Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

0
votes
0answers
10 views

Mitigations for Android Invisible Overlay Views

I would like to begin by clarifying, my question does not relate to TapJacking attacks on Android and to my knowledge filterTouchesWhenObscured will not help in my case. Here is the scenario: I work ...
0
votes
2answers
91 views

Achieve total anonymity on public wifi using Android [on hold]

Would this be enough to achieve total anonymity on public wifi with an Android device: use Orbot spoof your MAC address turn off location services turn off cellular data Are there any other services ...
0
votes
2answers
65 views

What tests can be performed on mobile apps to determine if they are secure?

My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
0
votes
0answers
18 views

Security risks to embedding payment web page in Android app

I am very new to Android app development and I started out with the idea of fixing a small defect in an app. However, I got sucked further in and found that a payment processing company that we use ...
1
vote
1answer
42 views

Authenticate user based on mobile device identifier

I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
1
vote
0answers
26 views

Use BlueBorne to get arbitrary code execution on locked-down Android system from 2016

So here's the story. I have this smart watch, the Olio Model One. I would like to install Asteroid OS onto this watch, and in order to do that I have to get root code execution (the objective of this ...
2
votes
0answers
38 views

A way of doing secure data exchange in Android?

To my knowledge, all current Android apps with internet permission enabled are prone to apps stealing data. For example, if you have a messaging app, all your messages are readable by the company ...
3
votes
2answers
56 views

How to find what files in a zip are malware using Virustotal

I have a malware infected android phone and I am suspicious that some of the binaries in system/bin/ and system/xbin/ are malware so I decided to dump the system and zipped the contents of bin and ...
0
votes
1answer
60 views

Your connection will not be private - Wi-Fi CA certificate warning message on Android

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private. No certificate ...
0
votes
1answer
79 views

Android & Man In the Middle — how did Fox News do it?

A couple years ago Fox News aired a short clip on how smartphones track and upload user location/physical state data. The clip is freely available on youtube and it shows how two Android smartphones ...
2
votes
1answer
68 views

Is Amazon's app store vulnerable to external storage race condition?

There's been a load of kerfuffle about how Fortnite on Android saves APKs to external storage and how they can be overwritten before they are installed. (The press is awkwardly calling this a man-in-...
1
vote
3answers
128 views

How to inspect an email attachment without downloading it?

I accidentally opened a PDF email attachment on an Android phone as I was trying to figure out if the email was fraud or a scam. It was an email claiming I booked a flight and the pdf had my e-tickets....
0
votes
0answers
50 views

How to make screensavers secure?

For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
0
votes
1answer
28 views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
0
votes
1answer
606 views

Strange Chrome notification on Android 8.0

I just got a notification in French (I live in a French speaking country): Sincere congratulations, you won a Galaxy S8 phone. The notification has the icon of Chrome and is coming from news3....
5
votes
1answer
385 views

Using android auto in a rental car

I've started using rental cars frequently for work and android auto has apparently become common enough that many of the cars I rent have it built in. It could be helpful to me even over the short ...
0
votes
0answers
81 views

Can a Whatsapp account be spoofed?

I've had a big privacy concern lately regarding the safety of my Whatsapp account. Ever since my phone was stolen from me and returned by certain malicious individuals, I've had the weirdest feeling ...
0
votes
0answers
44 views

Can a phone provider tracked your phone if their SIM is not in the phone?

Let's say I have a dual SIM phone and I took one of the prepaid SIM cards out, the one that is being used to track me. The tracker is unaware that I had another one, and turned off the phone before ...
8
votes
1answer
236 views

Why would a banking app require access to browsing history and information about apps running on the device?

I have a banking app installed, but when I tried to update it, it asked me for permissions to access browsing history and the information about apps running on the device. Why would a banking app ...
1
vote
0answers
19 views

How to open a Boxcryptor file from emacs running inside termux on Android

I'm using Boxcryptor to encrypt my files in Dropbox. I use termux to run emacs on my Android phone. I'm having trouble opening the Boxcryptor files in emacs because I don't know where to look for the ...
1
vote
2answers
53 views

At What Point Does A Device Correspond/Link to its Owner?

I am aware that governments, organizations and hackers can do a plethora of things to your device (i.e. track your location, tap calls, etc.), but I can only assume that they can only do these things ...
7
votes
1answer
197 views

Does the ANeko app demonstrate vulnerabilities in the Android architecture?

There is an Android app called ANeko, which lets a cute cat run around your screen. The app doesn't require any special permissions. When I first started it, I was frightened for several reasons: It ...
1
vote
0answers
25 views

Android - Is there is a way to give an app a Permission through Bash scripts? [closed]

As the title says, I'm trying to find a way to give a specific app a permission without requesting it from the user, maybe through executing a script? Is this is even possible in anyway?!
0
votes
0answers
50 views

Wireshark showing all ports being probed from my tablet

The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
2
votes
1answer
72 views

What to never log to Android logcat?

Android apps write their logs to a file (usually referred to as "logcat") which is very useful not only for developers but also for users who want to investigate problems. You can easily see that ...
0
votes
1answer
112 views

Does Google identify me from my 'phone?

As per my previous question I would like to escape Google as much as possible. Since I realize that I can’t do this completely, I will do what I can, although some might find it pointless. I have ...
-2
votes
1answer
192 views

How can I intercept Android application's SSL traffic where SSL pinning is used?

I want to capture the SSL traffic of an Android Application which I think uses SSL pinning. I've tried running an app which says it uses VPN Tunneling and a Root Certificate to capture the SSL ...
0
votes
1answer
95 views

Infect Android device from inside the network without target knowing?

