Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
942
questions
0
votes
0answers
24 views
Mobile phone number spoofing [duplicate]
I received a text message from my son but it came up on my phone as not in my contacts and hence the number was displayed not his name. It was from an iPhone 7 fully up to date iOS and not with any ...
0
votes
1answer
130 views
Is the Android screen lock good enough to prevent access to an Android 8 device?
I have Android 8 mobile phone and I need to give it for mobile repair center for battery replacement. There is chip car, but there are lot of data in my phone.
What I want to know is it enough having ...
0
votes
1answer
59 views
Can sending a hidden Text/SMS messages be considered a security issue?
tl;dr: My Toyota Aygo sends Text/SMS messages through Bluetooth and my mobile phone. These messages are delivered to the recipient, but there is no sign of them in my Messages app.
Should I be ...
-1
votes
0answers
37 views
Risk of compromising a social media account by using it to log in to a mobile app? [duplicate]
A practice that I'm seeing that's unfortunately common in mobile apps is to require a social media or otherwise widely used account type for login. Often there is no other option.
For example, I see ...
0
votes
0answers
47 views
What is the recommended way to generate API tokens using Laravel framework?
I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
0
votes
0answers
8 views
Prevent unsolicited/malicious app install on Android [migrated]
Recently I noticed I have opera browser installed. I definitely did not install it because I was sleeping at that time. I checked installation time and revealed it was the day before yesterday
...
1
vote
0answers
51 views
Does a mobile VPN provide anonymity when using apps?
When employing a system-wide VPN on a smartphone, I understand that all web traffic is routed through that VPN. Browsing to a webpage in incognito mode would provide some degree of anonymity, but I'm ...
1
vote
1answer
115 views
When you use a cellular connection how is your internet connection encrypted
When you use a cellular connection how is your internet connection encrypted?
Usually there is some sort of key like with WIFI the wifi password is the key used to encrypt data?
How does encryption ...
2
votes
1answer
164 views
What is the most unique data identifier for a phone user that cannot be repeated?
I'm currently developing an Android (and probably iOS in the future) application for my company.
I was wondering what is the most unique data identifier to authenticate the users. A data that cannot ...
1
vote
0answers
64 views
How I rescue my Android from a trojan and how did I get it? [closed]
I received a message with the famous link My-love co via Whatsapp and I never clicked on the link; I blocked the contact and deleted the message containing it; such a link was reported as infected by ...
3
votes
1answer
123 views
Do mobile apps have their own certificate store?
When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or ...
0
votes
0answers
18 views
Sniffing Traffic Android App [duplicate]
So, imagine that a vulnerable app provides a login interface. This login sends the user's credentials to the App's server to authenticate the user. However this is done via HTTP, therefore not secure. ...
2
votes
1answer
95 views
Encrypting session cookies on an Android device
One of our clients has an issue with a government security audit on one of their mobile applications.
The finding states that the application stores session cookies on the device in clear text format ...
0
votes
0answers
50 views
What are the risks of buying used gadgets?
Thinking of buying a used iPhone and MacBook. Probably an iPhone 7/8/X and MBP 2015. As a security conscious (many would say overly paranoid) person I'm considering the risks. I'm quite sure I'm not ...
6
votes
1answer
391 views
esim vs sim card, what is more secure?
I can read many different attack vectors like swapping and porting but not sure if all those attacks are relevant about eSIM, can you please explain what are a security risk and attack vectors that ...
-1
votes
1answer
97 views
Why Am I Seeing Adverts When Using Mobile Data?
I was looking at an https page on my phone within the house via my home wifi network.
I turned off wifi and switched to mobile data and when I refreshed the page, suddenly there were adverts on the ...
0
votes
0answers
68 views
Spying apps: Android mic and camera access
Can android lollipop 5.1.1 apps which have permission to access mic and camera access them when the app is not running?
I woke up to the news by the NYT that a popular app I had previously downloaded ...
10
votes
1answer
203 views
Where are fingerprints stored on an Android phone?
Many recent phones come with a fingerprint scanner. I use them rarely but I'm curious how do hardware and software protect user's fingerprint data from being stolen.
Does a fingerprint scanner come ...
34
votes
9answers
9k views
Security implication if android app can be installed on emulator
I am working on ensuring security of my company's product. We have a mobile version of the product. This question is for the Android version
Background -
Our product is a SaaS-based product and the ...
12
votes
1answer
420 views
Canadian police mentioned a new line-trapping technique, but what is that?
The police in Canada are saying that there is a new technique ("line-trapping") where the scammers told a lady to call the police to confirm some fraudulent details, but when she hung up and called ...
4
votes
2answers
894 views
Can someone hack my phone by sending me a file (e.g. PDF) via Whatsapp?
My work requires (and depends on) Whatsapp for daily sharing of files with many people (PDF, PowerPoint, Word, Images, Web links...), and I was wondering if it is possible that someone can hack our ...
3
votes
1answer
68 views
How exactly do mobile apps achieve authorization code flow with PKCE?
Let's imagine the following:
I've developed a mobile app using Xamarin (iOS/Android compatible)
I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
0
votes
0answers
48 views
Are there LTE attacks besides aLTEr?
Background: I understand that most attacks on cell network-subscribed individuals rely on exploiting the poor authentication of GSM/2G comms. And if the victim is on LTE, then the next best strategy ...
2
votes
1answer
71 views
Does re-authenticating to apps on an unlocked phone really make an app more secure?
Several apps on my iPhone X including LastPass, and iCloud passwords prompt me for my Face ID before allowing me to use them. I guess the idea is that someone could accidentally take my unlocked phone ...
