Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
2 votes
1 answer
125 views

Is it possibile to capture unlock pin of smartphone(android/ios) using usb cable?

For example, bad USB cable( charging devices) loaded with script to record the unlock code of an android phone which is current being charged. so basically, the bad usb cable and the usb charger is ...
Maxfield's user avatar
  • 149
4 votes
2 answers
2k views

If my old device is infected, can my new device get viruses from my social media accounts?

Is it okay to log in my social media accounts (Facebook, Instagram, etc.) from my old phone that I believe is infected with viruses to my new phone? Can virus transfer because of that?
Jeszabami's user avatar
4 votes
0 answers
99 views

Android Find My Device Network Privacy

My Android device today popped up a screen indicating that it had joined the new Find My Device Network that allows two-way scanning of device locations over Bluetooth. Despite Google's claims of ...
Robert Chapin's user avatar
1 vote
0 answers
16 views

How to enable USB debugging mode when it has been disabled [migrated]

I have a Samsung Android which I am almost certain has malware/a rootkit on it. I'd like to take a forensic image of the device. In developer mode, the 'USB debugging' mode is shaded in and set to off....
chickenj0's user avatar
1 vote
3 answers
191 views

Can my phone got infected if visit my mail inbox without opening any mail attachments?

I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments. Is this true? If yes, how risky for ordinary mail ...
Sasi Bulan's user avatar
0 votes
0 answers
88 views

How does a pattern or a PIN secure an Android device with encryption?

Modern Android devices have encryption for the storage. It is secured with a key which is derived from the lock screen and a hardware bound key. We know that the rate limiting mechanism prevents brute ...
Michael Tsang's user avatar
0 votes
2 answers
103 views

How to Capture Mobile API Requests in burp when Server side pinning is implemented

I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
Tejas Pandya's user avatar
9 votes
1 answer
4k views

Is it possible to identify a phone model by screenshot stripped of metadata?

I.e., by comparing the dimensions of the screenshot and size / position of UI elements, without the aid of metadata?
tom894's user avatar
  • 199
0 votes
1 answer
203 views

Is malware less prevalent in the Apple App Store compared to the Google Play Store?

I was searching for reports about malware on the Apple App Store and only found minor ones (at least from a user's perspective) on the first few Google search results. Doing the same search for the ...
Martin Thoma's user avatar
  • 3,932
0 votes
0 answers
151 views

MDM & "Work Profile" Implications on Android 14

What are the privacy implications of using an MDM "work profile" on your own Android 14 device? First, an MDM app such as MaaS360 must create the work profile while running in the personal ...
user19087's user avatar
  • 111
1 vote
0 answers
226 views

Android Certificate Revocation Checking

I am hoping I can leverage everyone's knowledge on this one as I am at a lose. I have an Android 10 Device connecting to a containerized web application that is secured by a custom Certificate ...
Elliot's user avatar
  • 11
0 votes
0 answers
140 views

Intercepting Android App: Google detects burp proxy and block the request to app

I was recently doing bug bounty on a website and found it also has an app so i tried to pentest on it using burpsuite via MITM and intercepting it through burp proxy Though my request got blocked by ...
Dang Max 2.0's user avatar
0 votes
0 answers
21 views

How can iplocation.net know my country if I use a VPN thru Opera Mini on Android? [duplicate]

How can iplocation.net know my country if I use a VPN thru Opera Mini on Android? Accessing myip.com it says "no country". But accessing iplocation.net shows my real city and provider! And a ...
VeganEye's user avatar
0 votes
1 answer
95 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
2 votes
1 answer
236 views

Why does SafetyNet target non-rooted custom ROMs?

I understand that a rooted phone exposes its user to security issues, because a malware could do more damage in a rooted environment than in a non-rooted one. But why target up-to-date, non-rooted ...
Evolve's user avatar
  • 25
0 votes
1 answer
326 views

Up to date custom ROM vs outdated official ROM: which is more secure?

Question 1: Which is more secure between an up to date custom ROM and an outdated official ROM ? Question 2: If an up to date custom ROM is more secure, why is Google making it harder to pass ...
Evolve's user avatar
  • 25
4 votes
1 answer
3k views

Note Taking App Hacked?