Is it possible to malicious some device in the same network without the user knowing? there some people use malicious apps but the problem is the user have to see the dialog box application ...
0
votes
0answers
26 views

Suggestion for intercepting traffic with android app [duplicate]

Are there any tools that I can use to intercept the traffic of android app? I tried Charles proxy and Burp suite but they only support HTTP/HTTPS traffic. I have to pentest a game, basically it's ...
2
votes
1answer
100 views

Phone Number Appears to Have Been Temporarily Hijacked

What Happened: At 8:40am Telegram sends me a login code via the Telegram desktop app. At 8:44am Telegram informs me that someone has logged into my account via ip address #1 (appears to be PIA vpn) I ...
0
votes
1answer
160 views

How can an Android device be unlocked, and how long would that take?

The original question was about the minimum password (or PIN) length (or entropy) for the screen lock in Android. Seeing that nobody answered, and following Schroeder's advice, I'm going to edit it ...
0
votes
0answers
172 views

Android Messages Web and Privacy

Recently Google rolled out the feature to send SMS/Chat messages over Web via their Android Messages app. The approach seems similar to the WhatsApp Web Client. What I didn't find however are ...
2
votes
1answer
65 views

Need DNS changer app (or method) which actively locks DNS servers [closed]

I have tried all methods in the following link except DNS+DNSCrypt (having issues in flashing files): https://forum.xda-developers.com/general/xda-university/guide-how-to-change-dns-android-device-...
0
votes
0answers
98 views

Android phone connects to unknown WiFi-network without my action

I was visiting another city, and in one area, I noticed that my phone was connected to an unknown WiFi access point: I have never seen/been there in my life, and have never connected to that AP. What ...
2
votes
1answer
54 views

Is it safe to keep a hardcoded oAuth token on an app built solely for personal use?

I've built an android app that is only ever going to be used by me. It's not deployed to the store or anything - I download it to my phone with HockeyApp. However, this app has an oAuth token ...
0
votes
1answer
40 views

Can a Malicious App with Storage permissions access a Secure App's data

1) Assuming I have an untrusted app, e.g. sideloaded from an untrusted source with permissions to access storage granted installed on a recent (v7 or 8.x) Android device. 2) Assume I also have Signal,...
0
votes
0answers
75 views

ProtonMail Android app - security on phone

If I install the ProtonMail Android app on my phone, are the messages and the ProtonMail account ID itself secure within the phone? I assume many of the apps on my phone are able to see a lot of my ...
3
votes
2answers
112 views

Installing own certificate for HTTPS sniffing?

This is something I heard before but cannot remember how to do, I am looking for a tutorial or alike. I have an Android application I need to audit. I need to check if any cookies are being ...
13
votes
2answers
614 views

How can I escape Google?

I am unsure how to formulate this question, so please feel free to edit it. I considered asking on https://android.stackexchange.com/ but feel that this is more security related and more likely to ...
1
vote
1answer
86 views

Is showing the package name(Android)/bundle ID(ios) a security risk?

Suppose I release an app and accidentally publish the package name/bundle ID of the app which is suppose to be shown in development only, in a page. Is there any security concern that arises from this?...
0
votes
0answers
187 views

How to remove the FatRat (Kali Linux) generated payload from Android Device(Lollipop 5.1)

I have created a Payload (.apk) by FatRat (Kali Linux) and have installed it on an Android device (Lollipop 5.1). Now I want to remove the installed application from my device but could not been able ...
1
vote
0answers
46 views

Diffie-Hellman in Android File Transfer application [closed]

I'm working on the famous android app to transfer files using WiFi-Direct technology: https://github.com/Miserlou/Android-SDK-Samples/tree/master/WiFiDirectDemo I want to implement a key exchange ...
2
votes
2answers
225 views

Suspicious Push Notification on Android Phone

When I woke up this morning, I saw a Push Notification on my phone from 'Facebook' saying something like 'Funny Video'. Accidentally clicked on it and it opened a tab in Chrome from with a URL of ...
0
votes
1answer
43 views

Does SSH generate traffic when listening?

Does a service, for example, SSH, generate traffic when only listening (e.g. does it advertise itself in some way) when there is no connection established? I ask as on Android devices for example, we ...
1
vote
1answer
83 views

Shoulder surfing prevention or mitigation for unlocking mobile devices

How can shoulder surfing be prevented or mitigated when unlocking mobile devices? I found other questions about shoulder surfing that focus more on desktop machines, but I believe the issue is much ...
0
votes
1answer
103 views

Is it possible for ssh app on Android to collect my credentials?

I have a condition that I am far away from my laptop that I use to work. All I have is my Android Samsung J2. Sometimes I need to work remotely on my server, checking some stuff like traffic data, ...
1
vote
0answers
159 views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
1
vote
1answer
61 views

Tegra X1 bootrom exploit portability potential (K1 in nexus 9 specifically)

I have been wondering if anyone here reckons that porting the recent Tegra X1 bootrom exploit is achievable? The code in question does not seem likely to be going through significant changes ...
0
votes
0answers
20 views

Mobile apps AUTH flow

When the user enters username and password into an mobile app( iOS ,Android or windows app)it calls a thirds party oAuth login web service which responds back with oAuth access token and refresh token....
1
vote
0answers
242 views

NFC Android (Ntag213 vs Ultralight C)

I have an (university) project where I basically write and read text out of NFC Tags with Android devices in order to store one's balance in the card (wich can be used on the cafeteria, for example). ...