Questions tagged [android]
Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.
148
questions
64
votes
4
answers
22k
views
Why do mobile devices force user to type password after reboot?
Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an ...
- 779
8
votes
1
answer
4k
views
Connection between PIN/password and encryption keys in Android
I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm ...
- 191
24
votes
2
answers
8k
views
How do anti-virus apps for Android work?
There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
- 47.3k
24
votes
4
answers
24k
views
Verifying android application integrity from server side
I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
- 3,417
91
votes
2
answers
132k
views
What is the difference between serial number and thumbprint?
I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash.
The MSDN says:
Serial number A number that uniquely identifies the ...
- 1,062
31
votes
2
answers
191k
views
Can Android phone running without SIM card be tracked (localized) by police?
I am running an Android phone without a SIM card. I am using it for web surfing.
Can the police localize my phone using the cell towers (BTS)?
In other words, I know Android phones emit radiations ...
- 413
15
votes
1
answer
8k
views
Secure way to hold private keys in the Android app
What would be the most appropriate way to store private keys for barcode signing in the Android app?
Probably most experts here would say - just don't do it, cause it's insecure...
But I would like to ...
- 259
11
votes
3
answers
80k
views
How to determine if it is safe to install apk files from alternative android app stores?
Several sites offer APK downloads (1, 2, 3). Is there a way to determine if a given website/apk is safe to install?
- 805
536
votes
18
answers
118k
views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
- 2,751
34
votes
3
answers
3k
views
Security implications of rooting Android
My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
- 39.5k
23
votes
7
answers
66k
views
How do you capture ALL the traffic from an Android app?
I want to capture all the traffic from an Android app for its pen-testing. How do I do that?
Here's what I've already tried:
I installed the app on an emulator and started the emulator with a http-...
- 507
20
votes
4
answers
16k
views
Is Android's Password Screen Lock Enough Data Theft Protection?
With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply by-...
- 2,978
15
votes
2
answers
16k
views
How can I prevent a man-in-the-middle (MITM) attack on my Android app API?
I checked out the app Packet Capture.
This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root.
How can I ...
- 253
7
votes
3
answers
12k
views
Can someone detect the URL an android app uses?
I have an android app that makes HTTPS connection to specific URL. Is there a way to keep this URL secret?
I know that the IP address and the port number of that connection can be detected, but what ...
- 173
88
votes
3
answers
18k
views
Google account verification request
Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used).
I double checked it was the ...
- 1,939
86
votes
3
answers
15k
views
Can phone apps read my clipboard?
Via Hacker News, I came across a Tweet implying that Facebook's iOS app routinely reads and transmits all content from the user's pasteboard.
Leaving aside whether Facebook's app genuinely does this (...
- 1,827
78
votes
7
answers
91k
views
Are there actually any advantages to Android full-disk encryption?
So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
- 9,351
57
votes
2
answers
15k
views
How exactly does the Stagefright Vulnerability work on Android?
Digital Trends describes the Stagefright Vulnerability thus:
The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
- 1,595
42
votes
7
answers
6k
views
Best practices for securing an android device
Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
- 16.2k
35
votes
4
answers
11k
views
How do I verify HTTPS connections in Mobile apps?
There are a lot of mobile apps nowadays with payment gateways support.
However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection.
...
- 453
31
votes
5
answers
76k
views
How do location-based apps avoid getting cheated by emulated GPS?
Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits.
Given that emulated GPS are available for customized versions of Android, it sounds easy ...
- 1,286
19
votes
4
answers
11k
views
Securely erasing personal data from Android phone before selling
I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files.
What should I do?
user69377
17
votes
5
answers
3k
views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
- 100k
16
votes
4
answers
5k
views
What risk does Carrier IQ pose, exactly?
There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out.
My questions: What exactly does Carrier ...
- 100k
12
votes
1
answer
4k
views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
- 51k
10
votes
7
answers
37k
views
How safe/secure are banking applications on Android phones?
I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc.
How safe or unsafe is this application? For ...
- 755
7
votes
1
answer
39k
views
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Previously I have been able to bypass SSL Pinning by using the program JustTrustMe with the Xposed framework for nearly every app.
https://github.com/Fuzion24/JustTrustMe
However it has started to ...
- 797
4
votes
1
answer
15k
views
msfvenom payload problem
This is for educational purposes only!
