Android is an operating system for mobile devices such as smartphones and tablet computers. It is developed by the Open Handset Alliance led by Google.

learn more… | top users | synonyms

-2
votes
1answer
38 views

Security of stock iPod vs. hardened Android [on hold]

http://www.wired.com/2015/08/secure-way-communicate-IPOs-touch/ https://www.lawfareblog.com/iphones-fbi-and-going-dark I'm looking for some advice on how to affordably secure my electronic ...
0
votes
0answers
49 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
9
votes
2answers
708 views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
0
votes
0answers
28 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
2
votes
3answers
56 views

Bypass app permissions

I'm annoyed and actually scared by all the permissions that I have to grant the applications that is running on my Android phone. Is there is a way to bypass them ? Let's say my microphone. My ...
-1
votes
0answers
36 views

Popup ads in Android app [closed]

I made an Android application and one of my user is complaining that he is seeing the pop-up ads with in my Android application. Could you help me how to track down what is causing this? As this is ...
0
votes
0answers
17 views

Is Android WLAN MAC Address vulnerable? [duplicate]

What can a person do if he/she has WLAN MAC Address of my Android Device? What can be done to save my personal information?
0
votes
0answers
28 views

Does anybody recognize the files below that are in my tablet and cell phone? [closed]

I have few strange files in my tablet and cell phone that comes back no matter what kind of "cleaning" I have done Does anybody regognize these files? What could they be? ...
5
votes
2answers
75 views

Factory reset on a smartphone

On resetting a smartphone, the default factory image replaces the OS completely and restores it to known good settings. Is there any known way by which this default image can be compromised? On ...
3
votes
2answers
194 views
+50

How is “Touch Jacking” prevented on iOS, Android, and Win 10 - touch?

I'm looking at the security of both iOS and Android from a Touch-jacking security perspective. In other words, I expect that an application can be in a secure state to ensure that no overlays, screen ...
0
votes
0answers
37 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advert, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. This is ...
-2
votes
0answers
59 views

implementing a secure client-server system

I am creating an Android app that communicates with a server. I need a safe way to transmit sensitive data so this is what I planed to do: Use ssl pinned to the app, so the app knows the server. Use ...
2
votes
1answer
109 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
5
votes
1answer
49 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
0
votes
1answer
53 views

Is it safe to check if device is subject to Stagefright bug? [closed]

Is it safe to check if device is subject to Stagefright bug, for example with: Stagefright Detector App forAndroid by Zimperium ? Is such (or similar test) sufficient? Is there available any 3rd ...
-1
votes
0answers
13 views

How to run malloDroid script? [migrated]

I want to check SSL verification in my application. I downloaded on my santoku malloDroid.py and try use it (of course earlier I have read that script is an extansion of Androguard). I simply run ...
1
vote
2answers
44 views

Should Android apps for communication encryption and security require permissions like identity, device ID, contacts, etc.?

There is a Android application Threema for communication encryption and that says it does not collect user data, but it requires the following permissions: identity, contacts and device ID. Can ...
7
votes
2answers
72 views

Why does Android use SELinux?

To restrict/sandbox processes Android uses SELinux. Why was that chosen and not the linux capabilities or cgroups+namespaces solution? After all the cgroups+namespaces is kind of home grown for them ...
11
votes
2answers
891 views

Android built-in security for apps?

Whenever you go to Google's Play Store and install an app, a list of all the necessary access is shown and a confirmation to proceed with the installation is required. Let's imagine I would like to ...
0
votes
0answers
4 views

Connecting Android to Windows VPN [migrated]

I have set up a VPN on my Windows 10 computer by going into Control Panel\Network and Internet\Network Connections and hitting Alt and then going to File > New Incoming Connection... and setting up ...
-3
votes
0answers
44 views

Fake Access Point, Victim gets “Connection Refused” [closed]

I'm kinda having some problem with a Fake AP I have, it was working just fine but when I was trying a new script my dhcpd broke and I had to reinstall it and just out of the blue when every an android ...
3
votes
1answer
55 views

Can malware spread via bluetooth file transfer in Android?

I am aware of some malware that spreads when two devices are paired using Bluetooth; but can malware spread when sending a clean file to someone or receiving it via bluetooth ? If so, does it need ...
11
votes
2answers
255 views

“Encrypt and wipe” procedure on Android Lollipop?

I know a lot of people are advocating an "encrypt and wipe" procedure for selling used Android phones. But according to the AOSP website, in Android 5.x Lollipop: Created fast encryption, which ...
2
votes
1answer
85 views

How to determine if it is safe to install apk files from alternative android app stores?

Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
1
vote
1answer
132 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
48
votes
2answers
8k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
59
votes
4answers
5k views

How can common users defend against the StageFright vulnerability?

