Questions tagged [mobile]
Security in mobile devices. Issues concerning regular cellphones, smartphones, tablet computers and other portable information devices all fit into this category. If your question is specific to one of the following, use it instead: [phone], [smartphone], [iphone], [ios], [windows-phone], [android].
1
vote
1answer
31 views
Does mobile phones automatically connect to malformed cellular tower antenna?
I was told that an attacker is able to create fake cellular tower antenna imitator near your mobile phone, and your phone will automatically connect to it, nevertheless the fact,if that antenna has ...
0
votes
1answer
14 views
Disable Office 365 2FA before period of leave without phone?
On enablement of 2FA in Office 365 Admin center, the only offered 2FA methods are
Text message
Call
Notification in Authenticator app
Passcode in Authenticator app
Obviously, all of them require me ...
1
vote
0answers
16 views
Secure API access with mobile apps in restricted environments
In our current project, IT rules prohibit anything that is not PROD to be publicly accessible from the Internet. Access to development and review environments must be severely restricted. That said, ...
-3
votes
0answers
96 views
Somebody is hacking my iPhone [closed]
Somebody has somehow hacked my iPhone and is monitoring everything from my screen to my microphone, cameras and even my location. How do I force them out? I’m not technologically educated. I’m ...
0
votes
1answer
59 views
How I can get MAC address of devices using passive wifi?
There is a project at the university, there are a lot of mobile phones where the wifi works in passive mode and is not connected to an access point. Is it possible to get the MAC address of these ...
0
votes
1answer
42 views
Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?
I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
1
vote
3answers
127 views
How can I detect spyware on a smartphone
I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and ...
0
votes
0answers
20 views
Enterprise Mobile Application Security Options?
Background: Recently we've joined one of the biggest data-driven company. Till now we do not have any mobile developer/architect within company. Now business wants to develop mobile applications for ...
0
votes
0answers
44 views
How to delete data on a “keypad mobile” securely before selling it?
Nokia, Model: C1-01, Type: RM-607
How to delete data on a "keypad mobile" securely before selling it?
0
votes
0answers
53 views
Does a SIM Card provide the cellular radio with temporary keys?
I understand that a SIM card is essentially a self contained computer, on which an algorithm is run that will receive a RAND from a network operator, and use it compute temporary keys (CK and IK) ...
0
votes
0answers
37 views
Two-factor authentication on Galaxy Watch - should secrets be encrypted, and is this SQLite example secure?
I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...
1
vote
0answers
64 views
Fuzzing of Mobile Applications
I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz.
I searched on ...
6
votes
1answer
229 views
Will two smartphones (identical hardware and software) generate the same canvas fingerprint?
When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?
0
votes
1answer
42 views
How do JavaScript (and mobile) APIs keep user data clean?
Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
28 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
3
votes
3answers
210 views
A protocol for encrypting the data on the server, but with a password on a mobile device
I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
1
vote
0answers
79 views
Android WebView JavaScript Enabled
I recently found an Android application, which uses a WebView with enabled JavaScript. In this webview I am able to browse from their provided FAQ page to twitter, and from twitter basically ...
0
votes
1answer
22 views
Basic Auth Credentials on Mobile Device
I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. ...
2
votes
0answers
60 views
Can (the carrier of) a caller/callee see the position of the other ones mobile phone?
Someone came to me with the following request:
He/She wants to drive somewhere without the employer knowing in his/her free time. If the employer will know about the drive, it will be bad for his/her ...
4
votes
2answers
156 views
Upload malware to F-Droid repo?
What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
2
votes
2answers
88 views
How to protect API endpoint from abuse in mobile App?
Let's assume I have a mobile app that fetches the news feed from an url on my server.
GET/ https://example.com/api/v1/newsfeed
Is there a way to restrict the access to this endpoint to only from ...
1
vote
2answers
113 views
Prevent Text Spoofing - Best methods
In an enterprise environment we have been inundated with spoof texts appearing to be from the corporate office.
After much research it appears Verizon isn't able to assist. Just wondering if anyone ...
3
votes
0answers
95 views
What is the most secure NFC Encryption system? [closed]
What are the best ways for NFC (Near-field communication) encryption with high level of security?
Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
2
votes
0answers
51 views
Risk that apps with access to your saved files and camera roll get a hold of all your saved files and photos [closed]
Since I made pictures of some documents that should never be released to the public I was wondering how high the risks actually are, that the pictures I made have been "saved" by some of my apps, or ...