I'm trying to generate android payload using msfconsole payload standalone generator: msfvenom with the command:
msfvenom -p android/shell/reverse_tcp LHOST=...
- 2,515
2
votes
2
answers
2k
views
Can an android phone that is flashed to a trusted safe rom still be malicious?
I'm in the market for a new phone. The cheapest ones with decent specs are from China. Unfortunately I've read articles of phones sending data back to China for spying purposes.
The phone I am looking ...
- 225
52
votes
6
answers
12k
views
Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?
Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk.
It was for 3 seconds and I was in control of the MacBook the whole time.
- 701
32
votes
1
answer
6k
views
How does a refresh token help? [duplicate]
I have a basic doubt or apparently am missing out on something fundamental.
When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
- 1,522
26
votes
2
answers
5k
views
Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?
Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
user163495
21
votes
6
answers
61k
views
How do I know if Google keyboard input is safe for use?
I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out:
ATTENTION
This input method may be ...
- 5,330
21
votes
2
answers
5k
views
How can I escape Google?
I am unsure how to formulate this question, so please feel free to edit it.
I considered asking on https://android.stackexchange.com/ but feel that this is more security related and more likely to ...
- 1,410
21
votes
3
answers
41k
views
How can I tell if a PDF file I was sent contains malware?
I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How ...
- 313
16
votes
2
answers
10k
views
Android L encryption vs. iOS 8 encryption
Recently, the new full-disk encryption system of Apple's iOS 8 operating system has been in the news. And soon after Apple's release, Google announced that they will also enable encryption by default ...
- 339
16
votes
4
answers
7k
views
How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?
I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
- 263
16
votes
8
answers
18k
views
Keyloggers on Smartphones?
I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...
- 169
15
votes
3
answers
5k
views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
- 1,102
12
votes
2
answers
34k
views
How can I detect which background application is using the camera, microphone or GPRS?
I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
- 156
12
votes
2
answers
292
views
Does Centralisation Decrease the Probability but Increase the Damage of Exploits?
This question is, perhaps, a tad too abstract for a Q&A site. But it's been playing on my mind for a while, so I'm throwing it out there.
Modern systems seem to be increasingly centralised. An ...
- 463
12
votes
2
answers
383
views
Is there always a user notification when smartphones record audio?
Background: With microphones being embedded in all sorts of consumer electronics, there is widespread concern that certain actors (e.g. device manufacturers, ecosystem providers, third-party apps) ...
- 151
10
votes
3
answers
19k
views
Android/iOS application security testing checklist
According to OWASP, we have a list of top ten mobile application vulnerabilities.
But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
- 2,097
9
votes
4
answers
9k
views
Any useful tools for Android source code review? [closed]
I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS.
Fortify seems ...
- 757
9
votes
2
answers
635
views
How much can I trust the "factory restore/reset" on a(n) (potentially compromised) android?
This question is a simple one: how much can you trust the "factory restore/reset" option on an android device?
If the device has possibly been compromised, is it possible the "factory reset" will ...
- 201
8
votes
1
answer
11k
views
Android Keychain: what is a system wide credential?
Android documentation about keystore system has a sub-section Choose between a keychain or the Android keystore provider, it says we should use the KeyChain API when we want system-wide credentials. ...
- 710
8
votes
1
answer
2k
views
Can I find out what encryption is used by my Android Bluetooth keyboard?
I've got an Android tablet (Samsung Tab S2) and a Bluetooth keyboard (Celicious Tri BK01). I occasionally use the keyboard to enter my password.
Is there any way, in Android, to find out whether the ...
- 2,317
8
votes
4
answers
19k
views
Can visiting a malicious website infect an iOS or Android device?
Can visiting a malicious website infect an iOS or Android device?
We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps.
- 429
7
votes
3
answers
7k
views
What is this Russian calendar reminder that popped up?
I woke up this morning and saw a calendar reminder that I definitely did not put there, written in Russian. It would be super helpful if anyone knows what the text means, but I figured opening the ...
- 191
6
votes
2
answers
14k
views
How secure is full-disk encryption technology on LineageOS, or Android phones in general?
We're attempting to assess the information security on our mobile devices, and information seems rather varied on the question of encryption. Is the encryption technology employed by Android-based ...
- 63