Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category.

learn more… | top users | synonyms

2
votes
0answers
17 views

How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?

I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
38 views

Why more Android applications (compared to iOS) use certificate pinning?

I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning. Is there any explanation as ...
1
vote
1answer
20 views

Why mobile applications share device characteristics with third parties?

It is known that mobile applications can share with third parties many different types of data from information about the device to search terms used in the application. I understand that search ...
1
vote
1answer
67 views

Doesn't this make 2FA irrelevant and possibly dangerous?

Article. One sentence summary: they use a smartphone as a listening device to compromise computer security. I know our bank doesn't allow us to take cell phones in at all, even if they're completely ...
-1
votes
1answer
22 views

Testing attacks on the Signal messaging app [on hold]

I want to verify the security of the Signal messaging app. Signal is said to offer several security features. I want to try several attacks, including attacks that have worked on other more vulnerable ...
0
votes
0answers
25 views

How to mitigate attacks on mobile phone via mobile network, i.e. imsi catchers and other methods to take into account [on hold]

I have AIMSICD installed on my unrooted Galaxy Grand Prime running 5.1.1. I don't connect it to my home router, which I'm assuming as a matter of course has been compromised, or wifi hotspots. I never ...
0
votes
0answers
5 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
-3
votes
0answers
31 views

threema opensource client secure? [closed]

i found a project that support the 'secure messaging client' "Threema" on linux (and even windows). (simple said, Threema is: like a secure Whatsapp Alternative from swizerland - further explanation: ...
3
votes
1answer
73 views

Security of cellular-connected devices

The EFF Secure Messaging Scorecard lists a number of apps that meet all of its security criteria. So assuming that end-to-end encryption is accessible for the majority of people in countries in which ...
0
votes
1answer
39 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
1
vote
0answers
22 views

Are there any Android device dumps available to be used as datasets?

I'm interested in finding Android device data dumps so as to use in my PhD research, concerning data analysis. I have only been able to encounter two sources online; one of them unavailable at the ...
0
votes
0answers
51 views

For multiple clients it's better symmetric or assymetric encryption?

I'm a newbie in the encryption world so I'm here for asking which is the best solution between Symmetric and Asymmetric encryption. In our use cases, we have multiple clients that must be ...
4
votes
2answers
78 views

Out of band verification using phone; a fallacy?

More and more websites nowadays require new users to verify their 'identity' by requesting the user prove that he/she has access to a device identified by a telephone number (typically a phone). The ...
0
votes
1answer
87 views

Does non-persistent data ever need to be encrypted?

Does non-persistent data ever need to be encrypted? If I had a project with confidential data stored in non-persistent class variables should I be doing anything to protect this data? I am developing ...
0
votes
0answers
24 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
5
votes
1answer
488 views

Can mobile network operators read WhatsApp metadata?

After turning on end-to-end encryption for WhatsApp is it possible for the network operators to read the metadata of the messages being exchanged? I see here (in Transport security) that metadata ...
16
votes
1answer
1k views

How does end to end encryption work with whatsapp web?

Since today I have noticed whatsapp is using end to end encryption. However web.whatsapp.com is also still working. Does whatsapp establish a connection with my phone to keep things secure?
0
votes
2answers
53 views

Best way to keep cell day to day phone calls private - is VOIP better?

This question is about preventing eavesdropping by hackers, thieves, or other smart people collecting information for shady purposes. Is it better to buy a smartphone and install a VOIP service on it ...
1
vote
1answer
53 views

Internet of things is what exactly? [closed]

I have found that the term IOT (internet of things) is pretty vague. I am wondering if a mobile device, a cell phone, is this considered a part of the IOT realm? It is a thing, and its connected to ...
1
vote
4answers
102 views

How sensitive are mobile telephone numbers?

A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is stalking you with hiding caller ID find out which provider gave out the number but not ...
5
votes
1answer
2k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
2
votes
1answer
62 views

Is it possible to know imei number of other mobile using any sort of wireless technology?

Are there methods to grab imei numbers of mobiles irrespective of smart or ordinary using Bluetooth or similar wireless technologies. Case : other mobile may not have Bluetooth or possibly switched ...
-2
votes
1answer
60 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
1
vote
1answer
56 views

COPE vs. BYOD - as an employee why should I be interested in BYOD? [closed]

I am curios what is the motivation for employees to go with BYOD? As an employee why I should want to allow installation of MDM solution on my smartphone?
0
votes
2answers
207 views

Why does Telegram not use end-to-end encryption? [closed]

Signal and Telegram are both mobile applications that "try" to ensure secure chats. Signal uses end-to-end encryption, Telegram does this as well (in 'secret chats') but it does not use end-to-end ...
58
votes
3answers
5k views

Why aren't IMSI catchers rendered ineffective by standard MITM defenses?