I am using the note taking app Color Note (www.colornote.com) on my mobile phone that is using Android 7.1.1 to take some notes (old device). I am not using their cloud sync capability, and my email/...
J_A's user avatar
  • 57
3 votes
1 answer
351 views

What can forensic analysts extract from a fully encrypted phone? [closed]

I was very disappointed to hear that my friend, who had his Android phone seized not too long ago, has had his phone broken by police forensics. As far as I know, it was a few years old, Samsung, and ...
Elizabeth Vogue's user avatar
15 votes
2 answers
5k views

Are banking and finance apps safe on an Android phone with cracked apps?

I want to install a few banking apps for my bank accounts. I also have modded or cracked games/applications installed on my phone, but my phone is not rooted. Will adding a banking app increase the ...
Manav Dhakaan's user avatar
2 votes
0 answers
124 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 178
1 vote
0 answers
250 views

Using Android Wireless Hotspot while connected to Hotel internet via VPN

I want to make sure I understand the security implications of this scenario: I am staying in a hotel. I have a VPN on my android phone. I connect to the hotel's unencrypted WiFi network with the ...
stochastic's user avatar
1 vote
0 answers
194 views

Hundreds of bots creating accounts using sign-in with Google

We are getting hundreds of bots creating accounts using sign-in with google, like this in this format: Colin Bush: [email protected] Tambra Lockett: [email protected] Marjorie ...
Zeone line's user avatar
1 vote
0 answers
162 views

Detecting hard to detect stalkerware - a theoretical question

Suppose you have a stalker and this person has access to professional advice. Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with ...
LiamNiam's user avatar
3 votes
1 answer
387 views

Is Android private DNS using domain name a security risk?

Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning? How ...
masterchief164's user avatar
2 votes
1 answer
784 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
Team B.I's user avatar
  • 141
3 votes
0 answers
1k views

I want to track my android phone using IMEI [closed]

My phone was stolen last week. I went to the police to track it but still now no result. What software can I use to track my device just using the IMEI of the phone?
Mu'azu S. Ahmed's user avatar
1 vote
0 answers
225 views

Gmail app on Android can't send messages since months

I've got the issue that the Gmail app on Android (OnePlus One device) is unable to send messages (it stays in Outbox instead of Sent). Once in the past, I've solved this by clearing the Gmail app ...
nusch's user avatar
  • 47
1 vote
2 answers
4k views

Move a user CA cert to a trusted root cert in Android 13

I am using Fiddler, and I have to insert a CA Cert to decrypt the SSL certificate coming out of my device. My device running Android 13 is rooted, and when I installed my cert, it went into the user's ...
Jason Chan's user avatar
1 vote
0 answers
126 views

In Google account, a suspicious Android Galaxy Tab device is persistent to revoking

I have a Galaxy Tab device, but have already signed out from it and reset the tab to factory. However, in my Google account, there is still a device of "Galaxy Tab", added 200+ days ago, in ...
user avatar
1 vote
0 answers
151 views

How to pentest apps running on HarmonyOS

I could not find any checklist for pentesting apps on HarmonyOS. I know HarmonyOS is based on Android, and all Android applications work on HarmonyOS if I use hms instead of gms. So would an Android ...
Firat's user avatar
  • 13
18 votes
2 answers
6k views

How is Xiaomi changing my browser home page?

I have recently observed that the home page of Google Chrome on my Xiaomi Android phone has been altered to a website called "Mintnav". I did not update any software. How is Xiaomi able to ...
samurai jack's user avatar
1 vote
0 answers
128 views

Different types of USB charger attacks that work on Android phones

I'm wondering about different types of malicious USB charger attacks that work on Android devices when USB debugging option is disabled and if the USB option is set to "charge only". I'm not ...
Kurusakibill074's user avatar
0 votes
1 answer
119 views

Detect invalid cert Android client if URL being redirected to a fake server [duplicate]

Here is the scenario: Server A is an authentic server (A.com). Server F is a fake server (F.com) that also has a valid cert for F.com has a copy of A.com certificate to it (to fake as A.com). Client ...
Tung D. Nguyen's user avatar
1 vote
1 answer
856 views

Unexpected certificate authority installation on an android

Last week I received a notification pop-up on my galaxy s10 phone stating a certificate authority has been installed on this device. There was no information as to what authority was installed and ...
Janne Möttölä's user avatar
1 vote
0 answers
262 views

Which is safer - using the sql_conn Flutter package or using a web server as a middle layer for requests against a SQL Server database?

We are currently working on setting up new Android handheld devices (RF guns) to read/write to our SQL Server 2019 database and are at a fork in the road in deciding what to do. Both options below ...
TheMortiestMorty's user avatar
1 vote
1 answer
262 views

Can mobile hardware have backdoor access to camera, microphone that bypasses operating system?