0
votes
0answers
64 views
How does an IMSI catcher “impersonate” a base station/cell tower?
On reading about IMSI catchers, I keep seeing that they "impersonate" a real cell tower or "base station" so that the phone drops its signal-carried data on that machine while on its way to the ...
0
votes
0answers
33 views
Is it a good practice to implement admin pages in a mobile application?
So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in.
And it's implemented on the mobile application, with checks in ...
0
votes
0answers
48 views
Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection
I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device.
I followed the setup instructions available here: https://security.secure.force.com/...
2
votes
1answer
107 views
Cordova's APP_SECRET discovered in config.xml file
What is the security implication of the APP_SECRET being discovered in a Cordova Mobile app? Steps on how to get the APP_SECRET is described here but there appears to be no clear guidance on what the ...
2
votes
1answer
358 views
How does Whatsapp store encryption keys on the phone?
It looks like Whatsapp stores encryption keys on the phone side, but I wonder if there are any details on how they do it? Do they use Android Keystore / Secure Enclave? Or something else?
The main ...
4
votes
2answers
74 views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
2
votes
0answers
88 views
Is what fingerprint scanners in mobiles store a stealable value?
If a fingerprint scanner were a human it would probably be like this:
take a photo of the finger presented for authentication
check it against the original photo to determine if it's the same.
This ...
0
votes
1answer
55 views
A recieved text message that was never sent on iPhone [duplicate]
My girlfriend asked me why I texted her at 2:30 am. But I went to bed at 2am and that message was not recorded on my phone. She had an iPhone and I have a Samsung Galaxy S9. She sent me a picture of ...
0
votes
1answer
154 views
strange text sent from my phone to a friend [duplicate]
A friend received a text from my phone which actually used my husbands name in the text. It was not from me and does not show up in my text message thread. The text does not include a link or any ...
2
votes
0answers
61 views
Effective ways to hide your IP address and Device Information from apps on Mobile? [closed]
How can you make sure site admins are not able to get information like your IP, Browser, Device, etc?
0
votes
0answers
51 views
Mobile Code Scanning
I know that MobSF is generally well recommended as the OSS solution for code scanning of mobile devices.
To my knowledge though, it only performs dynamic analysis of android applications (and you ...
0
votes
0answers
29 views
Activity (Logging Screen, and recovery password) are vulnerable to using by others applications?
I have an application, and I ran the Drozer Framework, It show me some Activities that has not permission, Is the activity of my Login and recover password, So If I run the activity in external ...
0
votes
2answers
84 views
Does Using VPN on a Dubious Custom Mobile ROM Reduce the Risk to the Network?
I have flashed an old Samsung phone with a custom ROM. The OS (and all the needed software) come from a website that "should" be safe, from users that "should" be trustworthy. Still, I like to be a ...
0
votes
1answer
74 views
Concept needed: user specific encryption on server
In a typical mobile project, a user can register and login into an app, and the app communicates with a server.
For simplicity, consider an app where the user can register/login using the OAuth2 ...
2
votes
1answer
163 views
How to stop my phone from secretly recording me? [duplicate]
I unplug my microphone from my computer when I am not using it. The same with my webcam. I am not using Alexa or similar.
However, my smartphone has an included battery that I cannot take out.
My ...
1
vote
0answers
116 views
2
votes
1answer
148 views
OAuth Authorization Flow without external user agent for iOS application
We are developing an iOS application and server where a user will be able to store some personal information and top up money.
I have been reading about the OAuth Authorization flow using PKCE and ...
0
votes
1answer
77 views
What are the suggested way to protect content in mobile app
I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header ...
2
votes
1answer
113 views
Encryption on Mobile Devices - Multiparty Encryption - Key Management
I have the following setting:
Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
3
votes
0answers
142 views
Do modern operating systems still send targeted or directed Wi-Fi probe requests that contain SSIDs?
Do modern (versions of) operating systems, primarily Android and iOS on mobile, still send targeted or directed probe requests when searching for Wi-Fi networks to connect to?
Such targeted or ...
1
vote
0answers
128 views
Stop smartphone microphone from listening in background [duplicate]
Recently it has come to light that tech companies such as Facebook and Microsoft use humans to listen and transcribe audio conversations on Facebook messenger and Skype to improve their AI. However ...
0
votes
1answer
89 views
Viewing URLs on Mobile Devices
What are you doing to help your users view URLs in emails on mobile devices? Our training program is helping people to understand how to view URLs before clicking the actual link. On mobile devices ...
1
vote
1answer
99 views
Is OAuth2.0 really secure for a mobile application?
I have been doing some research about using OAuth2.0 on our mobile application, but I'm really having trouble deciding whether OAuth2.0 really is the best choice.
Since we are not interacting with ...
2
votes
0answers
65 views
Can this possibly infected SMS have been delivered with a cell-site simulator?
Very recently, I had received a message containing this text:
#E(£ΘULÆ;iFΩ¥bi:iFΩké¤V7ud£Φ
M:ed9+FÅH9edYK6,ΘΔbr£1wÄ:mJi
£ΦùÅΣMè£$¤Z9 B#ΨMÑ0tJ_¥ΦL2
Φ9#WLÆ7eh£Ç6IX2sf£9Ψ6
DΩ¥B....
0
votes
2answers
153 views
CSRF on inter-app communication iOS
How can I make a request from one app to another on iOS and verify the origin of the app request?
Apple used to have an applicationSource sent along with deeplinks, but it's now being deprecated. ...
0
votes
0answers
79 views
How do I create a secure authentication service which works both for web apps and mobile apps?
As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app.
...
