Questions tagged [mobile]

Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].

Filter by
Sorted by
Tagged with
1 vote
0 answers
39 views

Photos are recoverable but videos are not on my vivo x27 phone [closed]

In order to test data recovery apps, I have conducted experiments where I took photos and videos, deleted them permanently, then attempted to recover them immediately. The photos can be recovered ...
pxc3110's user avatar
  • 11
0 votes
0 answers
93 views

Opening a mobile banking app in an unknown Wifi [duplicate]

At Travel.SE, we have an HNQ: How to make my credit card "less" secure for travel? about how to reduce the number of false credit card declines when traveling abroad. The current top answer ...
Stephan Kolassa's user avatar
1 vote
0 answers
135 views

Is it normal for ns.sipgeo.t-mobile.com to bypass DNS and VPN settings on iOS, iPadOS, and macOS? [closed]

I’ve been using NextDNS to monitor DNS lookups on my devices in an effort to figure out how they’re being remotely controlled and I notice that ns.sipgeo.t-mobile.com is simply able to bypass both DNS ...
Patrick Dark's user avatar
1 vote
1 answer
315 views

Is it secure to use session ID as authentication token received from an HTTP header?

I am writing a mobile application for an already existing web app. In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
TommyGun's user avatar
2 votes
2 answers
356 views

Does Signal store mobile phone numbers server-side in plain text?

Does Signal (the company) keep or ever have mobile phone numbers in plaintext (on any form of server-side storage)? I searched the web and couldn't find an official statement/documentation/answer/code/...
Adam Monsen's user avatar
1 vote
0 answers
108 views

Are banks significantly reducing security by migrating everyone to mobile banking?

I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
TooTea's user avatar
  • 851
1 vote
1 answer
835 views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 141
0 votes
0 answers
162 views

Bypassing AES encryption if the keys are not in local,but in server

When I conduct a mobile pentest, I have run into payload encryption in HTTP traffic. In general, the AES key and IV ( initialization vector) are located in APK, and can be used to encrypt the payload ...
Not a Salmon Fish's user avatar
1 vote
0 answers
131 views

How to pentest apps running on HarmonyOS

I could not find any checklist for pentesting apps on HarmonyOS. I know HarmonyOS is based on Android, and all Android applications work on HarmonyOS if I use hms instead of gms. So would an Android ...
Firat's user avatar
  • 13
1 vote
0 answers
84 views

Caller hijacking in Croatia [closed]

I got this issue today and I'm completely confused. Here is the story: I'm from Germany and on vacation in Croatia (all inside the EU with EU Roaming) with my German cellphone and German sim card. I ...
m4rc0's user avatar
  • 11
1 vote
1 answer
239 views

Can mobile hardware have backdoor access to camera, microphone that bypasses operating system?

I found out about AOSP variants such as Calyx, Graphene, etc. They promise increased security. I want to know if hardware backdoors can allow access to the camera, microphone, etc. and subsequently ...
Vishal's user avatar
  • 13
1 vote
1 answer
278 views

Bypassing root detection qualify as a vulnerability?

I am working on security testing of an android application. There is a root detection in the Android application. objection, frida etc. It is possible to bypass this with ways. My main question is: ...
Exnovan's user avatar
  • 35
1 vote
0 answers
96 views

Is Android SOS being used as privilege escalation or settings bypass?

I have been getting random SOS countdowns triggered on my phone. Every time this happens, a pop-up appears telling me that unknown numbers have been temporarily unblocked. The most recent instance was ...
Miles's user avatar
  • 111
2 votes
1 answer
1k views

Re-authentication with biometrics in a mobile app using access token

My mobile app has this (fairly common) authentication user experience: user signs in with email and password user is prompted to enable biometrics for faster access next time when user returns to app ...
Tamlyn's user avatar
  • 175
47 votes
2 answers
12k views

Does rebooting a phone daily increase your phone's security?

