Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
0 votes
1 answer
98 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
0 votes
0 answers
5 views

Screen Recording permission in Android 9.0 goes away when force stopping app [migrated]

When I use third party app for screen recording 1st time I have to give screen recording permission. Then I don't have to give that permission. 2nd 3rd times .... It can record. I don't find any ...
0 votes
0 answers
9 views

Difference between "picture in picture" and "draw over other apps" in android. And their security vulnerability [migrated]

What are the security vulnerability of these two permissions? Is it possible that I'm typing something in chat heads of a fb messenger and other third app with "display over other app" ...
2 votes
2 answers
1k views

Android Root Certificate Issue

I'm trying to intercept requests using OWASP ZAP proxy and Burp Suite. My current configuration is my android phone (One Plus 5 Android Oreo 8.1) has installed both certificate from ZAP and Burp. But ...
2 votes
1 answer
135 views

Is it possibile to capture unlock pin of smartphone(android/ios) using usb cable?

For example, bad USB cable( charging devices) loaded with script to record the unlock code of an android phone which is current being charged. so basically, the bad usb cable and the usb charger is ...
0 votes
1 answer
283 views

Secure chat application with multiple users on one device?

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application. My thought was to store a private key in ...
4 votes
2 answers
2k views

If my old device is infected, can my new device get viruses from my social media accounts?

Is it okay to log in my social media accounts (Facebook, Instagram, etc.) from my old phone that I believe is infected with viruses to my new phone? Can virus transfer because of that?
5 votes
0 answers
108 views

Android Find My Device Network Privacy

My Android device today popped up a screen indicating that it had joined the new Find My Device Network that allows two-way scanning of device locations over Bluetooth. Despite Google's claims of ...
0 votes
1 answer
16k views

Can my android phone get hacked if I share my hotspot?

I lent my mobile data to someone's computer and was not in the room while they were using it. Suppose they wanted to gain control/access to my android device. How easy would it be? As far as I know, ...
1 vote
0 answers
16 views

How to enable USB debugging mode when it has been disabled [migrated]

I have a Samsung Android which I am almost certain has malware/a rootkit on it. I'd like to take a forensic image of the device. In developer mode, the 'USB debugging' mode is shaded in and set to off....
1 vote
3 answers
193 views

Can my phone got infected if visit my mail inbox without opening any mail attachments?

I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments. Is this true? If yes, how risky for ordinary mail ...
6 votes
1 answer
338 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
1 vote
3 answers
547 views

Securing Android Application API access

While creating an Android App that uses an API, the most difficult problem to solve is API security. Creating a token and securing it in KeyStores is one thing. But what about a guest user? A guest ...
0 votes
1 answer
990 views

Automatic connection to unknown WiFi-network (without user consent)

During a trip, I crossed one city. While crossing one area, I noticed that my phone was connected to an unknown WiFi access point: I have never been in that place in my life, and have never connected ...
1 vote
1 answer
1k views

Hiding metasploit APK after first launch

How can I hide metasploit APK after first launch? I know there is a command for it in meterpreter but I want it to hide itself when it is first launched. Before adding hide_app_icon command to ...
0 votes
1 answer
1k views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
0 votes
2 answers
605 views

How are USSD messages used and who could send them?

Some illegal ads started showing up on my Android phone as message boxes recently. They are said to be "USSD messages" in an app recording notifications (com.evanhe.nhfree). There is a Wikipedia ...
0 votes
2 answers
103 views

How to Capture Mobile API Requests in burp when Server side pinning is implemented

I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
1 vote
1 answer
343 views

What is the most secure internet access option for Android phones?

My goal is to make one of my android phones as secure as possible, hence the question: What is the most secure way for an Android phone to gain internet access? Options I (think I) have: The phone ...
7 votes
0 answers
690 views

Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs? [closed]

Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to? Such targeted or ...
2 votes
2 answers
460 views

Suspicious "ChromeSync" pop-up in Android requesting credentials

Since late May, I have been getting suspicious pop-up messages overlay on top of android Apps (see screenshots), requesting entering of the "ChromeSync Passphrase" for my google account. I ...
0 votes
1 answer
210 views

Is malware less prevalent in the Apple App Store compared to the Google Play Store?

I was searching for reports about malware on the Apple App Store and only found minor ones (at least from a user's perspective) on the first few Google search results. Doing the same search for the ...
1 vote
1 answer
772 views

How to set autorunscript of core commands?

I'm trying to automate scripts of an Android Metasploit payload. I can successfully automate any script on the /post module, however, I'm trying to automate geolocate, dump_calllog and others that are ...
9 votes
1 answer
2k views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
2 votes
1 answer
174 views

urbanairship basic Authorization found in Mobile Application Outgoing Traffic

I was testing an android application using Burp suite. When I opened the android application, an app "Outgoing Traffic" log was added in Burp suite Site map. The API request is: PUT /api/...
2 votes
1 answer
411 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
0 votes
1 answer
173 views

How does Android/Firefox authenticate the Android Pocket app, for example?

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
2 votes
1 answer
211 views

Is it possible to move image files from a text thread on a phone to a virtual box without downloading them?