I was just informed of the StageFright vulnerability in Android devices. A specially crafted MMS message can gain access to data on the phone; so presumably it's a buffer overflow with subsequent ...
1
vote
3answers
75 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
-2
votes
1answer
44 views

Attack on Androids Encryption called FROST

http://www.extremetech.com/computing/150536-how-to-bypass-an-android-smartphones-encryption-and-security-put-it-in-the-freezer I read this article about FROST and in the comments someone was stating ...
2
votes
0answers
91 views

How does an android device/os prevent me from getting root?

I have never used an android phone and so hopefully this is not a bad question to ask. I know on iOS the kernel itself is signed and so cannot be extended and all applications are signed. Hence I ...
1
vote
1answer
162 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
2
votes
0answers
70 views

Using .apk files to reverse_tcp and exploit on android? [closed]

I have been able to install and run the application that I plan on exploiting. Once the app is running I am able to exploit the application. In my testing environment I am able to do this just fine. ...
2
votes
1answer
63 views

Encryption of settings/credentials in mobile apps - what threats does this protect against?

I have been decompiling Android apps recently. In a sample of 37 apps, 12 of these use some form of custom encryption/obfuscation to store settings and credentials on the device. By necessity, the ...
2
votes
0answers
36 views

Risks when connecting Public WLAN networks [closed]

I want to refer with my question directly to a question posted on the forum before. wifi topic I am running teamviewer on my android which is not rooted and i am not using a firewall on it. I guess ...
1
vote
1answer
104 views

What should I do when I found a strange email on my phone?

Today I found a strange email (not sended, just a draft) on my android smartphone, and this is not good. The screen was on standby and when I pressed the on/off button to see the clock, I found a ...
1
vote
1answer
57 views

Phonegap/Cordova InApp pinlock, difference if its on Java Layer/HTML5 layers?

I am going to build a PIN lock on Phonegap, trying to understand the security layer. As Phonegap is just a webview, it can be easily altered, if you are connected to a device. I believe that you can ...
1
vote
0answers
2k views

How do I get rid of the Total Ad Performance malware from my Android? [closed]

My Sony Xperia Z3 Compact has been infected by a malware that redirects my browsers to either one of the two websites: www.totaladperformance.com or www.admomi.com. I have the paid version of ...
1
vote
2answers
102 views

Could one fit a root application in sim card

In the third Mr.Robot episode a character inserted a Micro-SD card in a smartphone in order to root it and gain information, so I thought maybe someone could fit a root-kit on a Sim-card. Would that ...
-1
votes
1answer
38 views

User account password hashing [duplicate]

We are developing a mobile app that includes a user account system. Currently, we have a system password flow like this: User enters password -> SHA-256 HMAC hash with key -> server -> SHA-256 ...
3
votes
1answer
92 views

Android disk encryption

When is the data on an Android phone encrypted? I am assuming here that the device is configured to have full disk encryption enabled. Is it only encrypted when the device is powered off and ...
2
votes
1answer
87 views

How to implement encrytion/decryption system using IV between mobile app and web service

In my app we are going to send encrypted data to the web service. I am using the following code to encrypt and decrypt the data - public class DecEn { private static final String password = ...
1
vote
1answer
59 views

Is there any way track a Andriod phone using IMEI Number [closed]

I have lost my phone and I have a IMEI number of it. However, the guy removed my SIM card. Is there any way to track who is using my phone?
2
votes
0answers
35 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
1
vote
3answers
211 views

Why not fix Android root exploit? [closed]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
0
votes
1answer
14 views

Security risks for a simple network configuration screen in android [closed]

I am building an Android App that pulls chart information from a server where the connection is specified on this view Ideally, the end user will put in a valid host and port resulting in business ...
3
votes
2answers
84 views

Can you use ssh for secure inter app communication on the same device?

I use ssh to get an encrypted connection between servers and local machines all the time. It's fast, it's secure, and there's a way to do it in nearly every system programming language that I've used ...
1
vote
0answers
34 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
1answer
45 views

Looking for a Meterpreter binary for android

I tried meterpreter for android. The apk that is generated by metasploit by giving remote host ip & port and then run on target phone. I found it as a handy tool to access my phone remotely. I ...
0
votes
1answer
56 views

How to check if Android application is vulnerable to heartbleed

I Am trying to find if an android application is vulnerable to heartbleed vulnerability. I want to know how to check if the application is vulnerable to heartbleed by reversing the app file.
0
votes
1answer
73 views

Are deleted SMS still retrievable from Android-based phones? [closed]

I'm wondering whether deleted SMS on Android phones are retrievable? If so, how is this done? How can one avoid it?