8
votes
3answers
239 views
Is a second, “old” (dumb) phone dedicated just to receiving bank tokens as safe as “modern” (smart) phone?
Are old phones safer / safe / as safe as modern smartphones when it comes to auth-tokens / confirmations tokens?
Is SMS encrypted?
1
vote
3answers
183 views
How to prevent unauthorized users from accessing an image on my server just by URL?
I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
2
votes
0answers
39 views
How to give end users access to accounts previously only administered by managers?
I have a question about how to handle a somewhat unique authentication situation.
We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
0
votes
1answer
233 views
4G Pocket WiFi - IMSI Catcher?
Nearly all mobile phones are vulnerable to IMSI catcher attack's fake mobile networks. They can access storage, inject rootkits/backdoors, turn the microphone on view internet traffic even with a VPN ...
4
votes
1answer
102 views
GSM - Implementing Cipher Mode Command on YateBTS
I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!?
I use the combination of BladeRF x40 FPGA and ...
0
votes
1answer
96 views
Does the device you are logging into count as one of the factors for MFA when you are using device biometrics? [duplicate]
Yes it does because
I 'have' the physical device
I 'am' the owner of the fingerprint
But no it doesn't because
1=>2 : If you have my device the fingerprint is now something you can get.
Which ...
0
votes
2answers
641 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
102 views
Can smartphone app be hacked by wifi?
We all know that it is possible to spy on other people in the same wifi network, even if it is difficult.
What about apps, like Facebook app for Android? Is it similar to an https website so it is ...
1
vote
0answers
50 views
What are the security implications of using an iPhone purchased in China
I recently bought an iPhone off Craigslist, but It's come to my attention that the phone was purchased by it's original owner in China (The model no is: A1528). Are there any security implications if ...
-1
votes
1answer
110 views
Surveillance by mobile network provider
I am customer of Vodafone Germany as my mobile network provider. After extension of my RED S mobile contract i realized, that the option "Vodafone Secure Net" is enforced by the company without ...
0
votes
1answer
117 views
Fake bank text message
I recently tried to use my card to buy something on my phone for £29.99. My card was declined so I used a different card and the payment went through.
A couple minutes later I get a message from a ...
514
votes
18answers
108k views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
1
vote
1answer
80 views
Mobile application authentication using UUID
I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is:
When user signs in, device sends username and ...
0
votes
1answer
260 views
Mobile call encryption [duplicate]
Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...
25
votes
6answers
5k views
Why do apps with phone verification send the user a message, rather than have the user send one to them?
Many apps allow the user to authenticate with their phone number, by having the user enter it, and then sending an SMS with a code to be entered into the app. Very few (if any that I can find still ...
0
votes
2answers
98 views
What tests can be performed on mobile apps to determine if they are secure?
My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
3
votes
2answers
205 views
Authenticate user based on mobile device identifier
I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
235 views
Is there a way to secure an API key on iOS?
When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
1
vote
0answers
78 views
How do third party providers remove the SIM lock on a mobile phone?
There are third party providers online who offer to remove the SIM lock on mobile phones, by emailing the unlock code. All they ask for is the phone's IMEI and the network provider's name.
In one ...
-1
votes
1answer
276 views
How to make QR Code uncopyable - Scanning of the QR Code at consumer level [closed]
I am designing a Consumer Protection System for import products on Blockchain technology. My Client wants to use QR Code instead of Security Tax Stamp. How can we make QR Code uncopyable at the ...
0
votes
0answers
63 views
How to make screensavers secure?
For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to ...
1
vote
1answer
50 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
1
vote
0answers
112 views
What kinds of attacks are possible on 3G/4G routers [closed]
How much more or less secure is using a mobile (3G/4G) router to connect to the internet?
I know using tor over the internet should render eavesdropping useless, but excluding physical access, what ...
0
votes
3answers
112 views
Should I block a user from using banking app if they fake the location?
I was wondering if this could be a security issue for banking application and if so, why? What are the risks if I allow it?
1
vote
2answers
63 views
Protecting payment mobile app against mobile theft
Currently I'm designing a payment app.
It has the standard security controls such as HTTPS communication, certificate pinning, no cache, login with 2FA (OTP), 2FA for payment operation.. but I'm not ...
1
vote
0answers
375 views
What data is bitmoji keyboard collecting about me?
Bitmoji is a virtual keyboard for iOS and Android to create personalized emojis (very paraphrased). I've found a few blogs looking at the permissions it requests and the privacy policy that it shares ...