I found out about AOSP variants such as Calyx, Graphene, etc. They promise increased security. I want to know if hardware backdoors can allow access to the camera, microphone, etc. and subsequently ...
Vishal's user avatar
  • 13
1 vote
1 answer
185 views

Malware infection to wifi router from android phone

Suppose a wifi router has strong admin password, updated firmware and no vulnurability then - Is the router safe from malware infection from android phones connected to it? Can malware from an ...
Ajay's user avatar
  • 41
1 vote
0 answers
157 views

Is filling the internal storage of an Android device using `dd` sufficient for data removal?

I have a rooted phone I'm willing to sell, but I had Personally Identifiable Information (PII) on it and I am questioning whether filling the internal storage with null bytes using dd would be ...
user avatar
1 vote
0 answers
21 views

How do end-to-end encryption (E2EE) IM apps implementing push notifications? [duplicate]

Say WhatsApp and Signal on Android devices, how do they keep the E2EE not be broken? Some answers claimed that WhatsApp uses VoIP background mode on iOS to make the push notification invoke the app to ...
Xiangyi Meng's user avatar
1 vote
1 answer
474 views

Vulnerability scanning on target Android device

Is there an nmap vulnerability scanning script (vuln, vulscan, nmap-vulners etc) for scanning target Android devices on the network? If not, is there any specific scanning tool that scans for CVE on ...
Ajay's user avatar
  • 41
26 votes
6 answers
13k views

Spying on a smartphone remotely by the authorities: feasibility and operation

French lawmakers agreed to a justice reform bill that includes a provision granting police the power to remotely activate suspects' geolocation, microphone and camera (source). Following the senators, ...
Yann Rimbaud's user avatar
1 vote
0 answers
104 views

Is Android SOS being used as privilege escalation or settings bypass?

I have been getting random SOS countdowns triggered on my phone. Every time this happens, a pop-up appears telling me that unknown numbers have been temporarily unblocked. The most recent instance was ...
Miles's user avatar
  • 111
2 votes
2 answers
2k views

Steps after accidentally opening malicious URL with Android device

So I opened a malicious URL with my Android phone. It took some 20 seconds to dawn on me after which I put it on airplane mode. I didn't enter any info in the meanwhile. I tried to see if I can assess ...
Manouil's user avatar
  • 23
2 votes
0 answers
155 views

Is a mobile phone number in itself an information that can be utilized by hackers etc? [duplicate]

I recently installed Tinder, and I saw that the app warns about sharing your phone number to avoid being hacked. I also noticed certain obviously fake profiles pressing for getting a phone number or ...
smith's user avatar
  • 121
1 vote
0 answers
213 views

I'm receiving text messages that my family didn't send

Lately I've been receiving text messages from family members that they did not send. All 4 family members and I are a part of the SMS group where we send and receive messages related to our family. ...
MRPA67's user avatar
  • 11
1 vote
0 answers
502 views

Are drive-by downloads and installs a significant threat to an average modern Android or Firefox for Windows user?

Today I learned that drive-by downloads and drive-by installations are or have been a thing. Yet there's something very counterintuitive about them if considered a real threat for modern smartphone or ...
jka's user avatar
  • 113
1 vote
0 answers
233 views

Are Android Bluetooth file transfers encrypted?

Suppose I pair two Android phones together using Bluetooth and transfer a file from the first phone to the second by sharing the file using Bluetooth. Does Android encrypt the file transfer so that no ...
Flux's user avatar
  • 913
1 vote
1 answer
266 views

Is a short password good enough if the phone has the "auto factory reset after 15 lockscreen password errors" feature on?

My Samsung Galaxy phone has a feature named "auto factory reset," by which (according to the blurb in the device's settings) this happens: After 15 incorrect attempts to unlock your phone, ...
Catomic's user avatar
  • 247
0 votes
0 answers
147 views

ISP-restricted VPN on Android

How to connect to VPN service on Android via its app if it's restricted by state ISPs, but you're able to connect via cloud VPS network outside the state My idea is about concepts in general: you ...
agiAWjoa0za's user avatar
1 vote
0 answers
719 views

Cannot aireplay-ng deauth attack Android 11

I was trying to do a deauth attack on Android 11 phone but it didn't work. I am using sudo aireplay-ng --deauth 100000 -a [AP mac_addr] -c [my mac_addr] wlan0 The access point uses wpa2 encryption, ...
Harshvardhan Sinha's user avatar

1
2 3 4 5
28