There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications. ...
31
votes
4answers
2k views

How do I verify HTTPS connections in Mobile apps?

There are a lot of mobile apps nowadays with payment gateways support. However, unlike desktop browsers, these mobile apps do not show us an 'Address bar' by which we can identify a HTTPS connection. ...
3
votes
0answers
75 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
2
votes
1answer
38 views

What are the security implications of installing an iPhone configuration profile?

What are the security risks of installing a "configuration profile" on iOS from www.vshare.com? I don't know what a configuration profile is or what it does. They are found in Settings > General > ...
2
votes
1answer
113 views

T-Mobile WWAN IP address is DoD Network Information Center? [closed]

I wrote an app that grabs the IP address of my Wifi as well as the WWAN i.e. the data part of my Tmobile plan. I have an iPhone. Here is what my app prints. I use pretty standard code to obtain the ...
2
votes
2answers
44 views

Apple's OTA update process

When reading the iOS security doc, on page 6, it discusses the OTA update process. The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, ...
-2
votes
1answer
67 views

Can someone send popup message to all mobile network users?

Can you detect all users in the same network cellular or mobile network as you? Is it possible to send SMS or broadcast popup message from your mobile phone to other mobile users in your proximity?
1
vote
2answers
66 views

Blackphone - Silentcircle - mobile apps

i have question about blackphone (silent circle). Is there any advantage over other mobile phones if i want to use third party mobile apps? So if I agree with terms of use of some applications, ...
11
votes
3answers
1k views

Why is my phone connection secure without a password when WiFi is not even with a password?

When I talk on the phone or send text messages, I never need to type a userid and password. But when I use WiFi I need to use a password. How is the phone connection secured without a password, and ...
0
votes
2answers
68 views

Is there a way to uniquely identify a mobile device through packet sniffing?

I need to uniquely identify a mobile device using the "ping" packets that it transmits to cellular towers regularly, in an area of interest by installing a packet sniffer at that location? I only need ...
3
votes
4answers
118 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
-5
votes
1answer
66 views

Mobile number tracking

Is there any way we can track our mobile when it is lost? I have done a google search on the same and found that we have websites which give us the details of where the SIM was purchased & ...
10
votes
1answer
187 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
2
votes
1answer
56 views

Is it completely safe to store the unencrypted credentials within a variable in the ios device

Overview is we encrypt the credentials using the pincode as the passphrase that the user also sets. One of the requirements is to NEVER SAVE THE PINCODE anytime anywhere. Everytime the user goes out ...
1
vote
1answer
89 views

Android app permission warning: how serious?

Installed a snow emergency parking app published by my city. My android phone warned me that it asks for dangerous permissions. Namely action_boot_completed, get_accounts. It seems strange that a ...
-2
votes
1answer
92 views

Possible phone tapping [closed]

Only when one of my contacts calls me (my son) when I pick up there is somebody else on the line, usually with a foreign accent. When I hang up and called my son, he confirms he made the call and ...
3
votes
2answers
121 views

Risks of lending/borrowing a SIM card temporarily?

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is ...
4
votes
1answer
49 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
0
votes
1answer
50 views

Verifying that an Android banking app checks that the certificate is trusted

I have a closed source banking app on my unrooted Android phone. I'd like to verify the following: The app uses SSL to communicate with the server The app verifies that the SSL certificate of the ...
1
vote
0answers
26 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
-2
votes
1answer
58 views

Is my iPhone 6S Plus compromised? [closed]

Is it usual practice on an iPhone 6S Plus for the wifi and Bluetooth addresses to be identical except for the very last number? One ends in .44 and the other .45. I've also had a lot of weird things ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
0
votes
0answers
421 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
31 views

GPS security standards

Are there any GPS (global position) security standards to secure any kind of GPS implementation? For e.g GPS software coding standards, GPS traffic encryption standards? I asked because nowadays there ...
6
votes
2answers
111 views

Why should you clear your pasteboard when exiting your app?

I've been scanning an iOS application of mine and the highest risk vulnerability appears to be that the pasteboard is not getting cleared when I terminate the application. I don't want the user to ...