Recently, the Australian Prime Minister Anthony Albanese gave some advice to regularly reboot your phone to boost its security. Apparently this advice is somewhat commonly given to legislators. This ...
Cold Fish's user avatar
  • 573
1 vote
1 answer
154 views

One Time Password Mobile phone authentication

Can the Mobile phone One Time Password authentication be alphanumeric with special characters? If Yes, There will be more pros and less cons with increased security? One Time password Can a One Time ...
Prashant Akerkar's user avatar
1 vote
0 answers
123 views

How to know if my iPhone has spyware [duplicate]

Is there a way I can check if my phone is being tapped or monitored by a spy app? I’ve updated security patches but I am still not ok with that. Any advice?
Quietude's user avatar
5 votes
1 answer
205 views

Protection of API from abuse (signup and carding attacks)

I have a backend (API) and mobile apps. Mobile apps user use same client_id (Oauth2). Now I see many Bots signing up, adding credit card for checking them (carding) I cannot throttle, limit them since ...
dev's user avatar
  • 997
2 votes
0 answers
129 views

Storing encrypted data in iOS keychain

In my Unity app in C# I am using a 3rd party script which allows me store and retrieve data using iOS keychain. The stored data is a private user generated key which is used to encrypt data before ...
Ando's user avatar
  • 133
1 vote
1 answer
523 views

Can smartphone eavesdrop on conversations while in your pocket?

Suppose I have a cellphone in my pocket, and it is running a malicious app or malicious code, and I am having an in-person conversation with another person. Is it possible for my phone to capture my ...
D.W.'s user avatar
  • 99.6k
1 vote
1 answer
130 views

Encrypted user data and storing hashed RSA keys on the server for backup reasons

Imagine a mobile app that connects to an API server. Disclaimer I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives. The goal The backend/database super ...
Laisender's user avatar
  • 111
2 votes
1 answer
224 views

Benefits of certificate pinning to leaf with intermediate as a backup?

According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup. Any security measure is only as good ...
jon's user avatar
  • 121
2 votes
1 answer
189 views

MSTG-ARCH-3 What means?

In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes: "A high-level architecture for the mobile app and all connected remote services has ...
Luiz Filipe's user avatar
2 votes
1 answer
853 views

Best Way to handle Authorization tokens on mobile apps

in our organization we have our own OpenId server (Identity Server) that we use to authenticate people into our applications, let me explain how we currently handle our web clients. so we have an API ...
MoTahir's user avatar
  • 121
9 votes
5 answers
3k views

Identify someone using a double identity by tracing phone use common to the two 'identities'?

Thriller novelist here looking to get something right. I have a character who uses an alias. I have two scenarios I'm trying to have play out... At some point, they have sent emails from the same ...
Andrew Raymond Books's user avatar
1 vote
0 answers
129 views

MobSF Android Activity APK Pentest

it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it: Under HARDCODED_SECRETS in MobSF, ...
Mr John's user avatar
  • 11
2 votes
1 answer
170 views

Is there such a thing as a dedicated mobile phone for mobile application security testing?

There are pentest OS distributions, like Kali Linux, and there's also Hak5 and their physical pentest gadgets. I was wondering if there is such a phone for mobile pentesting. Nowadays, with ...
kylie32's user avatar
  • 21
2 votes
1 answer
565 views

Mobile network APN: security implications of "Authentication type" equal "None"

My mobile network provider instructs me to set up my APN by resetting everything to default, and then only changing APN to their value. I see that this leaves the setting Authentication type as None. ...
Jan Żankowski's user avatar
1 vote
0 answers
2k views

Can I know if someone transferred files from my mobile to their computer

If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
Shekar Bodhanapu's user avatar
1 vote
0 answers
107 views

Limit admin rights requested by Exchange Active Sync mail account on mobile phone

Background: Setting up an organisational Exchange mail account on a private mobile phone (Android) using Active Sync, one has to accept quite extensive administrative rights for the Exchange mail ...
Martin's user avatar
  • 335
2 votes
1 answer
2k views

Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?

