Questions tagged [android]

Questions tagged [Android] should focus on security of the operating system itself, or of Android-specific apps. Questions about Android that are not directly security-related should be asked at android.stackexchange.com.

Filter by
Sorted by
Tagged with
532
votes
18answers
114k views

Police forcing me to install Jingwang spyware app, how to minimize impact?

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it. Knowing that I may be ...
88
votes
3answers
17k views

Google account verification request

Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used). I double checked it was the ...
85
votes
2answers
106k views

What is the difference between serial number and thumbprint?

I have problems to understand what is the difference between the serial number of a certificate and its SHA1 hash. The MSDN says: Serial number A number that uniquely identifies the ...
83
votes
3answers
14k views

Can phone apps read my clipboard?

Via Hacker News, I came across a Tweet implying that Facebook's iOS app routinely reads and transmits all content from the user's pasteboard. Leaving aside whether Facebook's app genuinely does this (...
76
votes
7answers
90k views

Are there actually any advantages to Android full-disk encryption?

So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
67
votes
8answers
15k views

Can a stolen Android phone with USB debugging enabled have screen lock bypassed?

My Android (8.0) phone was pickpocketed from me yesterday. It was immediately turned off by the thief and when I tried to locate it using Find My Device it shows as offline. As a programmer and a ...
64
votes
4answers
6k views

How can common users defend against the StageFright vulnerability?

I was just informed of the StageFright vulnerability in Android devices. A specially crafted MMS message can gain access to data on the phone; so presumably it's a buffer overflow with subsequent ...
63
votes
6answers
10k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
63
votes
3answers
5k views

Are staggered roll outs of security patches bad?

Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often ...
62
votes
4answers
18k views

Why do mobile devices force user to type password after reboot?

Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an ...
57
votes
3answers
9k views

My Android phone is vulnerable, but there are no updates?

I bought brand new HTC Desire 526G with operating system 4.4.2 (Kitkat), everything is as it should be (not rooted) so it is still on factory settings. But now I didn't get for a long time any ...
57
votes
2answers
14k views

How exactly does the Stagefright Vulnerability work on Android?

Digital Trends describes the Stagefright Vulnerability thus: The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming ...
52
votes
6answers
12k views

Am I at risk if I let someone charge their Android phone from my MacBook through a micro USB cable?

Someone connected their Android phone to my MacBook and it made me think if this has put my MacBook at risk. It was for 3 seconds and I was in control of the MacBook the whole time.
50
votes
5answers
9k views

Downsides of showing email address on Android lock screen

My stock Android 9.0 gives me the option of showing some short text message on the lock screen. I want to add my email address here, so people know how to contact me if they find my phone. Are there ...
44
votes
3answers
16k views

How can Android encryption be so fast?

Android uses full-disk encryption to encrypt files and decrypt them at startup. What I don't understand is that decrypting multiple gigabytes of files must take a lot of time, if nothing else then ...
44
votes
1answer
4k views

Why is Firewire a bigger threat than USB?

This question notes that a person briefly connected an Android device to an Apple computer via USB, and one comment indicates that it would "quite possibly" be a risk: In theory, yes, in practice, ...
43
votes
4answers
4k views

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...
41
votes
7answers
5k views

Best practices for securing an android device

Does anyone have any suggestions on securing an Android device? I'm not particularly interested in enterprise level software - I'm looking to secure my own ZTE Blade phone which has a lot of personal ...
39
votes
4answers
48k views

Microsoft email servers "require remote control of Android device security features"

Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (...
35
votes
4answers
9k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
34
votes
9answers
10k views

Security implication if android app can be installed on emulator

I am working on ensuring security of my company's product. We have a mobile version of the product. This question is for the Android version Background - Our product is a SaaS-based product and the ...
34
votes
3answers
3k views

Security implications of rooting Android

My Android smart phone has fancy features that I can get only if I root it, e.g., free-wifi tethering or Cisco VPN (with group name/password). However, the procedure to root my phone makes me ...
32
votes
1answer
6k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
31
votes
2answers
180k views

Can Android phone running without SIM card be tracked (localized) by police?

I am running an Android phone without a SIM card. I am using it for web surfing. Can the police localize my phone using the cell towers (BTS)? In other words, I know Android phones emit radiations ...
30
votes
4answers
27k views

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
30
votes
3answers
1k views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
29
votes
5answers
73k views

How do location-based apps avoid getting cheated by emulated GPS?

