers
53 views

Is it possible decrypt Android 8 encryption, if the device encryption key is gone (but with a known PIN and KEK)?

main question is in the title. Some clarification though: When you factory reset your encrypted phone, the old device encryption key (DEK a) gets deleted and a new encryption key (DEK b) is being ...
0
votes
0answers
30 views

Logging Keycode event in android secure or insecure?

During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not? Please observe the ...
0
votes
1answer
69 views

On a mobile, does using a password instead of a PIN make encryption stronger?

On a mobile, does using a password instead of a PIN make encryption stronger? What key does the phone use for its encryption? Would it use the PIN itself?
3
votes
2answers
90 views

Outlook for Android uses intermediate Microsoft Servers

I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established. I was auditing ...
7
votes
2answers
176 views

Does connecting an android device via usb to a PC pose a risk if charging is selected?

If an android device has some something malicious on it that can also target/affect PCs. And that device is connected to a PC via USB, by default it automatically chooses to start charging. Is there ...
2
votes
0answers
119 views

Cambridge University paper on Android factory reset still up to date?

An answer (Data deleted after encryption - recoverable?) came to conclusions, which triggered some questions for me. Link to the paper: https://www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf ...
-1
votes
1answer
68 views

tls custom system trusted certificate on android6 not working [closed]

I encounter the same problem as the user has in this post: Why does Samsung Android browser say our site has a valid certificate, but the site identity has not been verified? The accepted answer is: ...
1
vote
1answer
98 views

How does android antivirus scan root files like “/data/data”

I want to know how does android antivirus scan packages private files in "/data/data" directory. I read somewhere that they check the file name with their database and declare it as malware but how ...
0
votes
0answers
49 views

How to intercept packets of system apps in Android?

I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser. I have configured the proxy of my machine with burp port(8080) on the test ...
2
votes
0answers
71 views

How can I securily use a pre-owned smartphone?

Is there a feasible way to safely use a pre-owned smartphone? For a PC/Laptop I would simply shred the contents of the hard disk drive before creating new partitions. If feeling paranoid, I might ...
0
votes
0answers
77 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
10
votes
2answers
241 views

Is it possible to get infected by opening an email in Android Gmail app?

I just received an email from an unknown person, titled "da vinci" and containing a docx file with the same name. Not suspicious at all, right? I have not opened or downloaded the file, but: The ...
1
vote
1answer
139 views

Data deleted after encryption - recoverable?

My device (Android 8.0) is encrypted with the default encryption (no startup password). As far as I know, when I have data on my phone and factory-reset the phone, the data is unrecoverable, since a ...
0
votes
0answers
13 views

Prevent the android app from running if packet capture or any sniffer is installed on the phone [migrated]

I want to make my Android app secure. In some applications, if the phone has a network sniffer program installed(packet capture,ssl capture etc), the application gives an alert(Remove packet capture) ...
1
vote
2answers
146 views

how easy a device can be hacked? [closed]

from when i was kid until today , i still have this idea that hacking is someone knows your ip address then he magically control your device and take a copy of your data. without even sending you a ...
1
vote
0answers
105 views

How to crack encrypted Android SQLite DB? [closed]

I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts, How do we ensure that DB is encrypted properly and it is ...
0
votes
1answer
53 views

Possible risks of multicast

I noticed that a android in my network is constantly connect to Multicast DNS IP. I seen this because my firewall block this inbound connection. Other devices connects to that IP too, but this android ...
1
vote
1answer
126 views

How to sniff bluetooth traffic to Android app?

Please bare with me with this introduction to the problem. Unfortunately title might be confusing, but it's hard to came up with proper one - let me show you why. I'm trying to decode WM-Bus (Smart ...
1
vote
1answer
67 views

About Android's PNG vulnerability

I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can ...
0
votes
0answers
41 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
28
votes
2answers
5k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
0
votes
1answer
60 views

What is the process of finding deep links from an Android application?

I'm very curious on how to go about this the only solution i can think of is to decompile, modify the code to print when a deep link is clicked, and recompile, if you have any other suggestions i ...
1
vote
1answer
266 views

Can I decrypt my SD card as phone died

The mainboard of my s7 passed away and i need to decrypt my SD card. Does Samsung store the keys in their cloud? Is there any way to decrypt the card? I can't believe that once the phone dies (mb, ...
1
vote
0answers
92 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
1answer
173 views

What is more safe: 3g/4g or public wifi?

The scenario is: John is out of home and, using his smartphone, he need to send some messages from Whatsapp, use Facebook's app and do some bank operations. Since I have read this and this topics, I'...
-5
votes
1answer
155 views

A safer way to read emails on Android devices

I've been trying to think of a safer way to check the email on an Android device. Android devices are generally very insecure, and therefore they should not be trusted for anything serious. Here are ...
0
votes
0answers
54 views

Junk code insertion in Smali

I was trying to obfuscate android by adding junk code in Smali. Understood that by adding nop/goto instruction to it works well. However when I tried to add (const/4 v0, 0x4) my app crash after ...
0
votes
0answers
175 views

Can my father's smartphone be compromised?

My father said to me that he allowed installation of apps from unknown sources when he was asked to do it to go further with something (he said that don't remember when or what he was doing). In ...
2
votes
1answer
108 views

Hide an app on Android

Is there any way to completely block anyone or anything from detecting an app that is installed on any Android device? Not from physically looking through someone's device but from google or any ...
0
votes
1answer
126 views

Strange spam to my IG and email with my secret information

I got strange email recently telling that i have an affair and it listed my visited cities with my boyfriend last year. Also threaten to share my relationship with others. Something that bother me ...
0
votes
1answer
40 views

Protecting Android debug bridge that is connected to the internet

I have an android device which acts as a brain for my home security that has access to cameras, heat sensors, motion sensors and some appliances. I have enabled android debug bridge on my android ...
0
votes
0answers
27 views

How to use Network Service Discovery in Android Studio

I am trying to create an android app that discovers devices on a network and lists these to the user. From what I understand, the best way of doing this is by using NSD. So, I have attempted to run ...
1
vote
0answers
35 views

Can an attacker spoof content provider, backup manager or wallpaper manager in Android?

We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app. So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
0
votes
2answers
104 views

Opened a phising email on school email

Hello I opened this email sent to my school email and I realized it was a phising email. And now my OCD and anxiety are going haywire. Is it possible I got infected? I did not click on any links. I ...
1
vote
2answers
53 views

Security Audit - How to make sure a specific android app does not send my data to its data center

We need to pass a specific security audit in our company. All our front line workers use the mobile phone provided by our company (controlled by Intunes) and they require to install apps such as ...
2
votes
3answers
268 views

How do I protect from a PNG vulnerability on Android?

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached. What's interesting it's asking to interact with the image and "copy-...
1
vote
2answers
81 views

Doubt on Android permissions mapping with UIDs/GIDs

Reading the book: Android Security Internals I'm reading at Chapter 2 - Permission Management paragraph that permissions are assigned to application at install time by the packet manager with a ...