I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps. Frankly, the applications I test are critical bank ...
Exnovan's user avatar
  • 35
2 votes
1 answer
491 views

Avoid QR/Barcode duplicates for fake product identification

I'm developing an app for a college project to detect fake products. The idea is to scan a QR or barcode and the app will automatically tell you if the product is either original or fake. How to avoid ...
Ale26's user avatar
  • 23
1 vote
1 answer
134 views

How do I prevent cell tracking

Can my phone be "locked onto" by a person sitting in a vehicle outside my house and thereafter tracked? If a person simply gets my cell number, can the phone then be tracked? If I buy a pay-...
David Griffiths's user avatar
2 votes
1 answer
67 views

Mobile App Security for Spotify [closed]

This is a little bit crazy. A long time ago, I created a Spotify account using Facebook credentials. A few years ago, I stopped my premium subscription, deleted Spotify from all devices and didn't ...
Ghassan Karwchan's user avatar
3 votes
0 answers
421 views

Cell tower to cell phone encrypted communication

I have done some search here but I can't understand how phones and antennas share the keys used for encryption and decryption. As far as I understand, mobile phones today use LTE i.e 4G (sometimes ...
Mah Neh's user avatar
  • 35
0 votes
1 answer
87 views

What are the methods to prevent and detect front-end behavior alterations in mobile apps?

I don't know the technical possibilities of this attack, but the scenario as I will explain below sounds probable. So here it is. I have a mobile app that does computation on the users phone and send ...
Hileamlak Yitayew's user avatar
1 vote
1 answer
99 views

Static react native app security issues

I am creating a react native mobile application using Expo. This app simply renders information - there is no data collection or entry, no user accounts, no database (other than JSON storage). There ...
server_unknown's user avatar
2 votes
0 answers
338 views

Storing app specific PINs on mobile devices for local authentication

Are there any best practices for storing app specific PINs (e.g. 6 digit PIN that isn't part of the device lock screen) on mobile devices (Android/iOS)? I know several banking and authenticator apps ...
user1118764's user avatar
2 votes
0 answers
91 views

Why did attackers try to change billing address in a SIM swap attack?

Recently, we saw a spat of sim swap attacks against some of our users in my organization. It was a unusually high number of "number transfer" requests being sent out by a mobile carrier. ...
user92592's user avatar
  • 554
1 vote
0 answers
26 views

Safest way to wipe sensitive information off company phone before giving it away [duplicate]

We have a lot of devices in my company that we use to test and after some years some of them become unsupported. We are thinking about selling some of the ones that are not used any more but worry ...
papakias's user avatar
  • 215
2 votes
1 answer
541 views

Best practice to encrypt data on smartphone

What is best practice for the encryption of offline application data? I have an application where multiple users can log in. The user gets data from an internet API, where the user authenticates. I ...
Donatic's user avatar
  • 121
3 votes
1 answer
122 views

Mobile Application Security

Do we need to carry out separate pentest for apps that are written in language that supports multi platform compilation like fultter? How much value it will bring since backend and major chunk of code ...
Syed Anas's user avatar
  • 131
5 votes
0 answers
493 views

How does end-to-end encryption work with whatsapp web as of 2022?

The accepted answer to this question is now outdated, since Whatsapp web does not require an online smartphone to function anymore. How is the key exchange performed securely?
Federico Poloni's user avatar
2 votes
1 answer
150 views

How do companies like UberMedia/Near locate the home addresses of people who were detected somewhere else?

This news article (cited in this other question) shows that the company UberMedia (now rebranded Near) can retrieve the location of people's home from persons attending an event. How does this company ...
A. Hersean's user avatar
  • 10.6k
2 votes
0 answers
156 views

Allow the use of camera phones in the manufacturing facilities; but then how do I maintain the security of the premises

What are the best practices to be followed to maintain security in the manufacturing site where camera phones are allowed? I'm working on one of the largest manufacturing facility where few of the R&...
Baranikumar Venkatesan's user avatar
2 votes
1 answer
217 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user842225's user avatar
4 votes
2 answers
984 views

Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying

I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals ...
CT-Asker's user avatar
2 votes
0 answers
220 views

Is using a second hand/grey market phone for banking security a credible risk?

I asked this question in money about telling my bank about using a second hand or grey market mobile phone. The the implication of some of the comments is that any worry is misplaced. It seems to me ...
User65535's user avatar
  • 151
2 votes
0 answers
81 views

What are the pitfalls of adding a corporate eSIM to an unmanaged employee device in lieu of land-line phones?

Instead of having a landline at each employee's desk, allow them to add an eSIM to a compatible personal cell phone. (If possible, disable SMS for the added eSIM so it is acting as a replacement for ...
PlasticCasio's user avatar
2 votes
0 answers
183 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
Struggler's user avatar

1
2 3 4 5
22