Some apps like Foursquare require the user to "check in" at physical places, in order to gain money benefits. Given that emulated GPS are available for customized versions of Android, it sounds easy ...
28
votes
2answers
6k views

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android. On OS X: to enable encryption current user must have a password protected account. After enabling the ...
27
votes
3answers
5k views

Why do a lot of Android apps (like Linkedin) require many unrelated privileges?

I wanted to install the Linkedin app on my Android phone and I was shocked when it asked for nearly all possible permissions including reading all of my private data and calendar data. Why does any ...
23
votes
3answers
20k views

Bank complains about rooted Android. Is it really any worse than a Windows desktop?

When I use my bank's Android application, the app notices that my phone is rooted and puts up a message with a big red "danger" symbol and a message saying "vulnerable device." I totally understand ...
23
votes
2answers
8k views

How do anti-virus apps for Android work?

There seems to be a lot of anti-virus apps for Android. On a desktop or server an anti-virus must run with super-user privileges, however I am pretty sure these mobile anti-viruses are running as an ...
22
votes
5answers
47k views

Memory dumping Android

I need to evaluate the security of a cryptographic library. In particular I am targeting a part of the library where I believe the private key is exposed for a limited time in the RAM. Any ideas or ...
21
votes
4answers
21k views

Verifying android application integrity from server side

I have android applications (Mobile banking) that connect to my server and do online transactions (via Internet/USSD/SMS), I want to make sure those clients are not tampered with and are the original ...
21
votes
2answers
3k views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Between version 4.4 and 9, Android supported Full-Disk Encryption (FDE). On Android 7, a new system called File-Based Encryption (FBE) was introduced, and was subsequently made mandatory on Android 10....
20
votes
3answers
38k views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
20
votes
3answers
34k views

How can I tell if a PDF file I was sent contains malware?

I was emailed a PDF file by a family member. I have reason to suspect that it was given to said family member by someone who would like nothing more than to infect me with a Remote Access Trojan. How ...
20
votes
1answer
436 views

What was the original intent for the feature that StrandHogg uses?

The "Affinity" of Android tasks seems really complex to handle. The StrandHogg vulnerability uses tricks with "Affinity" to render itself inside an another app. The information that I've found this ...
20
votes
1answer
8k views

How to crack (get secret from) Android Keystore System

I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to ...
19
votes
4answers
14k views

Is Android's Password Screen Lock Enough Data Theft Protection?

With the exception of the SD card data, is Android's built-in password/pin/pattern screen lock enough to protect data stored in your phone's internal storage in case of theft? Or can a thief simply by-...
19
votes
2answers
4k views

How can I escape Google?

I am unsure how to formulate this question, so please feel free to edit it. I considered asking on https://android.stackexchange.com/ but feel that this is more security related and more likely to ...
19
votes
6answers
57k views

How do I know if Google keyboard input is safe for use?

I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out: ATTENTION This input method may be ...
19
votes
3answers
18k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
18
votes
4answers
9k views

Securely erasing personal data from Android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
17
votes
2answers
3k views

Does biometric authentication in Android transfer any biometric data to the app?

On my Android phone I use several apps that propose biometric authentication. If I enable it, can these applications read my fingerprint data and transfer it to the third party servers?
17
votes
5answers
3k views

Android API/development security pitfalls

What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
17
votes
7answers
58k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a http-...
16
votes
4answers
5k views

What risk does Carrier IQ pose, exactly?

There has been a lot of discussion about Carrier IQ, monitoring software that is pre-installed on many Android phones. Many allegations have been thrown out. My questions: What exactly does Carrier ...
16
votes
5answers
7k views

How can buffer overflows be harmful in Android?

How can buffer overflows be potentially dangerous in Android? Specifically, if each app has its own user id and it being run in Dalvik VM copy that has the same id. I thought that even if the ...
16
votes
3answers
6k views

Does disabling WiFi and mobile data make my phone impossible to hack online?

As I understand, a relatively outdated phone (Android 5, not updated for a few years) could be easily compromised by using security exploits through WiFi, mobile data, NFC or Bluetooth. I'm about to ...
16
votes
8answers
17k views

Keyloggers on Smartphones?

I need to clarify my question. I'm wondering if there are any apps for smartphone that can log each 'keystroke' (i.e. key pressed on touchscreen) that a user does. Performing a google search brings up ...

1
2 3 4 5
26