I'm looking into a spam bot that's been sending me messages on my phone (Samsung s10). It's sent a couple images that I want to try and scrape for metadata and do a reverse image search on. Since the ...
6 votes
3 answers
452 views

Is it safe to connect a random USB battery from a bin to my phone without stopping data transfer in some way?

I've asked the question Power-only USB connection to charge my phone - as simple as cutting the data lines? in electronics SE. In order to bypass the "Why do you want to do this?" request ...
3 votes
1 answer
5k views

Security risks with setDomStorageEnabled(true) in Android?

What are the security risks associated with enabling setDomStorageEnabled(true) method? Reference.
0 votes
0 answers
89 views

How does a pattern or a PIN secure an Android device with encryption?

Modern Android devices have encryption for the storage. It is secured with a key which is derived from the lock screen and a hardware bound key. We know that the rate limiting mechanism prevents brute ...
1 vote
1 answer
260 views

Multiple SMS activation codes received by error

For several days now I am receiving activation codes by SMS that look like this: Your ToYou verification code is 8058 Some are from ToYou, that seems to be a delivery service, others are from similar ...
9 votes
1 answer
4k views

Is it possible to identify a phone model by screenshot stripped of metadata?

I.e., by comparing the dimensions of the screenshot and size / position of UI elements, without the aid of metadata?
1 vote
1 answer
894 views

Unexpected certificate authority installation on an android

Last week I received a notification pop-up on my galaxy s10 phone stating a certificate authority has been installed on this device. There was no information as to what authority was installed and ...
5 votes
0 answers
721 views

What is google recommendation to fix the task hijacking issue

Applications running on android devices below 10 are vulnerable to task hijacking. Even though the issue is fixed from android 11 and above, we cannot tell our customers to upgrade the android version ...
2 votes
1 answer
1k views

How do you get Geolocation information from the CellID field in the herrevad database from Google Mobile Services?

There's a database called herrevad, that can be found in /data/data/com.google.android.gms/databases. This database contains timestamped entries about (some of the) app activity of the phone. The ...
2 votes
1 answer
532 views

Is sending an object created via intent.getSerializableExtra to handler.postDelayed leading to Code Execution?

I'm new to android pentesting and I would like to know : if sending an object created via the result of intent.getSerializableExtra("EXTRA_TEST"); to handler.postDelayed(TheObject,500) could lead ...
0 votes
0 answers
152 views

MDM & "Work Profile" Implications on Android 14

What are the privacy implications of using an MDM "work profile" on your own Android 14 device? First, an MDM app such as MaaS360 must create the work profile while running in the personal ...
13 votes
5 answers
7k views

Are Web Views in android secure?

"Web Views" are views that display some online content, usually a webpage within an android app. Implemented "Web Views" usually don't seem to have any kind of status bar or an address bar to confirm ...
1 vote
2 answers
4k views

Move a user CA cert to a trusted root cert in Android 13

I am using Fiddler, and I have to insert a CA Cert to decrypt the SSL certificate coming out of my device. My device running Android 13 is rooted, and when I installed my cert, it went into the user's ...
1 vote
0 answers
236 views

Android Certificate Revocation Checking

I am hoping I can leverage everyone's knowledge on this one as I am at a lose. I have an Android 10 Device connecting to a containerized web application that is secured by a custom Certificate ...
0 votes
0 answers
140 views

Intercepting Android App: Google detects burp proxy and block the request to app

I was recently doing bug bounty on a website and found it also has an app so i tried to pentest on it using burpsuite via MITM and intercepting it through burp proxy Though my request got blocked by ...
0 votes
1 answer
3k views

How to globally limit Bluetooth functionality on Android and iPhone

I recently got my parents a Bluetooth speaker, and they are very new to the smartphone arena. What I would like is to disable all of the Bluetooth functionality in their phones except for the ability ...
0 votes
0 answers
21 views

How can iplocation.net know my country if I use a VPN thru Opera Mini on Android? [duplicate]

How can iplocation.net know my country if I use a VPN thru Opera Mini on Android? Accessing myip.com it says "no country". But accessing iplocation.net shows my real city and provider! And a ...
2 votes
1 answer
243 views

Why does SafetyNet target non-rooted custom ROMs?

I understand that a rooted phone exposes its user to security issues, because a malware could do more damage in a rooted environment than in a non-rooted one. But why target up-to-date, non-rooted ...
8 votes
1 answer
3k views

Connection between PIN/password and encryption keys in Android

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
0 votes
1 answer
339 views

Up to date custom ROM vs outdated official ROM: which is more secure?

Question 1: Which is more secure between an up to date custom ROM and an outdated official ROM ? Question 2: If an up to date custom ROM is more secure, why is Google making it harder to pass ...
4 votes
1 answer
3k views

Note Taking App Hacked?

I am using the note taking app Color Note (www.colornote.com) on my mobile phone that is using Android 7.1.1 to take some notes (old device). I am not using their cloud sync capability, and my email/...
1 vote
2 answers
4k views

Using Android private DNS with VPN

Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS - sadly over HTTPS atm only works for specific DNS providers). What I am trying to establish is: ...
15 votes
2 answers
5k views

Are banking and finance apps safe on an Android phone with cracked apps?

I want to install a few banking apps for my bank accounts. I also have modded or cracked games/applications installed on my phone, but my phone is not rooted. Will adding a banking app increase the ...

1
2 3 4 5
28